SBOM support for the RubyGems ecosystem

[colby-swandale]

Organisations and developers increasingly need to know exactly what's in the software they depend on. SBOMs (Software Bill of Materials) are the standard answer, a machine-readable inventory of a package's components and dependencies. RubyGems.org currently has no native SBOM support: maintainers can't publish SBOMs with their gems, and consumers have no way to access them from the registry.

This initiative adds SBOM support to the RubyGems ecosystem, giving maintainers a way to publish SBOMs alongside gem releases, and giving consumers and automated tooling a way to access them.

Done when:

• A standard SBOM format is selected (CycloneDX, SPDX, or both)
• Gem maintainers can publish SBOMs alongside gem releases
• Published SBOMs are accessible via the RubyGems.org API
• SBOMs are surfaced on gem pages on RubyGems.org
• RubyGems CLI supports generating SBOMs for a gem's dependencies
• Published SBOMs meet NTIA/CISA minimum elements

[hsbt]

https://github.com/hsbt/bundler-sbom is available. Some poeple already used this for their company. I'm okay to transfer this and their right to RubyCentral if that needed.