tools,build: add CycloneDX SBOM generation

[BethGriggs]

This is a proof-of-concept for build-time SBOM generation in Node.js core (nodejs/security-wg#1115).

The PR adds tools/generate-sbom.py, a stdlib-only Python 3 script that produces a CycloneDX 1.5 JSON Software Bill of Materials covering all bundled runtime dependencies of the Node.js binary.

The script reads config.gypi (produced by ./configure) to determine which dependencies are active in the current build, then extracts version strings from committed C headers, CMakeLists.txt files, package.json files,
and other metadata sources across all deps/ subdirectories. Dependencies disabled via configure flags or satisfied by system libraries are listed with scope: excluded so the document accurately reflects the actual build.

./configure
make sbom       # → out/Release/node-v27.0.0-sbom.json
make test-sbom  # validates the output

Pre-emptive questions

• How much ongoing maintenance does this require?
  • Little. Dep version bumps are picked up automatically from committed headers and package.json files. New JS files in lib/ flow through config.gypi automatically. The only manual step is one DEP_CATALOG entry when a new C/C++ dep is added - a CI test enforces this so a missing entry fails rather than producing a silent gap.
• Why CycloneDX and not SPDX?:
  • npm already ships a CycloneDX 1.5 implementation in deps/npm/lib/utils/sbom-cyclonedx.js. SPDX support could be added later behind a --format flag.
• Why Python and not a Node.js script?:
  • The script runs before node is built. ./configure just needs to have run. Python is already the language of the entire build toolchain (configure.py, gyp_node.py, install.py).
• Why not generate this automatically during make build / make release?
  • Intentionally out of scope for this PR, the idea is that we'd review and iterate before committing to ship it as a release asset.

SBOM snippets

{
  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "serialNumber": "urn:uuid:17555426-32bc-454a-b766-1a7de082741c",
  "version": 1,
  "metadata": {
    "timestamp": "2026-10-15T13:21:37.952127+00:00",
    "lifecycles": [
      {
        "phase": "build"
      }
    ],
    "tools": [
      {
        "vendor": "Node.js",
        "name": "generate_sbom.py",
        "version": "27.0.0"
      }
    ],
    "component": {
      "bom-ref": "nodejs@27.0.0",
      "type": "framework",
      "name": "nodejs",
      "version": "27.0.0",
      "description": "Node.js JavaScript runtime",
      "purl": "pkg:github/nodejs/node@27.0.0"
    },

 ...
 "components": [
    {
      "bom-ref": "openssl@3.5.9",
      "type": "library",
      "name": "openssl",
      "version": "3.5.9",
      "description": "TLS/SSL and general-purpose cryptography library",
      "scope": "required",
      "purl": "pkg:github/openssl/openssl@3.5.9"
    },
    {
      "bom-ref": "zlib@1.3.2.1",
      "type": "library",
      "name": "zlib",
      "version": "1.3.2.1",
      "description": "General-purpose lossless data compression library",
      "scope": "required",
      "purl": "pkg:github/madler/zlib@1.3.2.1"
    },
    ...

[nodejs-github-bot]

Review requested:

• @nodejs/tsc