Initial implementation

.github/CODEOWNERS

@@ -0,0 +1 @@
+*   @devops-kung-fu/the-incredibles

.github/FUNDING.yml

@@ -0,0 +1,13 @@
+# These are supported funding model platforms
+
+github: devops-kung-fu
+patreon: # Replace with a single Patreon username
+open_collective: # Replace with a single Open Collective username
+ko_fi: # Replace with a single Ko-fi username
+tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
+community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
+liberapay: # Replace with a single Liberapay username
+issuehunt: # Replace with a single IssueHunt username
+otechie: # Replace with a single Otechie username
+lfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry
+custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2']

.github/dependabot.yml

@@ -0,0 +1,14 @@
+version: 2
+updates:
+- package-ecosystem: github-actions
+  directory: /.github/workflows
+  schedule:
+    interval: daily
+    time: "05:00"
+    timezone: US/Pacific
+- package-ecosystem: gomod
+  directory: /
+  schedule:
+    interval: daily
+    time: "05:00"
+    timezone: US/Pacific

.github/workflows/go-quality.yml

@@ -0,0 +1,43 @@
+name: Go Quality Checks
+on: push
+jobs:
+  tests:
+    runs-on: ubuntu-latest
+    steps:
+      - 
+        name: Checkout
+        uses: actions/checkout@v3
+      - 
+        name: Setup Go
+        uses: actions/setup-go@v4
+        with:
+          go-version: '1.21'
+      - 
+        name: Install Dependencies
+        run: |
+          go version
+          go install honnef.co/go/tools/cmd/staticcheck@latest
+          go install github.com/fzipp/gocyclo/cmd/gocyclo@latest
+      - 
+        name: Test
+        run: |
+          go test -v -coverprofile=coverage.out ./...
+          go tool cover -func=coverage.out
+      - 
+        name: CodeCov
+        run: bash <(curl -s https://codecov.io/bash)
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+      - 
+        name: Build
+        run: go build
+      - 
+        name: Vet
+        run: go vet -v
+      - 
+        name: staticcheck
+        run: staticcheck -f stylish -checks all  ./...
+      - 
+        name: gocyclo
+        run: gocyclo .
+

.github/workflows/release.yml

@@ -0,0 +1,47 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+      -
+        name: Set up Go
+        uses: actions/setup-go@v4
+        with:
+          go-version: '1.21'
+          check-latest: true
+      - run: go version
+      - 
+        name: Generate SBOM
+        uses: anchore/sbom-action@v0
+        with:
+          artifact-name: kissbom.cyclonedx.json
+          path: .
+          format: cyclonedx-json
+      - 
+        name: Release SBOM
+        uses: anchore/sbom-action/publish-sbom@v0
+        with:
+          sbom-artifact-match: ".*\\.cyclonedx.json$"
+      -
+        name: GoReleaser Action
+        uses: goreleaser/[email protected]
+        with:
+          version: ${{ env.GITHUB_REF_NAME }}
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.PUBLISHER_TOKEN }}
+

.gitignore

@@ -1,6 +1,3 @@
-# If you prefer the allow list template instead of the deny list, see community template:
-# https://github.com/github/gitignore/blob/main/community/Golang/Go.AllowList.gitignore
-#
 # Binaries for programs and plugins
 *.exe
 *.exe~
@@ -17,5 +14,12 @@
 # Dependency directories (remove the comment below to include it)
 # vendor/
 
-# Go workspace file
-go.work
+.DS_Store
+
+kissbom
+
+*.env
+
+/rest
+
+coverage.html

.goreleaser.yaml

@@ -0,0 +1,45 @@
+project_name: kissbom
+
+builds:
+  - 
+    binary: kissbom
+    env:
+      - CGO_ENABLED=0
+    goos:
+      - darwin
+      - linux
+      - windows
+    goarch:
+      - amd64
+      - arm64
+
+release:
+  prerelease: auto
+
+universal_binaries:
+  - replace: true
+
+brews:
+  -
+    name: kissbom
+    homepage: "https://github.com/devops-kung-fu/kissbom"
+    tap:
+      owner: devops-kung-fu
+      name: homebrew-tap
+    commit_author:
+      name: djschleen
+      email: [email protected]
+
+checksum:
+  name_template: 'checksums.txt'
+
+nfpms:
+  - 
+    maintainer: DevOps Kung Fu Mafia <[email protected]>
+    description: Converts a CycloneDX file into a KissBOM. Implements the kissbom-spec (https://github.com/kissbom/kissbom-spec). 
+    homepage: https://github.com/devops-kung-fu/kissbom
+    license: MPL
+    formats:
+      - deb
+      - rpm
+

