Something went wrong. Try again.
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136#!/usr/bin/env python3# SPDX-License-Identifier: GPL-2.0-only OR MIT# Copyright (C) 2025 TNG Technology Consulting GmbH
"""Compute software bill of materials in SPDX format describing a kernel build."""
import jsonimport loggingimport osimport sysimport timeimport uuidimport sbom.sbom_logging as sbom_loggingfrom sbom.config import get_configfrom sbom.path_utils import is_relative_tofrom sbom.spdx import JsonLdSpdxDocument, SpdxIdGeneratorfrom sbom.spdx.core import CreationInfo, SpdxDocumentfrom sbom.spdx_graph import SpdxIdGeneratorCollection, build_spdx_graphsfrom sbom.cmd_graph import CmdGraph
def _exit_with_summary(write_output_on_error: bool = False) -> None: warning_summary = sbom_logging.summarize_warnings() error_summary = sbom_logging.summarize_errors() if warning_summary: logging.warning(warning_summary) if error_summary: logging.error(error_summary) if not write_output_on_error: logging.info( "Use --write-output-on-error to generate output documents even when errors occur. " "Note that in this case the generated documents may be incomplete." ) sys.exit(1)
def main(): # Read config config = get_config()
# Configure logging logging.basicConfig( level=logging.DEBUG if config.debug else logging.INFO, format="[%(levelname)s] %(message)s", )
# Build cmd graph logging.debug("Start building cmd graph") start_time = time.time() cmd_graph = CmdGraph.create(config.root_paths, config) logging.debug(f"Built cmd graph in {time.time() - start_time} seconds")
# Save used files document if config.generate_used_files: if config.src_tree == config.obj_tree: logging.info( f"Extracting all files from the cmd graph to {config.used_files_file_name} " "instead of only source files because source files cannot be " "reliably classified when the source and object trees are identical.", ) used_files = [os.path.relpath(node.absolute_path, config.src_tree) for node in cmd_graph] logging.debug(f"Found {len(used_files)} files in cmd graph.") else: used_files = [ os.path.relpath(node.absolute_path, config.src_tree) for node in cmd_graph if is_relative_to(node.absolute_path, config.src_tree) and not is_relative_to(node.absolute_path, config.obj_tree) ] logging.debug(f"Found {len(used_files)} source files in cmd graph") if not sbom_logging.has_errors() or config.write_output_on_error: used_files_path = os.path.join(config.output_directory, config.used_files_file_name) with open(used_files_path, "w", encoding="utf-8") as f: f.write("\n".join(str(file_path) for file_path in used_files)) logging.debug(f"Successfully saved {used_files_path}")
if config.generate_spdx is False: _exit_with_summary(config.write_output_on_error) return
# Build SPDX Documents logging.debug("Start generating SPDX graph based on cmd graph") start_time = time.time()
# The real uuid will be generated based on the content of the SPDX graphs # to ensure that the same SPDX document is always assigned the same uuid. PLACEHOLDER_UUID = "00000000-0000-0000-0000-000000000000" spdx_id_base_namespace = f"{config.spdxId_prefix}{PLACEHOLDER_UUID}/" spdx_id_generators = SpdxIdGeneratorCollection( base=SpdxIdGenerator(prefix="p", namespace=spdx_id_base_namespace), source=SpdxIdGenerator(prefix="s", namespace=f"{spdx_id_base_namespace}source/"), build=SpdxIdGenerator(prefix="b", namespace=f"{spdx_id_base_namespace}build/"), output=SpdxIdGenerator(prefix="o", namespace=f"{spdx_id_base_namespace}output/"), )
spdx_graphs = build_spdx_graphs( cmd_graph, spdx_id_generators, config, ) spdx_id_uuid = uuid.uuid5( uuid.NAMESPACE_URL, "".join( json.dumps(element.to_dict()) for spdx_graph in spdx_graphs.values() for element in spdx_graph.to_list() ), ) logging.debug(f"Generated SPDX graph in {time.time() - start_time} seconds")
if not sbom_logging.has_errors() or config.write_output_on_error: for kernel_sbom_kind, spdx_graph in spdx_graphs.items(): spdx_graph_objects = spdx_graph.to_list() # Add warning and error summary to creation info comment creation_info = next(element for element in spdx_graph_objects if isinstance(element, CreationInfo)) creation_info.comment = "\n".join([ sbom_logging.summarize_warnings(), sbom_logging.summarize_errors(), ]).strip() # Replace Placeholder uuid with real uuid for spdxIds spdx_document = next(element for element in spdx_graph_objects if isinstance(element, SpdxDocument)) for namespaceMap in spdx_document.namespaceMap: namespaceMap.namespace = namespaceMap.namespace.replace(PLACEHOLDER_UUID, str(spdx_id_uuid)) # Serialize SPDX graph to JSON-LD spdx_doc = JsonLdSpdxDocument(graph=spdx_graph_objects) save_path = os.path.join(config.output_directory, config.spdx_file_names[kernel_sbom_kind]) spdx_doc.save(save_path, config.prettify_json) logging.debug(f"Successfully saved {save_path}")
_exit_with_summary(config.write_output_on_error)
# Call main methodif __name__ == "__main__": main()