[build] Generate cross-platform Selenium Manager SBOM and NOTICE

.github/workflows/ci-rust.yml

@@ -222,10 +222,41 @@ jobs:
           path: selenium-manager-macos-debug.tar
           retention-days: 6
 
+  sbom:
+    name: "SBOM and Notices"
+    runs-on: ubuntu-latest
+    needs: tests
+    if: github.event_name != 'schedule' && github.event.repository.fork == false && (github.ref == 'refs/heads/trunk' || inputs.release)
+    steps:
+      - name: "Checkout project"
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.branch }}
+      - name: "Update Rust"
+        run: |
+          rustup update
+          rustc -vV
+      - name: "Install SBOM tools"
+        run: cargo install --locked cargo-cyclonedx@0.5.7 cargo-about@0.6.6
+      - name: "Generate SBOM and third-party notices"
+        working-directory: rust
+        run: |
+          # --target all includes target-gated crates for every platform, not just the host.
+          cargo cyclonedx --format json --all-features --target all
+          cargo about generate about.hbs > selenium-manager-THIRD-PARTY-NOTICES.txt
+      - name: "Upload SBOM and notices"
+        uses: actions/upload-artifact@v7
+        with:
+          name: selenium-manager-sbom
+          path: |
+            rust/selenium-manager.cdx.json
+            rust/selenium-manager-THIRD-PARTY-NOTICES.txt
+          retention-days: 6
+
   release:
     name: "Release Binaries"
     runs-on: ubuntu-latest
-    needs: [ macos-stable, linux-stable, windows-stable, macos-debug, linux-debug, windows-debug ]
+    needs: [ macos-stable, linux-stable, windows-stable, macos-debug, linux-debug, windows-debug, sbom ]
     if: github.event_name != 'schedule' && github.event.repository.fork == false && (github.ref == 'refs/heads/trunk' || inputs.release)
     steps:
       - name: "Checkout selenium_manager_artifacts"
@@ -242,7 +273,9 @@ jobs:
           linux_sha=$(shasum -a 256 artifacts/selenium-manager-linux/selenium-manager-linux | awk '{print $1}')
           macos_sha=$(shasum -a 256 artifacts/selenium-manager-macos/selenium-manager-macos | awk '{print $1}')
           windows_sha=$(shasum -a 256 artifacts/selenium-manager-windows/selenium-manager-windows.exe | awk '{print $1}')
-          echo "{\"macos\": \"$macos_sha\", \"windows\": \"$windows_sha\", \"linux\": \"$linux_sha\"}" > latest.json
+          sbom_sha=$(shasum -a 256 artifacts/selenium-manager-sbom/selenium-manager.cdx.json | awk '{print $1}')
+          notice_sha=$(shasum -a 256 artifacts/selenium-manager-sbom/selenium-manager-THIRD-PARTY-NOTICES.txt | awk '{print $1}')
+          echo "{\"macos\": \"$macos_sha\", \"windows\": \"$windows_sha\", \"linux\": \"$linux_sha\", \"sbom\": \"$sbom_sha\", \"notice\": \"$notice_sha\"}" > latest.json
           git config --local user.email "selenium-ci@users.noreply.github.com"
           git config --local user.name "Selenium CI Bot"
           git add latest.json
@@ -266,3 +299,5 @@ jobs:
             artifacts/selenium-manager-linux-debug/selenium-manager-linux-debug.tar
             artifacts/selenium-manager-macos-debug/selenium-manager-macos-debug.tar
             artifacts/selenium-manager-windows-debug/selenium-manager-windows-debug.exe
+            artifacts/selenium-manager-sbom/selenium-manager.cdx.json
+            artifacts/selenium-manager-sbom/selenium-manager-THIRD-PARTY-NOTICES.txt

rust/about.hbs

@@ -0,0 +1,20 @@
+Third-party software bundled with Selenium Manager. Full license texts follow.
+
+Overview of licenses:
+{{#each overview}}
+  - {{{name}}}: {{count}} crate(s)
+{{/each}}
+
+{{#each licenses}}
+================================================================================
+{{{name}}}
+================================================================================
+
+Used by:
+{{#each used_by}}
+  - {{crate.name}} {{crate.version}}
+{{/each}}
+
+{{{text}}}
+
+{{/each}}

rust/about.toml

@@ -0,0 +1,28 @@
+# Licenses present in the crate tree; cargo-about won't emit the NOTICE without this list.
+accepted = [
+    "MIT",
+    "Apache-2.0",
+    "Apache-2.0 WITH LLVM-exception",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "ISC",
+    "Unicode-3.0",
+    "Unicode-DFS-2016",
+    "0BSD",
+    "Zlib",
+    "MPL-2.0",
+    "Unlicense",
+    "CC0-1.0",
+    "BSL-1.0",
+    "OpenSSL",
+    "CDLA-Permissive-2.0",
+    "bzip2-1.0.6",
+]
+
+ignore-dev-dependencies = true
+
+# Resolve licenses from the crates themselves; don't depend on the clearlydefined service.
+no-clearly-defined = true
+
+# ring ships a license-file rather than an SPDX expression.
+workarounds = ["ring"]