open-eid · metsma · Mar 19, 2026
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -12,15 +12,19 @@ jobs:
     steps:
     - name: Checkout
       uses: actions/checkout@v6
+    - name: Install CMake
+      uses: lukka/get-cmake@latest
     - name: Build
       run: |
         cmake -S . -B build -DCMAKE_OSX_ARCHITECTURES="x86_64;arm64" -DCMAKE_BUILD_TYPE=RelWithDebInfo
         cmake --build build --target pkgbuild
     - name: Archive artifacts
-      uses: actions/upload-artifact@v6
+      uses: actions/upload-artifact@v7
       with:
         name: macOS
-        path: build/*.pkg
+        path: |
+          build/*.pkg
+          build/ID-updater.spdx.json
   windows:
     name: Build on Windows
     runs-on: ${{ matrix.platform == 'arm64' && 'windows-11-arm' || 'windows-2025' }}
@@ -50,6 +54,8 @@ jobs:
       uses: ilammy/msvc-dev-cmd@v1
       with:
         arch: ${{ matrix.platform }}
+    - name: Install CMake
+      uses: lukka/get-cmake@latest
     - name: Install WiX
       run: |
         dotnet tool install -g wix --version 6.0.2
@@ -63,7 +69,9 @@ jobs:
           -DVCPKG_TARGET_TRIPLET=${{ matrix.platform }}-windows
         cmake --build build --target installer
     - name: Archive artifacts
-      uses: actions/upload-artifact@v6
+      uses: actions/upload-artifact@v7
       with:
         name: msi_${{ matrix.vcver }}_${{ matrix.platform }}
-        path: build/*.msi
+        path: |
+          build/*.msi
+          build/ID-updater.spdx.json
diff --git a/Application.cpp b/Application.cpp
@@ -1,21 +1,5 @@
-/*
- * id-updater
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
- *
- */
+// SPDX-FileCopyrightText: Estonian Information System Authority
+// SPDX-License-Identifier: LGPL-2.1-or-later
 
 #include "Application.h"
 

diff --git a/Application.h b/Application.h
@@ -1,21 +1,5 @@
-/*
- * id-updater
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
- *
- */
+// SPDX-FileCopyrightText: Estonian Information System Authority
+// SPDX-License-Identifier: LGPL-2.1-or-later
 
 #pragma once
 

diff --git a/CMakeLists.txt b/CMakeLists.txt
@@ -1,5 +1,9 @@
 cmake_minimum_required(VERSION 3.22)
-project(ID-updater VERSION 3.19.0)
+project(ID-updater VERSION 3.19.0
+	DESCRIPTION "Open-eID updater application for macOS and Windows"
+	HOMEPAGE_URL https://github.com/open-eid/updater
+	SPDX_LICENSE LGPL-2.1-or-later
+)
 
 macro( SET_ENV NAME DEF )
 	if( DEFINED ENV{${NAME}} )
@@ -10,6 +14,7 @@ macro( SET_ENV NAME DEF )
 endmacro()
 
 set_env(BUILD_NUMBER 0)
+set(CMAKE_EXPERIMENTAL_GENERATE_SBOM ca494ed3-b261-4205-a01f-603c95e4cae0)
 set(VERSION ${PROJECT_VERSION}.${BUILD_NUMBER})
 set_env( CONFIG_URL "https://id.eesti.ee/config.json" CACHE STRING "Set Config URL" )
 set_env( SIGNCERT "" CACHE STRING "Common name of certificate to used sign binaries, empty skip signing" )
@@ -118,7 +123,7 @@ if( APPLE )
 		MACOSX_BUNDLE_INFO_PLIST ${CMAKE_CURRENT_SOURCE_DIR}/prefPane/Info.plist.cmake
 		MACOSX_BUNDLE_BUNDLE_NAME ${PROJECT_NAME}
 		MACOSX_BUNDLE_GUI_IDENTIFIER "ee.ria.${PROJECT_NAME}"
-		MACOSX_BUNDLE_COPYRIGHT "(C) 2010-2025 Estonian Information System Authority"
+		MACOSX_BUNDLE_COPYRIGHT "(C) 2010-2026 Estonian Information System Authority"
 		MACOSX_BUNDLE_ICON_FILE Icon.icns
 		MACOSX_BUNDLE_SHORT_VERSION_STRING ${PROJECT_VERSION}
 		MACOSX_BUNDLE_BUNDLE_VERSION ${BUILD_NUMBER}
@@ -129,7 +134,10 @@ if( APPLE )
 	add_custom_command(TARGET ${PROJECT_NAME} POST_BUILD
 		COMMAND cp ${CMAKE_CURRENT_BINARY_DIR}/id-updater-helper $<TARGET_BUNDLE_CONTENT_DIR:${PROJECT_NAME}>/Resources
 	)
-	install( TARGETS ${PROJECT_NAME} DESTINATION /Library/PreferencePanes )
+	install(TARGETS ${PROJECT_NAME} EXPORT ${PROJECT_NAME}Export DESTINATION /Library/PreferencePanes)
+	export(SBOM ${PROJECT_NAME} EXPORT ${PROJECT_NAME}Export
+		#PACKAGE_URL "pkg:github/open-eid/updater@${PROJECT_VERSION}"                                                           
+	)
 
