2026年8月19日

關於 SPDX SBOM 的撰寫

關於 SPDX SBOM 的撰寫，若我有以下檔案:
src\config.h
src\debug.h
src\dp8051.h
src\fw_save_rom.c
src\fw_save_rom.h
src\fw_tag.c
src\fw_tag.h
src\hdmitx.c
src\IO.h
src\IO_dp8051.c
src\IO_dp8051_i2c0.c
src\isr.c
src\it66318.c
src\it66318.h
src\ite_typedef.h
src\Main.c
src\mcu.h
src\platform.h
src\STARTUP.A51
src\timer.c
src\typedef.h
src\version.h
IT66318_build.bat
it66318_dp8051.BAT
唯一用到的外部元件為 KeilC, 應該如何撰寫 SBOM?

要為這個專案撰寫 SPDX SBOM（軟體物料清單），最標準且清晰的做法是將其結構化為一個專案（Package）、一組原始碼檔案（Files），以及一個外部建置工具（Dependency Package）。
以下為您規劃 SPDX 2.3 (Tag-Value 格式) 的撰寫架構與具體範本：

核心撰寫邏輯

  1. 專案本身 (Package)：定義您的主程式（例如命名為 MyEmbeddedProject）。
  2. 檔案清單 (File)：將您列出的 22 個原始碼檔案與批次檔逐一表列，並計算其 SHA1/SHA256 雜湊值（Checksum）。
  3. 外部元件 (External Package)：將 Keil C51（或您使用的具體版本）列為一個獨立的 Package。
  4. 關係 (Relationship)：
    • 專案 CONTAINS（包含）這 22 個檔案。
    • 專案 BUILD_TOOL_OF（建置工具關係）依賴於 Keil C。

SPDX SBOM 具體範本

您可以將以下內容儲存為 bom.spdx（文字檔）：
SPDXVersion: SPDX-2.3
DataLicense: CC0-1.0
SPDXID: SPDXRef-DOCUMENT
DocumentName: Embedded-Project-SBOM
DocumentNamespace: https://yourdomain.com
Creator: Organization: Your Company Name
Created: 2026-08-19T02:15:00Z

## ===================================================================
## 主專案資訊 (Package)
## ===================================================================
PackageName: MyEmbeddedProject
SPDXID: SPDXRef-Package-MainProject
PackageVersion: 1.0.0
PackageDownloadLocation: NOASSERTION
FilesAnalyzed: true
PackageVerificationCode: 0000000000000000000000000000000000000000
PackageLicenseConcluded: LicenseRef-Proprietary
PackageLicenseDeclared: LicenseRef-Proprietary
PackageCopyrightText: <text>Copyright (c) 2026 Your Company.</text>
PackageSummary: <text>Firmware project for IT66318 device.</text>

## ===================================================================
## 外部元件：Keil C 建置工具 (Package)
## ===================================================================
PackageName: Keil C51 Compiler
SPDXID: SPDXRef-Package-KeilC
PackageVersion: V9.60a
PackageSupplier: Organization: Arm Keil
PackageDownloadLocation: NOASSERTION
FilesAnalyzed: false
PackageLicenseConcluded: LicenseRef-Proprietary
PackageCopyrightText: <text>Copyright (c) ARM Germany GmbH.</text>
PackageSummary: <text>Toolchain used to compile the 8051 firmware.</text>

## ===================================================================
## 檔案清單 (Files)
## ===================================================================

FileName: ./src/config.h
SPDXID: SPDXRef-File-config-h
FileChecksum: SHA1: 2aae6c35c94fcfb415dbe95f408b9ce91ee846ed
LicenseConcluded: NOASSERTION
FileCopyrightText: NOASSERTION

FileName: ./src/debug.h
SPDXID: SPDXRef-File-debug-h
FileChecksum: SHA1: 3bbf6c35c94fcfb415dbe95f408b9ce91ee846ee
LicenseConcluded: NOASSERTION
FileCopyrightText: NOASSERTION

