Update MariaDB Server SBOM generation to CISA 2026 Minimum Elements

Background & Objective

MariaDB generates Software Bills of Materials (SBOMs) to provide visibility into software components and meet customer and regulatory requirements. CISA has published the 2026 Minimum Elements for SBOM (replacing the 2021 NTIA Minimum Elements).

This task strictly covers updating the build system / CMake SBOM generator in the MariaDB Server repository so that the generated CycloneDX JSON structure conforms to CycloneDX 1.6 and CISA 2026 metadata fields.

Scope: CMake / Repository Generator

Update the CMake SBOM generation scripts in the server repository to include the following CISA 2026 fields in the output JSON:

• Data Format & Spec: CycloneDX JSON (specVersion 1.6).
• SBOM Author & Tool Metadata:
  • Set SBOM Author (MariaDB Foundation / MariaDB Plc as appropriate).
  • Populate tool.name and tool.version for the generation tool.
• SBOM Lifecycle Context:
  • Populate SBOM Generation Context (e.g., build or post-build).
• Component Identifiers & Hashes:
  • Ensure each component includes at least one common identifier (purl and/or cpe).
  • Include component cryptographic hashes (hash.alg and hash.content) for executable artifacts where available.
• Licenses:
  • Ensure component licenses use valid SPDX license identifiers where available.
• Dependencies:
  • Ensure dependency relationships represent the direct and transitive dependency graph.
• Unknown Values:
  • Explicitly represent unknown required elements as unknown rather than omitting the field.

Acceptance Criteria

• [ ] CMake build targets produce a valid CycloneDX 1.6 JSON document containing the CISA 2026 fields above.

Out of Scope (Handled by Release Engineering / CI)

• Digital signing / signature attestations (GPG / Cosign) during release builds.
• CI pipeline integration, automated schema gates, and long-term storage upload/publishing.