Add Initial Setup Supporting JSON for CycloneDX and SPDX

.github/CODEOWNERS

@@ -0,0 +1,16 @@
+# Global owners
+
+* @j28smith
+
+## Language specific owners
+
+/go/            @j28smith
+/java/          @j28smith
+/javascript/    @j28smith
+/python/        @j28smith
+/rust/          @j28smith
+
+## Specification and Test Vectors
+
+/specs/         @j28smith
+/test-vectors/  @j28smith

.github/workflows/go.yml

@@ -0,0 +1,38 @@
+name: Go Project
+
+on:
+  push:
+    branches: [ "**" ]
+  pull_request:
+    branches: [ "main" ]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build and Test
+    runs-on: ubuntu-latest
+    env:
+      GOEXPERIMENT: jsonv2
+    defaults:
+      run:
+        working-directory: ./go
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: ⚙️ Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: 'go/go.mod'
+          cache-dependency-path: go/go.sum
+          cache: false
+
+      - name: 👀 Display Go version
+        run: go version
+
+      - name: 🔨 Build
+        run: go build -v
+
+      - name: ✅ Run Tests
+        run: go test -v

.github/workflows/java.yml

@@ -0,0 +1,33 @@
+name: Java Project
+
+on:
+  push:
+    branches: [ "**" ]
+  pull_request:
+    branches: [ "main" ]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build and Test
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ./java
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: ⚙️ Set up JDK 
+        uses: actions/setup-java@v5
+        with:
+          distribution: 'temurin'
+          java-version: '25'
+          cache: maven
+
+      - name: 🔨 Build
+        run: mvn compile
+
+      - name: ✅ Run Tests
+        run: mvn test

.github/workflows/javascript.yml

@@ -0,0 +1,41 @@
+name: JavaScript Project
+
+on:
+  push:
+    branches: [ "**" ]
+  pull_request:
+    branches: [ "main" ]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Run Tests
+    runs-on: ubuntu-latest
+
+    defaults:
+      run:
+        working-directory: ./javascript
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: ⚙️ Setup Node.js
+        uses: actions/setup-node@v6
+        with:   
+          node-version: 25
+          cache: 'npm'
+          cache-dependency-path: ./javascript/package-lock.json
+
+      - name: 📦 Install Dependencies
+        run: npm ci
+
+      - name: ✨ Check Formatting
+        run: npm run format:check
+
+      - name: 🧶 Lint Code
+        run: npm run lint
+
+      - name: ✅ Run Tests
+        run: npm test

.github/workflows/lint.yml

@@ -0,0 +1,33 @@
+name: Linter Checks
+
+on:
+  push:
+    branches: [ "**" ]
+  pull_request:
+    branches: [ "main" ]
+
+jobs:
+  markdown-lint:
+    name: Markdown Linter
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v6
+
+      - name: Run Markdown Linter
+        uses: davidanson/markdownlint-cli2-action@v22
+        with:
+          globs: "**/*.md"
+          config: ".markdownlint.json"
+
+  python-lint:
+    name: Python Linter
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v6
+
+      - name: Run Ruff Python Linter
+        uses: astral-sh/ruff-action@v3
+        with:
+          src: "./python"

.github/workflows/python.yml

@@ -0,0 +1,36 @@
+name: Python Project
+
+on:
+  push:
+    branches: [ "**" ]
+  pull_request:
+    branches: [ "main" ]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build and Test
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ./python
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: ⚙️ Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: '3.14'
+
+      - name: 👀 Display Python version
+        run: python --version
+
+      - name: 📦 Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements.txt
+
+      - name: ✅ Run Tests
+        run: pytest -v test_hash.py

.github/workflows/rust.yml

@@ -0,0 +1,35 @@
+name: Rust Project
+
+on:
+  push:
+    branches: [ "**" ]
+  pull_request:
+    branches: [ "main" ]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build and Test
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ./rust
+    steps:
+      - uses: actions/checkout@v6
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy, rustfmt
+
+      - name: ✨ Check Formatting
+        run: cargo fmt --all -- --check
+
+      - name: 🧶 Lint Code
+        run: cargo clippy -- -D warnings
+
+      - name: 🔨 Build
+        run: cargo build --verbose
+
+      - name: ✅ Run Tests
+        run: cargo test --verbose

.gitignore

@@ -0,0 +1,45 @@
+# --- General ---
+.DS_Store
+.vscode/
+.idea/
+
+# --- Go ---
+# Binaries for programs and plugins
+*.exe
+*.exe~
+*.dll
+*.so
+*.dylib
+vendor/
+
+# --- Python ---
+__pycache__/
+*.py[cod]
+*$py.class
+.venv/
+venv/
+env/
+*.egg-info/
+
+# --- Node.js / TypeScript ---
+node_modules/
+dist/
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+
+# --- Java ---
+*.class
+*.log
+*.jar
+*.war
+target/
+.mvn/
+.gradle/
+build/
+
+# --- Rust ---
+/target/
+Cargo.lock
+**/*.rs.bk
+

.markdownlint.json

@@ -0,0 +1,6 @@
+{
+  "default": true,
+  "MD013": {
+     "tables": false
+  }
+}