FileName: ./src/dp8051.h
SPDXID: SPDXRef-File-dp8051-h
FileChecksum: SHA1: 4ccf6c35c94fcfb415dbe95f408b9ce91ee846ef
LicenseConcluded: NOASSERTION
FileCopyrightText: NOASSERTION

FileName: ./src/fw_save_rom.c
SPDXID: SPDXRef-File-fw-save-rom-c
FileChecksum: SHA1: 5ddf6c35c94fcfb415dbe95f408b9ce91ee846f0
LicenseConcluded: NOASSERTION
FileCopyrightText: NOASSERTION

FileName: ./src/fw_save_rom.h
SPDXID: SPDXRef-File-fw-save-rom-h
FileChecksum: SHA1: 6eef6c35c94fcfb415dbe95f408b9ce91ee846f1
LicenseConcluded: NOASSERTION
FileCopyrightText: NOASSERTION

FileName: ./src/fw_tag.c
SPDXID: SPDXRef-File-fw-tag-c
FileChecksum: SHA1: 7ffa6c35c94fcfb415dbe95f408b9ce91ee846f2
LicenseConcluded: NOASSERTION
FileCopyrightText: NOASSERTION

FileName: ./src/fw_tag.h
SPDXID: SPDXRef-File-fw-tag-h
FileChecksum: SHA1: 8aab6c35c94fcfb415dbe95f408b9ce91ee846f3
LicenseConcluded: NOASSERTION
FileCopyrightText: NOASSERTION

FileName: ./src/hdmitx.c
SPDXID: SPDXRef-File-hdmitx-c
FileChecksum: SHA1: 9bbc6c35c94fcfb415dbe95f408b9ce91ee846f4
LicenseConcluded: NOASSERTION
FileCopyrightText: NOASSERTION

FileName: ./src/IO.h
SPDXID: SPDXRef-File-IO-h
FileChecksum: SHA1: 0ccd6c35c94fcfb415dbe95f408b9ce91ee846f5
LicenseConcluded: NOASSERTION
FileCopyrightText: NOASSERTION

FileName: ./src/IO_dp8051.c
SPDXID: SPDXRef-File-IO-dp8051-c
FileChecksum: SHA1: 1dde6c35c94fcfb415dbe95f408b9ce91ee846f6
LicenseConcluded: NOASSERTION
FileCopyrightText: NOASSERTION

FileName: ./src/IO_dp8051_i2c0.c
SPDXID: SPDXRef-File-IO-dp8051-i2c0-c
FileChecksum: SHA1: 2eef6c35c94fcfb415dbe95f408b9ce91ee846f7
LicenseConcluded: NOASSERTION
FileCopyrightText: NOASSERTION

FileName: ./src/isr.c
SPDXID: SPDXRef-File-isr-c
FileChecksum: SHA1: 3ffa6c35c94fcfb415dbe95f408b9ce91ee846f8
LicenseConcluded: NOASSERTION
FileCopyrightText: NOASSERTION

FileName: ./src/it66318.c
SPDXID: SPDXRef-File-it66318-c
FileChecksum: SHA1: 4aab6c35c94fcfb415dbe95f408b9ce91ee846f9
LicenseConcluded: NOASSERTION
FileCopyrightText: NOASSERTION

FileName: ./src/it66318.h
SPDXID: SPDXRef-File-it66318-h
FileChecksum: SHA1: 5bbc6c35c94fcfb415dbe95f408b9ce91ee846fa
LicenseConcluded: NOASSERTION
FileCopyrightText: NOASSERTION

FileName: ./src/ite_typedef.h
SPDXID: SPDXRef-File-ite-typedef-h
FileChecksum: SHA1: 6ccd6c35c94fcfb415dbe95f408b9ce91ee846fb
LicenseConcluded: NOASSERTION
FileCopyrightText: NOASSERTION

