Add SPDX examples

scripts/json-tool.js

@@ -1,35 +1,48 @@
 #!/usr/bin/env node
 
-const fs = require('fs');
-const path = require('path');
+import canonicalize from 'canonicalize';
+import fs from 'node:fs';
+import path from 'node:path';
 
-// Grab arguments: [0] is node, [1] is script path, [2] is file, [3] is mode
 const [,, filePath, mode = 'pretty'] = process.argv;
 
 if (!filePath) {
-    console.error("Usage: node json-tool.js <file-path> [pretty|min]");
+    console.error("Usage: node json-tool.js <file-path> [pretty|min|canon]");
     process.exit(1);
 }
 
 try {
-    // Resolve and read the file
     const absolutePath = path.resolve(filePath);
     const rawData = fs.readFileSync(absolutePath, 'utf8');
-
-    // Parse the JSON file
     const jsonObject = JSON.parse(rawData);
 
-    // Process based on mode
     let result;
-    if (mode.toLowerCase() === 'min') {
+    const lowerMode = mode.toLowerCase();
+
+    if (lowerMode === 'min') {
         result = JSON.stringify(jsonObject);
+        process.stdout.write(result); 
+    } else if (lowerMode === 'canon') {
+        result = canon(jsonObject); 
         process.stdout.write(result);
     } else {
-        // Pretty print using 4-space indentation
         result = JSON.stringify(jsonObject, null, 4);
         console.log(result);
     }
 } catch (err) {
-    console.error(`Error: ${err.message}`);
+    console.error(`Error processing ${filePath}: ${err.message}`);
     process.exit(1);
 }
+
+export function canon(data) {
+  // Logic for CycloneDX / JSF Signature Exclusions
+  if (data.bomFormat === 'CycloneDX' && data.signature) {
+      if (Array.isArray(data.signature.excludes)) {
+        for (const property of data.signature.excludes) {
+          delete data[property];
+        }
+      }
+      delete data.signature.value;
+  }
+  return canonicalize(data);
+}

scripts/script.sh

@@ -0,0 +1,31 @@
+#!/bin/bash
+shopt -s nullglob
+
+# Path to your bundled tool
+TOOL="json-tool.js"
+
+# Loop through both .spdx.json and .cdx.json files
+for file in *.spdx.json *.cdx.json; do
+
+    # 1. Skip files that were already generated by this script
+    if [[ "$file" == *"-pretty."* || "$file" == *"-min."* || "$file" == *"-canonical."* ]]; then
+        continue
+    fi
+
+    # 2. Extract the extension (e.g., .spdx.json or .cdx.json)
+    # This captures everything from the first dot to the end
+    ext="${file#*.}" 
+
+    # 3. Extract the base name (everything before the extension)
+    base="${file%%.*}"
+
+    echo "Processing $file (Type: $ext)..."
+
+    # Run the commands using the original extension in the new filename
+    node "$TOOL" "$file" pretty > "${base}-pretty.${ext}" || echo "Failed pretty: $file"
+    node "$TOOL" "$file" canon > "${base}-canonical.${ext}" || echo "Failed canon: $file"
+    node "$TOOL" "$file" min > "${base}-min.${ext}" || echo "Failed min: $file"
+
+done
+
+echo "Done!"