Releases: CycloneDX/cyclonedx-gomod
v1.0.0
Changelog
Enhancements
- Introduce multi-command CLI (#42 via #45)
- Output SBOMs in v1.3 of the CycloneDX specification (#43 via
5bab19b) - Add support for application SBOMs (#44 via #50)
- Add support for binary SBOMs (#21 via #46)
- Include applicable build constraints in application SBOMs (#29 via #59)
- Add license detection support for binary SBOMs (#51 via #52)
- Generate pseudo versions using
golang.org/x/mod(#55 via #57) - Use license evidence for detected licenses (#40 via #49)
- Build with and test against Go 1.17 (via #54)
- Introduce improved logging (via #46)
- Add indication for which application the SBOM was generated for (#67 via #71)
- Slightly reduce threshold for license detection confidence, and log a debug message if this threshold isn't met (#79 via #80)
- Thanks TheDiveO for reporting!
Fixes
- Fix annotated tags not being recognized as versions (#56 via #57)
- Fix normalized versions interfering with hash calculation (#58 via #60)
- Fix
appcommand missing dependencies whenmainpackage is spread across multiple files (#75 via #78)
Breaking Changes
- The CLI now consists of multiple subcommands, thus being incompatible with the CLI in cyclonedx-gomod
v0.x - Detected licenses (when using the
-licensesflag) will now use thecomponents/evidence/licensesnode instead ofcomponents/licenses. Tools that consume SBOMs and don't support CycloneDX v1.3 yet may not recognize those licenses - Version normalization has been removed (#60). As a consequence,
+incompatiblesuffixes andvprefixes (-novprefixflag inv0.x) are not trimmed anymore - The
-reproducibleflag has been removed (via9b45f4a)
Dependency Updates
- Update
github.com/CycloneDX/cyclonedx-gofromv0.3.0tov0.4.0(via5bab19b) - Update
golang.org/x/modfromv0.4.2tov0.5.1(via #57 and088f0e3) - Update
golang.org/x/cryptofromv0.0.0-20210711020723-a769d52b0f97tov0.0.0-20210817164053-32db794688a5(via75ae52a)
Building and Packaging
- Produce and publish an SBOM for each binary built when releasing (via #62)
- Builds for
windows/386andlinux/386have been dropped (via #62) - Use standard Go notation for architectures in release artifact names (via #62)
- e.g.
cyclonedx-gomod_1.0.0_windows_x64.zipis nowcyclonedx-gomod_1.0.0_windows_amd64.zip
- e.g.
Commits since v1.0.0-beta.2
6276d83 feat: decrease min license detection confidence to 0.85 (#80)
b93fc5b refactor: cleanup and cosmetics (#81)
Docker images
docker pull cyclonedx/cyclonedx-gomod:v1.0.0docker pull cyclonedx/cyclonedx-gomod:v1docker pull cyclonedx/cyclonedx-gomod:v1.0
v1.0.0-beta.2
v1.0.0-beta.1
v1.0.0-beta.0
Changelog
0b09de5 Enable CodeQL Security Scan (#47)
ac53b42 build: update go directive in go.mod to go 1.17
c87bbaa chore(deps): update github.com/rs/zerolog from v1.23.0 to v1.25.0
75ae52a chore(deps): update golang.org/x/crypto to v0.0.0-20210817164053-32db794688a5
088f0e3 chore(deps): update golang.org/x/mod from v0.5.0 to v0.5.1
be6a7f6 ci: cleanup ci workflow
4a9c43e ci: don't build against go 1.16 anymore
43e1e14 feat: add application name as property and update purl with subpath to application (#71)
70ea280 feat: disable colored log output when running in ci (#70)
Docker images
docker pull cyclonedx/cyclonedx-gomod:v1.0.0-beta.0docker pull cyclonedx/cyclonedx-gomod:v1docker pull cyclonedx/cyclonedx-gomod:v1.0
v1.0.0-alpha.4
Changelog
d44cc3f build: produce an sbom for each binary built (#62)
d577c40 fix: provide error details when resolving replacements failed
cc50b11 fix: resolve local module in app command
b04354b misc: cosmetic tweaks
5221f2a refactor: remove version normalization (#60)
Docker images
docker pull cyclonedx/cyclonedx-gomod:v1.0.0-alpha.4docker pull cyclonedx/cyclonedx-gomod:v1docker pull cyclonedx/cyclonedx-gomod:v1.0
v1.0.0-alpha.3
v1.0.0-alpha.2
v1.0.0-alpha.1
v1.0.0-alpha.0
Changelog
0cbc174 ci: build and test against go 1.17 (#54)
9cff325 ci: build prs to develop-v1.0.0 as well
e93ff2d feat: add license resolution support for bin command (#52)
2b197e4 feat: generate sboms from binaries (#46)
edd71cb feat: use license evidence for detected licenses (#49)
d5e9f22 fix: ensure binary path is not a directory
404d7ee introduce multi-command cli (#45)
aee6d77 refactor: remove spdx code (#48)
2cb46a5 update cyclonedx-cli: 0.15.2 -> 0.17.0
5bab19b update cyclonedx-go: v0.3.0 -> v0.4.0
Docker images
docker pull cyclonedx/cyclonedx-gomod:v1.0.0-alpha.0docker pull cyclonedx/cyclonedx-gomod:v1docker pull cyclonedx/cyclonedx-gomod:v1.0
v0.10.0
Changelog
2d76e87 build: set pseudo version for Makefile builds
370a540 chore: tidy go.mod and go.sum
d975554 chore: update spdx licenses
830142c feat: sort dependencies by path
08d0a50 refactor: add license header to generated file
27eb9c8 refactor: fix inconsistency of b911e74
1dbd74a refactor: handle error when executing template
9a2a1a0 refactor: move spdx files into their own package
aa5c7c8 refactor: transfer copyright to owasp
b911e74 refactor: use common funcs for go command execution
Docker images
docker pull cyclonedx/cyclonedx-gomod:v0.10.0docker pull cyclonedx/cyclonedx-gomod:v0docker pull cyclonedx/cyclonedx-gomod:v0.10