FileName: ./src/Main.c
SPDXID: SPDXRef-File-Main-c
FileChecksum: SHA1: 7dde6c35c94fcfb415dbe95f408b9ce91ee846fc
LicenseConcluded: NOASSERTION
FileCopyrightText: NOASSERTION

FileName: ./src/mcu.h
SPDXID: SPDXRef-File-mcu-h
FileChecksum: SHA1: 8eef6c35c94fcfb415dbe95f408b9ce91ee846fd
LicenseConcluded: NOASSERTION
FileCopyrightText: NOASSERTION

FileName: ./src/platform.h
SPDXID: SPDXRef-File-platform-h
FileChecksum: SHA1: 9ffa6c35c94fcfb415dbe95f408b9ce91ee846fe
LicenseConcluded: NOASSERTION
FileCopyrightText: NOASSERTION

FileName: ./src/STARTUP.A51
SPDXID: SPDXRef-File-STARTUP-A51
FileChecksum: SHA1: 0aab6c35c94fcfb415dbe95f408b9ce91ee846ff
LicenseConcluded: NOASSERTION
FileCopyrightText: NOASSERTION

FileName: ./src/timer.c
SPDXID: SPDXRef-File-timer-c
FileChecksum: SHA1: 1bbc6c35c94fcfb415dbe95f408b9ce91ee84700
LicenseConcluded: NOASSERTION
FileCopyrightText: NOASSERTION

FileName: ./src/typedef.h
SPDXID: SPDXRef-File-typedef-h
FileChecksum: SHA1: 2ccd6c35c94fcfb415dbe95f408b9ce91ee84701
LicenseConcluded: NOASSERTION
FileCopyrightText: NOASSERTION

FileName: ./src/version.h
SPDXID: SPDXRef-File-version-h
FileChecksum: SHA1: 3dde6c35c94fcfb415dbe95f408b9ce91ee84702
LicenseConcluded: NOASSERTION
FileCopyrightText: NOASSERTION

FileName: ./IT66318_build.bat
SPDXID: SPDXRef-File-IT66318-build-bat
FileChecksum: SHA1: 4eef6c35c94fcfb415dbe95f408b9ce91ee84703
LicenseConcluded: NOASSERTION
FileCopyrightText: NOASSERTION

FileName: ./it66318_dp8051.BAT
SPDXID: SPDXRef-File-it66318-dp8051-BAT
FileChecksum: SHA1: 5ffa6c35c94fcfb415dbe95f408b9ce91ee84704
LicenseConcluded: NOASSERTION
FileCopyrightText: NOASSERTION

## ===================================================================
## 關聯性定義 (Relationships)
## ===================================================================
# 專案包含所有檔案
Relationship: SPDXRef-Package-MainProject CONTAINS SPDXRef-File-config-h
Relationship: SPDXRef-Package-MainProject CONTAINS SPDXRef-File-debug-h
Relationship: SPDXRef-Package-MainProject CONTAINS SPDXRef-File-dp8051-h
Relationship: SPDXRef-Package-MainProject CONTAINS SPDXRef-File-fw-save-rom-c
Relationship: SPDXRef-Package-MainProject CONTAINS SPDXRef-File-fw-save-rom-h
Relationship: SPDXRef-Package-MainProject CONTAINS SPDXRef-File-fw-tag-c
Relationship: SPDXRef-Package-MainProject CONTAINS SPDXRef-File-fw-tag-h
Relationship: SPDXRef-Package-MainProject CONTAINS SPDXRef-File-hdmitx-c
Relationship: SPDXRef-Package-MainProject CONTAINS SPDXRef-File-IO-h
Relationship: SPDXRef-Package-MainProject CONTAINS SPDXRef-File-IO-dp8051-c
Relationship: SPDXRef-Package-MainProject CONTAINS SPDXRef-File-IO-dp8051-i2c0-c
Relationship: SPDXRef-Package-MainProject CONTAINS SPDXRef-File-isr-c
Relationship: SPDXRef-Package-MainProject CONTAINS SPDXRef-File-it66318-c
Relationship: SPDXRef-Package-MainProject CONTAINS SPDXRef-File-it66318-h
Relationship: SPDXRef-Package-MainProject CONTAINS SPDXRef-File-ite-typedef-h
Relationship: SPDXRef-Package-MainProject CONTAINS SPDXRef-File-Main-c
Relationship: SPDXRef-Package-MainProject CONTAINS SPDXRef-File-mcu-h
Relationship: SPDXRef-Package-MainProject CONTAINS SPDXRef-File-platform-h
Relationship: SPDXRef-Package-MainProject CONTAINS SPDXRef-File-STARTUP-A51
Relationship: SPDXRef-Package-MainProject CONTAINS SPDXRef-File-timer-c
Relationship: SPDXRef-Package-MainProject CONTAINS SPDXRef-File-typedef-h
Relationship: SPDXRef-Package-MainProject CONTAINS SPDXRef-File-version-h
Relationship: SPDXRef-Package-MainProject CONTAINS SPDXRef-File-IT66318-build-bat
Relationship: SPDXRef-Package-MainProject CONTAINS SPDXRef-File-it66318-dp8051-BAT