CONTRIBUTING.md

@@ -0,0 +1,42 @@
+# Contributing to SBOM Canonical Hash
+
+Thank you for your interest in contributing! This project aims to demonstrate
+interoperable SBOM hashing across multiple languages.
+
+## Project Structure
+
+This is a monorepo. Each language implementation lives in its own directory:
+
+- `/go` - Go module
+- `/python` - Python package
+- `/rust` - Rust crate
+- ...
+
+## Development Guidelines
+
+### 1. Test Vectors are the Source of Truth
+
+- Do not modify test vectors inside language directories.
+- The "Golden" test vectors are located in `/test-vectors`.
+- All implementations must pass the suite defined in `/test-vectors/manifest.json`.
+
+### 2. Adding a New Language
+
+- Create a new directory for the language.
+- Implement the canonicalization logic (JCS for JSON, XML-C14N for XML).
+- Ensure your tests read from the root `/test-vectors` directory.
+- Add a CI job to `.github/workflows/ci.yml`.
+
+### 3. Reporting Issues
+
+- Please specify which language implementation you are using (or if it is a
+  flaw in the core spec).
+
+## Documentation Style
+
+We use `markdownlint` to keep our documentation consistent.
+
+- You can run it locally using the
+  [markdownlint-cli](https://github.com/igorshubovych/markdownlint-cli).
+- CI will fail if your PR contains linting errors.
+- Configuration is found in `.markdownlint.json`.

README.md

@@ -1,2 +1,57 @@
-# sbom-signing-best-practices
-A multi-language reference implementation for computing canonical SBOM hashes. Supports CycloneDX v1.7 & SPDX v3.0 (JSON/XML) to demonstrate cross-language interoperability and best practices for SBOM signing and integrity verification.
+# SBOM Signing Best Practices
+
+[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](LICENSE)
+[![Linter](https://github.com/shiftleftcyber/sbom-signing-best-practices/actions/workflows/lint.yml/badge.svg)](https://github.com/shiftleftcyber/sbom-signing-best-practices/actions/workflows/lint.yml)
+[![Go](https://github.com/shiftleftcyber/sbom-signing-best-practices/actions/workflows/go.yml/badge.svg)](https://github.com/shiftleftcyber/sbom-signing-best-practices/actions/workflows/go.yml)
+[![Java](https://github.com/shiftleftcyber/sbom-signing-best-practices/actions/workflows/java.yml/badge.svg)](https://github.com/shiftleftcyber/sbom-signing-best-practices/actions/workflows/java.yml)
+[![JavaScript](https://github.com/shiftleftcyber/sbom-signing-best-practices/actions/workflows/javascript.yml/badge.svg)](https://github.com/shiftleftcyber/sbom-signing-best-practices/actions/workflows/javascript.yml)
+[![Python](https://github.com/shiftleftcyber/sbom-signing-best-practices/actions/workflows/python.yml/badge.svg)](https://github.com/shiftleftcyber/sbom-signing-best-practices/actions/workflows/python.yml)
+[![Rust](https://github.com/shiftleftcyber/sbom-signing-best-practices/actions/workflows/rust.yml/badge.svg)](https://github.com/shiftleftcyber/sbom-signing-best-practices/actions/workflows/rust.yml)
+
+A set of reference implementations and test suites for computing canonical
+hashes of Software Bill of Materials (SBOMs). This project demonstrates
+multi-language interoperability to support reliable signing and integrity verification.
+
+## Supported Standards
+
+| Standard | Version | Format | Canonicalization | Signature Spec |
+| :--- | :--- | :--- | :--- | :--- |
+| **CycloneDX** | 1.7 | JSON | JCS (RFC 8785) | JSF |
+| **SPDX** | 2.2 | JSON | JCS (RFC 8785) | Undefined (detached) |
+| **SPDX** | 3.0 | JSON-LD | JCS (RFC 8785) | Undefined (detached) |
+
+\* Canonical hashing for XML formats (CycloneDX and SPDX) is currently under
+   evaluation and is slated for a future release.
+
+## The Goal: Deterministic Hashing
+
+The objective is to compute a hash of the SBOM **content**, independent of its **formatting**.
+
+By applying **canonicalization** (JCS) and **pruning** (JSF) prior to hashing, we
+ensure that the same logical data always produces the same hash. This allows
+SBOMs to be transmitted in any form — whether "minified" or "pretty-printed" — while
+maintaining a stable cryptographic identity across different platforms:
+
+> `Hash(Go_Impl(sbom-pretty.json))` == `Hash(Python_Impl(sbom-min.json))`
+
+## Technical Specification
+
+The exact rules for property exclusion, signature handling, and serialization
+are detailed in the technical spec:
+
+- [Technical Specification: JSON SBOM Canonical Hashing](/specs/README.md)
+
+## Directory Structure
+
+- `go/`: Go reference implementation.
+- `java/`: Java reference implementation.
+- `javascript/`: JavaScript reference implementation.
+- `python/`: Python reference implementation.
+- `rust/`: Rust reference implementation.
+- `specs/`: Technical details on the canonicalization rules used.
+- `test-vectors/`: Shared "golden" SBOMs and a test manifest file including the
+  expected hashes used to verify cross-language parity.
+
+## Getting Started
+
+Refer to the `README.md` in each language directory for build instructions.