How to Generate SBOM for OpenClaw Dependencies

# Two main SBOM standards:

# 1. SPDX (Software Package Data Exchange)
# Format: JSON, XML, RDF, tag-value
# Use: Broad industry standard, government requirement
# Includes: License info, copyright, relationships
# Example: .spdx.json file

# 2. CycloneDX
# Format: JSON, XML, Protobuf
# Use: AppSec focused, supply chain visibility
# Includes: Component types, license, vulnerability ref
# Example: bom.xml file

# SBOM contents:
# - Component name, version, type (library/framework/app)
# - License information
# - Vulnerabilities (CVE references)
# - Hashes (for integrity verification)
# - Supplier/Author information
# - Dependencies and relationships

# Why both?
# - SPDX: Compliance, licensing, legal teams
# - CycloneDX: Security teams, vulnerability scanning
# Use both for full visibility

# Install SBOM generation tools:
npm install -g @cyclonedx/npm
npm install -g spdx-sbom-generator

# Generate CycloneDX SBOM:
cyclonedx-npm --output-format json --output-file bom.json
# Creates: bom.json with all npm dependencies

# Generate SPDX SBOM:
spdx-sbom-generator --packageFile package.json --outputFormat json --output sbom.spdx.json

# View the SBOM:
cat bom.json | jq '.components[] | {name, version, license}'

# Example CycloneDX SBOM snippet:
{
  "bomFormat": "CycloneDX",
  "specVersion": "1.4",
  "components": [
    {
      "type": "library",
      "name": "react",
      "version": "19.0.0",
      "purl": "pkg:npm/react@19.0.0",
      "licenses": [
        {"license": {"name": "MIT"}}
      ],
      "hashes": [
        {"alg": "SHA-1", "content": "abc123..."}
      ],
      "vulnerabilities": [
        {"ref": "CVE-2023-12345", "rating": 7.5}
      ]
    }
  ]
}

# Install vulnerability scanning tools:
npm install -g @grype/grype
npm install -g snyk
npm install -g npm-audit

# 1. npm audit (built-in):
npm audit
# Shows: vulnerable packages, severity, fix recommendations
# Output format: human-readable table

npm audit --json > audit-report.json
# For parsing and integration

npm audit fix
# Automatically fixes vulnerable packages if possible

# 2. Grype (comprehensive vulnerability scanner):
grype dir:. -o json > vulnerabilities.json
grype dir:. -o table
# Scans all dependencies, compares against multiple DB:
# - NVD (National Vulnerability Database)
# - GitHub Advisory Database
# - Snyk vulnerability database

# 3. Snyk (focused on supply chain):
snyk test --json > snyk-report.json
snyk test
# Checks against Snyk vulnerability database
# Provides remediation guidance
# Integrates with CI/CD

# 4. Safety (for Python if applicable):
safety check --json > safety-report.json

# Aggregate vulnerability report:
# Combine all tools' findings into unified view

# Install license checking tools:
npm install -g license-checker
npm install -g license-report
npm install -g licensee

# 1. License Checker (simple, fast):
license-checker --json > licenses.json
license-checker --markdown > LICENSE-REPORT.md

# Example output:
# react@19.0.0: MIT
# webpack@5.89.0: MIT
# lodash@4.17.21: MIT
# aws-sdk@2.x: Apache-2.0

# 2. License Report (detailed):
license-report --only=production --output=json > license-report.json

# Analyze license compatibility:
# Prohibited licenses: GPL (if closed-source), AGPL
# Careful licenses: LGPL (must maintain open parts)
# Safe licenses: MIT, Apache-2.0, BSD

# 3. Create license policy:
# In .licensechecker.json:
{
  "spdx": true,
  "onlyAllow": [
    "MIT",
    "Apache-2.0",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC"
  ],
  "excludePackages": [
    "internal-package@1.0.0"
  ]
}

# Enforce in CI/CD:
license-checker --json --onlyAllow MIT,Apache-2.0
# Exit code 1 if violations found

# In .github/workflows/sbom.yml (GitHub Actions):
name: Generate SBOM

on:
  push:
    branches: [main]
    paths: ['package.json', 'package-lock.json']
  release:
    types: [published]

jobs:
  sbom:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Install Node
        uses: actions/setup-node@v3
        with:
          node-version: '20'

      - name: Install dependencies
        run: npm ci

      - name: Generate CycloneDX SBOM
        run: |
          npm install -g @cyclonedx/npm
          cyclonedx-npm --output-format json --output-file bom.json

      - name: Generate SPDX SBOM
        run: |
          npm install -g spdx-sbom-generator
          spdx-sbom-generator --outputFormat json --output sbom.spdx.json

      - name: Scan for vulnerabilities
        run: |
          npm audit --json > audit-report.json || true

      - name: Generate license report
        run: |
          npm install -g license-checker
          license-checker --json > licenses.json

      - name: Upload SBOM artifacts
        uses: actions/upload-artifact@v3
        with:
          name: sbom-reports
          path: |
            bom.json
            sbom.spdx.json
            audit-report.json
            licenses.json

      - name: Store SBOM in releases
        if: github.event_name == 'release'
        uses: actions/upload-release-asset@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          upload_url: ${{ github.event.release.upload_url }}
          asset_path: ./bom.json
          asset_name: openclaw-${{ github.event.release.tag_name }}-sbom.json
          asset_content_type: application/json

      - name: Commit SBOM to repository
        run: |
          git config user.email "bot@example.com"
          git config user.name "SBOM Bot"
          git add bom.json licenses.json
          git commit -m "chore: update SBOM and license report" || true
          git push

# Set up automated vulnerability monitoring:

# 1. GitHub Dependabot (built-in):
# In .github/dependabot.yml:
version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "daily"
    open-pull-requests-limit: 5
    reviewers:
      - "security-team"
    assignees:
      - "cto"

# 2. Snyk continuous monitoring:
# Connect GitHub → Snyk web UI
# Snyk automatically:
# - Tests all PRs for vulnerabilities
# - Creates PRs for fixes
# - Reports on security dashboard
# - Sends email alerts

# 3. Custom monitoring with cron job:
# In .github/workflows/vulnerability-monitor.yml:
name: Vulnerability Check

on:
  schedule:
    - cron: '0 2 * * *'  # Daily at 2 AM UTC

jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-node@v3
        with:
          node-version: '20'
      - run: npm ci
      - run: npm audit --json > audit-report.json || true

      - name: Check for critical vulnerabilities
        run: |
          critical_count=$(cat audit-report.json | jq '[.vulnerabilities[] | select(.severity == "critical")] | length')
          if [ $critical_count -gt 0 ]; then
            echo "CRITICAL: Found $critical_count critical vulnerabilities"
            exit 1
          fi

      - name: Notify if vulnerabilities found
        if: failure()
        uses: 8398a7/action-slack@v3
        with:
          status: ${{ job.status }}
          text: 'New vulnerabilities detected. Review audit report.'
          webhook_url: ${{ secrets.SLACK_WEBHOOK }}