# Keil C 是此專案的建置工具
Relationship: SPDXRef-Package-KeilC BUILD_TOOL_OF SPDXRef-Package-MainProject

注意事項與實務調整

  • 雜湊值（FileChecksum）：上列範本中的 SHA1 值為虛擬範例。您需要使用工具（如 PowerShell 的 Get-FileHash -Algorithm SHA1 <檔案> 或 Linux 的 sha1sum）算出每個檔案真實的雜湊值並貼入。
  • 專案驗證碼（PackageVerificationCode）：這是 SPDX 用來確保 Package 內容未被竄改的機制。它是將專案內所有檔案的 SHA1 值排序後再次計算出的雜湊值。若手寫嫌繁瑣，實務上可暫時填 0000...，或直接使用自動化工具（如 ntia-conformance-checker 或官方的 spdx-tools）來產生這行。
  • 授權條款（License）：
    • 範本中檔案皆預設為 NOASSERTION（未特別聲明）。
    • 專案本身設定為 LicenseRef-Proprietary（專有/私有軟體），您可以根據公司政策修改。
  • Keil C 版本：請記得將 PackageVersion: V9.60a 修改為您團隊實際使用的 Keil 版本（如 C51 V9.61 等），這對於漏洞溯源（Vulnerability Tracking）非常重要。
請問您需要將此範本轉換為 JSON 格式 嗎？或者您希望了解如何使用自動化工具（例如 ntia-conformance-checker）來驗證這份 SBOM 的合規性？

如以 SPDX  格式如何撰寫?

加上剛才介紹的 Tag-Value（.spdx 文字檔）格式，SPDX 官方也完全支援並推薦使用現代系統更容易解析的 JSON 格式。
以下為您提供符合 SPDX 2.3 規範的 JSON 完整範本。此格式非常適合用於 CI/CD 自動化流程與漏洞掃描工具：

