Initial Commit

packages/security-stack/security/slsa/src/schemas/sbom.schemas.ts

@@ -0,0 +1,52 @@
+import z from "zod";
+
+export const SbomComponentTypeSchema = z.enum([
+    "library",
+    "application",
+    "framework",
+    "file",
+]);
+
+export const SbomHashSchema = z.object({
+    alg: z.string().min(1),
+    content: z.string().min(1),
+});
+
+export const SbomComponentSchema = z.object({
+    type: SbomComponentTypeSchema,
+    name: z.string().min(1),
+    version: z.string().min(1),
+    purl: z.string().optional(),
+    description: z.string().optional(),
+    license: z.string().optional(),
+    hashes: z.array(SbomHashSchema).optional(),
+});
+
+export const SbomSchema = z.object({
+    bomFormat: z.literal("CycloneDX"),
+    specVersion: z.literal("1.5"),
+    serialNumber: z.string().regex(/^urn:uuid:/),
+    version: z.number().int().positive(),
+    metadata: z.object({
+        timestamp: z.string().min(1),
+        tools: z.array(
+            z.object({ name: z.string().min(1), version: z.string().min(1) })
+        ),
+        component: SbomComponentSchema,
+    }),
+    components: z.array(SbomComponentSchema),
+});
+
+export const SbomInputSchema = z.object({
+    packageName: z.string().min(1),
+    packageVersion: z.string().min(1),
+    packageDescription: z.string().optional(),
+    packageLicense: z.string().optional(),
+    dependencies: z.record(z.string(), z.string()),
+    componentType: SbomComponentTypeSchema.optional(),
+});
+
+export type SbomComponentType = z.infer<typeof SbomComponentTypeSchema>;
+export type SbomComponent = z.infer<typeof SbomComponentSchema>;
+export type Sbom = z.infer<typeof SbomSchema>;
+export type SbomInput = z.infer<typeof SbomInputSchema>;