.hookz.yaml

@@ -0,0 +1,49 @@
+  version: 2.4.0
+  sources:
+    - source: github.com/devops-kung-fu/hinge@latest
+    - source: github.com/kisielk/errcheck@latest      
+    - source: honnef.co/go/tools/cmd/staticcheck@latest
+    - source: github.com/fzipp/gocyclo/cmd/gocyclo@latest
+    - source: golang.org/x/vuln/cmd/govulncheck@latest
+  hooks:
+    - type: pre-commit
+      actions:
+        - name: "git: Pull (Ensure there are no upstream changes that are not local)"
+          exec: git
+          args: ["pull"]  
+        - name: "go: Tidy mod file"
+          exec: go
+          args: ["mod", "tidy"]
+        - name: "go: Update all dependencies to latest"
+          exec: go
+          args: ["get", "-u", "./..."]
+        - name: "gofmt: Run gofmt to format the code"
+          exec: gofmt
+          args: ["-s", "-w", "**/*.go"]
+        - name: "staticcheck: Lint all go files"
+          exec: staticcheck
+          args: ["-f", "stylish", "-checks", "all", "./..."] #to error out, add the arg "-set_exit_status"
+        - name: "errcheck: Ensure that errors are checked"
+          exec: errcheck
+          args: ["-ignoretests", "./..."]
+        - name: "govulncheck: Check for vulnerabilities"
+          exec: govulncheck
+          args: ["./..."]
+        - name: "gocyclo: Check cyclomatic complexities"
+          exec: gocyclo
+          args: ["-over", "7", "."]
+        - name: Hinge
+          exec: hinge
+          args: ["."]
+        - name: "go: Build (Ensure pulled modules do not break the build)"
+          exec: go
+          args: ["build", "-v", "./..."]
+        - name: "go: Run all tests"
+          exec: go
+          args: ["test", "-v", "-coverprofile=coverage.out", "./..."]
+        - name: "go: Test coverage"
+          exec: go
+          args: ["tool", "cover", "-func=coverage.out"]
+        - name: "git: Add all changed files during the pre-commit stage"
+          exec: git
+          args: ["add", "."]

.vscode/launch.json

@@ -0,0 +1,57 @@
+{
+    // Use IntelliSense to learn about possible attributes.
+    // Hover to view descriptions of existing attributes.
+    // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
+    "version": "0.2.0",
+    "configurations": [
+
+        {
+            "name": "Debug (output default)",
+            "type": "go",
+            "request": "launch",
+            "mode": "auto",
+            "program": "${workspaceFolder}/main.go",
+            "args": ["--debug=true", "convert", "./_TESTDATA_/juiceshop.cyclonedx.json"]
+        },
+        {
+            "name": "Debug (output json)",
+            "type": "go",
+            "request": "launch",
+            "mode": "auto",
+            "program": "${workspaceFolder}/main.go",
+            "args": ["--debug=true", "convert","--format", "yaml", "./_TESTDATA_/juiceshop.cyclonedx.json"]
+        },
+        {
+            "name": "Debug (output yaml)",
+            "type": "go",
+            "request": "launch",
+            "mode": "auto",
+            "program": "${workspaceFolder}/main.go",
+            "args": ["--debug=true", "convert","--format", "yaml", "./_TESTDATA_/juiceshop.cyclonedx.json"]
+        },
+        {
+            "name": "Debug (output csv)",
+            "type": "go",
+            "request": "launch",
+            "mode": "auto",
+            "program": "${workspaceFolder}/main.go",
+            "args": ["--debug=true", "convert","--format", "csv", "./_TESTDATA_/juiceshop.cyclonedx.json"]
+        },
+        {
+            "name": "Debug (output minimal)",
+            "type": "go",
+            "request": "launch",
+            "mode": "auto",
+            "program": "${workspaceFolder}/main.go",
+            "args": ["--debug=true", "convert","--format", "minimal", "./_TESTDATA_/juiceshop.cyclonedx.json"]
+        },
+        {
+            "name": "Debug (output compatible)",
+            "type": "go",
+            "request": "launch",
+            "mode": "auto",
+            "program": "${workspaceFolder}/main.go",
+            "args": ["--debug=true", "convert","--format", "compatible", "./_TESTDATA_/juiceshop.cyclonedx.json"]
+        },
+    ]
+}

.vscode/settings.json

@@ -0,0 +1,14 @@
+{
+    "cSpell.words": [
+        "afero",
+        "cyclonedx",
+        "dpkg",
+        "gocsv",
+        "juiceshop",
+        "kissbom",
+        "Ombredanne",
+        "pypi",
+        "stretchr",
+        "testfile"
+    ]
+}

CODE_OF_CONDUCT.md

@@ -0,0 +1,76 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as
+contributors and maintainers pledge to making participation in our project and
+our community a harassment-free experience for everyone, regardless of age, body
+size, disability, ethnicity, sex characteristics, gender identity and expression,
+level of experience, education, socio-economic status, nationality, personal
+appearance, race, religion, or sexual identity and orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment
+include:
+
+* Using welcoming and inclusive language
+* Being respectful of differing viewpoints and experiences
+* Gracefully accepting constructive criticism
+* Focusing on what is best for the community
+* Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery and unwelcome sexual attention or
+ advances
+* Trolling, insulting/derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or electronic
+ address, without explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+ professional setting
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable
+behavior and are expected to take appropriate and fair corrective action in
+response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or
+reject comments, commits, code, wiki edits, issues, and other contributions
+that are not aligned to this Code of Conduct, or to ban temporarily or
+permanently any contributor for other behaviors that they deem inappropriate,
+threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies both within project spaces and in public spaces
+when an individual is representing the project or its community. Examples of
+representing a project or community include using an official project e-mail
+address, posting via an official social media account, or acting as an appointed
+representative at an online or offline event. Representation of a project may be
+further defined and clarified by project maintainers.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported by contacting the project team. All
+complaints will be reviewed and investigated and will result in a response that
+is deemed necessary and appropriate to the circumstances. The project team is
+obligated to maintain confidentiality with regard to the reporter of an incident.
+Further details of specific enforcement policies may be posted separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good
+faith may face temporary or permanent repercussions as determined by other
+members of the project's leadership.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
+available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
+
+[homepage]: https://www.contributor-covenant.org
+
+For answers to common questions about this code of conduct, see
+https://www.contributor-covenant.org/faq