SPDX JSON 格式範本

您可以將以下內容儲存為 bom.spdx.json：
{
  "spdxVersion": "SPDX-2.3",
  "dataLicense": "CC0-1.0",
  "SPDXID": "SPDXRef-DOCUMENT",
  "name": "Embedded-Project-SBOM",
  "documentNamespace": "https://yourdomain.com",
  "creationInfo": {
    "creators": [
      "Organization: Your Company Name"
    ],
    "created": "2026-08-19T02:15:00Z"
  },
  "packages": [
    {
      "name": "MyEmbeddedProject",
      "SPDXID": "SPDXRef-Package-MainProject",
      "versionInfo": "1.0.0",
      "downloadLocation": "NOASSERTION",
      "filesAnalyzed": true,
      "packageVerificationCode": {
        "packageVerificationCodeValue": "0000000000000000000000000000000000000000"
      },
      "licenseConcluded": "LicenseRef-Proprietary",
      "licenseDeclared": "LicenseRef-Proprietary",
      "copyrightText": "Copyright (c) 2026 Your Company.",
      "summary": "Firmware project for IT66318 device.",
      "hasFiles": [
        "SPDXRef-File-config-h", "SPDXRef-File-debug-h", "SPDXRef-File-dp8051-h",
        "SPDXRef-File-fw-save-rom-c", "SPDXRef-File-fw-save-rom-h", "SPDXRef-File-fw-tag-c",
        "SPDXRef-File-fw-tag-h", "SPDXRef-File-hdmitx-c", "SPDXRef-File-IO-h",
        "SPDXRef-File-IO-dp8051-c", "SPDXRef-File-IO-dp8051-i2c0-c", "SPDXRef-File-isr-c",
        "SPDXRef-File-it66318-c", "SPDXRef-File-it66318-h", "SPDXRef-File-ite-typedef-h",
        "SPDXRef-File-Main-c", "SPDXRef-File-mcu-h", "SPDXRef-File-platform-h",
        "SPDXRef-File-STARTUP-A51", "SPDXRef-File-timer-c", "SPDXRef-File-typedef-h",
        "SPDXRef-File-version-h", "SPDXRef-File-IT66318-build-bat", "SPDXRef-File-it66318-dp8051-BAT"
      ]
    },
    {
      "name": "Keil C51 Compiler",
      "SPDXID": "SPDXRef-Package-KeilC",
      "versionInfo": "V9.60a",
      "supplier": "Organization: Arm Keil",
      "downloadLocation": "NOASSERTION",
      "filesAnalyzed": false,
      "licenseConcluded": "LicenseRef-Proprietary",
      "copyrightText": "Copyright (c) ARM Germany GmbH.",
      "summary": "Toolchain used to compile the 8051 firmware."
    }
  ],
  "files": [
    { "fileName": "./src/config.h", "SPDXID": "SPDXRef-File-config-h", "checksums": [{ "algorithm": "SHA1", "checksumValue": "2aae6c35c94fcfb415dbe95f408b9ce91ee846ed" }], "licenseConcluded": "NOASSERTION", "copyrightText": "NOASSERTION" },
    { "fileName": "./src/debug.h", "SPDXID": "SPDXRef-File-debug-h", "checksums": [{ "algorithm": "SHA1", "checksumValue": "3bbf6c35c94fcfb415dbe95f408b9ce91ee846ee" }], "licenseConcluded": "NOASSERTION", "copyrightText": "NOASSERTION" },
    { "fileName": "./src/dp8051.h", "SPDXID": "SPDXRef-File-dp8051-h", "checksums": [{ "algorithm": "SHA1", "checksumValue": "4ccf6c35c94fcfb415dbe95f408b9ce91ee846ef" }], "licenseConcluded": "NOASSERTION", "copyrightText": "NOASSERTION" },
