From d1656730abfb8ce293af278a8d1f74456c137389 Mon Sep 17 00:00:00 2001
From: Richard Hughes <richard@hughsie.com>
Date: Sat, 16 Nov 2024 11:28:16 +0000
Subject: [PATCH] Add a SBOM file in CycloneDX format

Improve supply chain security by including a SBOM file with substituted values.

This will be used to construct a composite platform SBOM.

Signed-off-by: Richard Hughes <richard@hughsie.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
 libfdt/sbom.cdx.json | 41 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)
 create mode 100644 libfdt/sbom.cdx.json

diff --git a/libfdt/sbom.cdx.json b/libfdt/sbom.cdx.json
new file mode 100644
index 00000000..303cf546
--- /dev/null
+++ b/libfdt/sbom.cdx.json
@@ -0,0 +1,41 @@
+{
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.6",
+  "version": 1,
+  "components": [
+    {
+      "type": "library",
+      "bom-ref": "pkg:github/dgibson/libfdt@@VCS_TAG@",
+      "cpe": "cpe:2.3:a:dgibson:libfdt:@VCS_TAG@:*:*:*:*:*:*:*",
+      "name": "libfdt",
+      "version": "@VCS_VERSION@",
+      "description": "Utility library for reading and manipulating the FDT binary format",
+      "authors": [
+        {
+          "name": "@VCS_SBOM_AUTHORS@"
+        }
+      ],
+      "supplier": {
+        "name": "libfdt developers"
+      },
+      "licenses": [
+        {
+          "license": {
+            "id": "BSD-2-Clause"
+          }
+        },
+        {
+          "license": {
+            "id": "GPL-2.0-or-later"
+          }
+        }
+      ],
+      "externalReferences": [
+        {
+          "type": "vcs",
+          "url": "https://github.com/dgibson/dtc"
+        }
+      ]
+    }
+  ]
+}