tools,build: add CycloneDX SBOM generation

Makefile

@@ -874,6 +874,14 @@ tools/doc/node_modules: tools/doc/package.json
 RAWVER=$(shell $(PYTHON) tools/getnodeversion.py)
 VERSION=v$(RAWVER)
 
+.PHONY: sbom
+sbom: config.gypi ## Write a CycloneDX SBOM of the bundled dependencies to out/Release/node-$(VERSION)-sbom.json.
+	$(PYTHON) tools/sbom/generate_sbom.py
+
+.PHONY: test-sbom
+test-sbom: ## Validate the SBOM written by `make sbom`.
+	$(PYTHON) tools/sbom/generate_sbom.py --validate
+
 .PHONY: doc-only
 .NOTPARALLEL: doc-only
 doc-only: $(apidoc_dirs) $(apidocs_html) $(apidocs_json) out/doc/api/all.json out/doc/llms.txt out/doc/apilinks.json  ## Builds the docs with the local or the global Node.js binary.

doc/contributing/maintaining/maintaining-dependencies.md

@@ -106,6 +106,12 @@ shared library is available can added by:
     }],
 ```
 
+* add an entry to the `DEP_CATALOG` list in `tools/sbom/generate_sbom.py` so the
+  dependency appears in the generated SBOM. Set `shared_flag` to the
+  `node_shared_depname` variable and `version_fn` to an extractor for
+  whichever file in the dependency records its version. See the comment
+  above `DEP_CATALOG` and the existing entries for examples.
+
 ## Supporting externalizable dependencies with JavaScript code
 
 Support for an externalizable dependency with JavaScript code
@@ -146,6 +152,10 @@ can be added as a non-externalizable dependency. In this case
 simply add the path to the JavaScript file in the `deps_files`
 list in the `node.gyp` file.
 
+Also add an entry to the `DEP_CATALOG` list in `tools/sbom/generate_sbom.py`, with
+`version_fn` reading the dependency's `package.json`, so the dependency
+appears in the generated SBOM.
+
 ## Common approach for dependencies with WASM components
 
 WASM components within dependencies are most often built

tools/sbom/README.md

@@ -0,0 +1,43 @@
+# SBOM generation
+
+Generates a [CycloneDX](https://cyclonedx.org/) Software Bill of Materials
+(SBOM) in JSON describing the bundled runtime dependencies of the Node.js
+binary.
+
+## Usage
+
+Run `./configure` first. The set of dependencies that end up in the binary is
+read from `config.gypi`.
+
+```bash
+make sbom       # write out/Release/node-v<version>-sbom.json
+make test-sbom  # validate the SBOM written by `make sbom`
+```
+
+The script can also be run directly:
+
+```bash
+python tools/sbom/generate_sbom.py [--output PATH]
+python tools/sbom/generate_sbom.py --validate [--output PATH]
+```
+
+## What the SBOM contains
+
+* `metadata.component`: the Node.js binary itself.
+* `components`: each bundled dependency that is linked into the binary, with
+  name, version and purl. Dependencies excluded by the configure options are
+  omitted.
+* `dependencies`: a single entry from the Node.js binary to every component.
+  Sub-dependencies of bundled dependencies are not recorded, and components
+  with no dependencies of their own get no entry.
+* `formulation`: build environment details (compilers, glibc version and the
+  configure command), when they can be determined. The configure command is
+  published as-is and may contain local paths.
+
+A dependency whose version cannot be read is recorded as `unknown` with a
+warning rather than failing the build.
+
+## Adding a dependency
+
+Add an entry to `DEP_CATALOG` in `generate_sbom.py` with its name, purl base,
+version extractor and, if it is conditional, its scope.