    { "fileName": "./src/fw_save_rom.c", "SPDXID": "SPDXRef-File-fw-save-rom-c", "checksums": [{ "algorithm": "SHA1", "checksumValue": "5ddf6c35c94fcfb415dbe95f408b9ce91ee846f0" }], "licenseConcluded": "NOASSERTION", "copyrightText": "NOASSERTION" },
    { "fileName": "./src/fw_save_rom.h", "SPDXID": "SPDXRef-File-fw-save-rom-h", "checksums": [{ "algorithm": "SHA1", "checksumValue": "6eef6c35c94fcfb415dbe95f408b9ce91ee846f1" }], "licenseConcluded": "NOASSERTION", "copyrightText": "NOASSERTION" },
    { "fileName": "./src/fw_tag.c", "SPDXID": "SPDXRef-File-fw-tag-c", "checksums": [{ "algorithm": "SHA1", "checksumValue": "7ffa6c35c94fcfb415dbe95f408b9ce91ee846f2" }], "licenseConcluded": "NOASSERTION", "copyrightText": "NOASSERTION" },
    { "fileName": "./src/fw_tag.h", "SPDXID": "SPDXRef-File-fw-tag-h", "checksums": [{ "algorithm": "SHA1", "checksumValue": "8aab6c35c94fcfb415dbe95f408b9ce91ee8463" }], "licenseConcluded": "NOASSERTION", "copyrightText": "NOASSERTION" },
    { "fileName": "./src/hdmitx.c", "SPDXID": "SPDXRef-File-hdmitx-c", "checksums": [{ "algorithm": "SHA1", "checksumValue": "9bbc6c35c94fcfb415dbe95f408b9ce91ee846f4" }], "licenseConcluded": "NOASSERTION", "copyrightText": "NOASSERTION" },
    { "fileName": "./src/IO.h", "SPDXID": "SPDXRef-File-IO-h", "checksums": [{ "algorithm": "SHA1", "checksumValue": "0ccd6c35c94fcfb415dbe95f408b9ce91ee846f5" }], "licenseConcluded": "NOASSERTION", "copyrightText": "NOASSERTION" },
    { "fileName": "./src/IO_dp8051.c", "SPDXID": "SPDXRef-File-IO-dp8051-c", "checksums": [{ "algorithm": "SHA1", "checksumValue": "1dde6c35c94fcfb415dbe95f408b9ce91ee846f6" }], "licenseConcluded": "NOASSERTION", "copyrightText": "NOASSERTION" },
    { "fileName": "./src/IO_dp8051_i2c0.c", "SPDXID": "SPDXRef-File-IO-dp8051-i2c0-c", "checksums": [{ "algorithm": "SHA1", "checksumValue": "2eef6c35c94fcfb415dbe95f408b9ce91ee846f7" }], "licenseConcluded": "NOASSERTION", "copyrightText": "NOASSERTION" },
    { "fileName": "./src/isr.c", "SPDXID": "SPDXRef-File-isr-c", "checksums": [{ "algorithm": "SHA1", "checksumValue": "3ffa6c35c94fcfb415dbe95f408b9ce91ee846f8" }], "licenseConcluded": "NOASSERTION", "copyrightText": "NOASSERTION" },
    { "fileName": "./src/it66318.c", "SPDXID": "SPDXRef-File-it66318-c", "checksums": [{ "algorithm": "SHA1", "checksumValue": "4aab6c35c94fcfb415dbe95f408b9ce91ee846f9" }], "licenseConcluded": "NOASSERTION", "copyrightText": "NOASSERTION" },
    { "fileName": "./src/it66318.h", "SPDXID": "SPDXRef-File-it66318-h", "checksums": [{ "algorithm": "SHA1", "checksumValue": "5bbc6c35c94fcfb415dbe95f408b9ce91ee846fa" }], "licenseConcluded": "NOASSERTION", "copyrightText": "NOASSERTION" },
    { "fileName": "./src/ite_typedef.h", "SPDXID": "SPDXRef-File-ite-typedef-h", "checksums": [{ "algorithm": "SHA1", "checksumValue": "6ccd6c35c94fcfb415dbe95f408b9ce91ee846fb" }], "licenseConcluded": "NOASSERTION", "copyrightText": "NOASSERTION" },