 	# Sign bundle after resources are copied
 	add_custom_target(signhelper DEPENDS ${PROJECT_NAME})
@@ -197,7 +205,6 @@ else()
 		msi wintrust Crypt32 taskschd comsupp Setupapi winscard Wtsapi32
 	)
 	qt_add_translations(${PROJECT_NAME} TS_FILES idupdater_et.ts idupdater_ru.ts
-		common/translations/common_et.ts common/translations/common_ru.ts
 		common/translations/qtbase_et.ts common/translations/qtbase_ru.ts
 		RESOURCE_PREFIX /
 		LUPDATE_OPTIONS -locations none
@@ -231,6 +238,8 @@ else()
 			${CMAKE_SOURCE_DIR}/common/WixUI_Minimal.wxs
 			-o ${MSI_FILE}.msi
 	)
+	install(TARGETS ${PROJECT_NAME} EXPORT ${PROJECT_NAME}Export)
+	export(SBOM ${PROJECT_NAME} EXPORT ${PROJECT_NAME}Export)
 	if(SIGNCERT)
 		if(CROSSSIGNCERT)
 			target_link_options(${PROJECT_NAME} PRIVATE "/INTEGRITYCHECK")

diff --git a/ScheduledUpdateTask.cpp b/ScheduledUpdateTask.cpp
@@ -1,21 +1,5 @@
-/*
- * id-updater
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
- *
- */
+// SPDX-FileCopyrightText: Estonian Information System Authority
+// SPDX-License-Identifier: LGPL-2.1-or-later
 
 #include "ScheduledUpdateTask.h"
 

diff --git a/ScheduledUpdateTask.h b/ScheduledUpdateTask.h
@@ -1,21 +1,5 @@
-/*
- * id-updater
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
- *
- */
+// SPDX-FileCopyrightText: Estonian Information System Authority
+// SPDX-License-Identifier: LGPL-2.1-or-later
 
 #pragma once
 

diff --git a/idupdater.cpp b/idupdater.cpp
@@ -1,21 +1,5 @@
-/*
- * id-updater
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
- *
- */
+// SPDX-FileCopyrightText: Estonian Information System Authority
+// SPDX-License-Identifier: LGPL-2.1-or-later
 
 #include "idupdater.h"
 

diff --git a/idupdater.h b/idupdater.h
@@ -1,21 +1,5 @@
-/*
- * id-updater
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
- *
- */
+// SPDX-FileCopyrightText: Estonian Information System Authority
+// SPDX-License-Identifier: LGPL-2.1-or-later
 
 #pragma once
 

diff --git a/idupdater.rc b/idupdater.rc
@@ -21,7 +21,7 @@ BEGIN
 			VALUE "FileDescription", "ID Updater Application"
 			VALUE "FileVersion", VERSION
 			VALUE "InternalName", "id-updater"
-			VALUE "LegalCopyright", "Copyright (C) 2009-2025 Estonian Information System Authority"
+			VALUE "LegalCopyright", "Copyright (C) 2009-2026 Estonian Information System Authority"
 			VALUE "OriginalFilename", "id-updater.exe"
 			VALUE "ProductName", "id-updater"
 			VALUE "ProductVersion", VERSION

diff --git a/prefPane/AdvancedWindowController.swift b/prefPane/AdvancedWindowController.swift
@@ -1,21 +1,5 @@
-/*
- * id-updater
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
- *
- */
+// SPDX-FileCopyrightText: Estonian Information System Authority
+// SPDX-License-Identifier: LGPL-2.1-or-later
 
 import Cocoa
 import SwiftUI

diff --git a/prefPane/id-updater.m b/prefPane/id-updater.m
@@ -1,21 +1,5 @@
-/*
- * id-updater
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
- *
- */
+// SPDX-FileCopyrightText: Estonian Information System Authority
+// SPDX-License-Identifier: LGPL-2.1-or-later
 
 #import <id_updater_lib/id_updater_lib-Swift.h>
 

diff --git a/prefPane/id-updater.swift b/prefPane/id-updater.swift
@@ -1,21 +1,5 @@
-/*
- * id-updater
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
- *
- */
+// SPDX-FileCopyrightText: Estonian Information System Authority
+// SPDX-License-Identifier: LGPL-2.1-or-later
 
 import PreferencePanes
 import Security

diff --git a/prefPane/main.swift b/prefPane/main.swift
@@ -1,21 +1,5 @@
-/*
- * id-updater
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
- *
- */
+// SPDX-FileCopyrightText: Estonian Information System Authority
+// SPDX-License-Identifier: LGPL-2.1-or-later
 
 import Foundation
 import id_updater_lib

diff --git a/prefPane/update.swift b/prefPane/update.swift
@@ -1,21 +1,5 @@
-/*
- * id-updater
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
- *
- */
+// SPDX-FileCopyrightText: Estonian Information System Authority
+// SPDX-License-Identifier: LGPL-2.1-or-later
 
 import CryptoTokenKit