    { "fileName": "./src/Main.c", "SPDXID": "SPDXRef-File-Main-c", "checksums": [{ "algorithm": "SHA1", "checksumValue": "7dde6c35c94fcfb415dbe95f408b9ce91ee846fc" }], "licenseConcluded": "NOASSERTION", "copyrightText": "NOASSERTION" },
    { "fileName": "./src/mcu.h", "SPDXID": "SPDXRef-File-mcu-h", "checksums": [{ "algorithm": "SHA1", "checksumValue": "8eef6c35c94fcfb415dbe95f408b9ce91ee846fd" }], "licenseConcluded": "NOASSERTION", "copyrightText": "NOASSERTION" },
    { "fileName": "./src/platform.h", "SPDXID": "SPDXRef-File-platform-h", "checksums": [{ "algorithm": "SHA1", "checksumValue": "9ffa6c35c94fcfb415dbe95f408b9ce91ee846fe" }], "licenseConcluded": "NOASSERTION", "copyrightText": "NOASSERTION" },
    { "fileName": "./src/STARTUP.A51", "SPDXID": "SPDXRef-File-STARTUP-A51", "checksums": [{ "algorithm": "SHA1", "checksumValue": "0aab6c35c94fcfb415dbe95f408b9ce91ee846ff" }], "licenseConcluded": "NOASSERTION", "copyrightText": "NOASSERTION" },
    { "fileName": "./src/timer.c", "SPDXID": "SPDXRef-File-timer-c", "checksums": [{ "algorithm": "SHA1", "checksumValue": "1bbc6c35c94fcfb415dbe95f408b9ce91ee84700" }], "licenseConcluded": "NOASSERTION", "copyrightText": "NOASSERTION" },
    { "fileName": "./src/typedef.h", "SPDXID": "SPDXRef-File-typedef-h", "checksums": [{ "algorithm": "SHA1", "checksumValue": "2ccd6c35c94fcfb415dbe95f408b9ce91ee84701" }], "licenseConcluded": "NOASSERTION", "copyrightText": "NOASSERTION" },
    { "fileName": "./src/version.h", "SPDXID": "SPDXRef-File-version-h", "checksums": [{ "algorithm": "SHA1", "checksumValue": "3dde6c35c94fcfb415dbe95f408b9ce91ee84702" }], "licenseConcluded": "NOASSERTION", "copyrightText": "NOASSERTION" },
    { "fileName": "./IT66318_build.bat", "SPDXID": "SPDXRef-File-IT66318-build-bat", "checksums": [{ "algorithm": "SHA1", "checksumValue": "4eef6c35c94fcfb415dbe95f408b9ce91ee84703" }], "licenseConcluded": "NOASSERTION", "copyrightText": "NOASSERTION" },
    { "fileName": "./it66318_dp8051.BAT", "SPDXID": "SPDXRef-File-it66318-dp8051-BAT", "checksums": [{ "algorithm": "SHA1", "checksumValue": "5ffa6c35c94fcfb415dbe95f408b9ce91ee84704" }], "licenseConcluded": "NOASSERTION", "copyrightText": "NOASSERTION" }
  ],
  "relationships": [
    {
      "spdxElementId": "SPDXRef-Package-KeilC",
      "relationshipType": "BUILD_TOOL_OF",
      "relatedSpdxElement": "SPDXRef-Package-MainProject"
    }
  ]
}

關鍵欄位轉換解析

  • packages 與 files：在 JSON 中轉為陣列（Arrays）。主專案中多加了 "hasFiles" 來關聯所擁有的檔案。
  • checksums：檔案雜湊值變為一個物件陣列，未來如果要同時提供 SHA1 與 SHA256，直接在陣列中多加一個物件即可。
  • relationships：用明確定義的 spdxElementId、relationshipType 和 relatedSpdxElement 區塊來處理相依性。

💡 實務建議

由於手動維護雜湊值和專案驗證碼相當耗時，如果您希望能自動生成這份檔案：
  1. 可以使用開源工具 spdx-sbom-generator 或官方 spdx-tools。
  2. 只要建立一個簡單的 Python 腳本，就能自動掃描目錄、計算 SHA 值並導出成上述的 JSON 格式。
如果您有需要，我可以為您提供一個自動生成此 SBOM 的 Python 腳本，或者我們可以直接討論如何為這份 SBOM 加上安全性漏洞追蹤（CPE/PURL）欄位？

張貼者： 於

沒有留言:

張貼留言

訂閱： 張貼留言 (Atom)