Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(sbom): use Annotation instead of AttributionTexts for SPDX formats #7811

Merged
merged 5 commits into from
Oct 30, 2024
Merged

fix(sbom): use Annotation instead of AttributionTexts for SPDX formats #7811

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
84db73e
fix(spdx): use `Annotation` instead of `AttributionTexts`
DmitriyLewen Oct 29, 2024
414518d
test(unit): update tests
DmitriyLewen Oct 29, 2024
30018da
test(integration): update tests
DmitriyLewen Oct 29, 2024
ef2a73d
refactor: don't save timeNow in Marshaller
DmitriyLewen Oct 29, 2024
6c1592d
chore: remove unneeded changes
DmitriyLewen Oct 29, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 27 additions & 12 deletions integration/testdata/conda-spdx.json.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,10 +31,15 @@
"referenceLocator": "pkg:conda/[email protected]"
}
],
"attributionTexts": [
"PkgType: conda-pkg"
],
"primaryPackagePurpose": "LIBRARY"
"primaryPackagePurpose": "LIBRARY",
"annotations": [
{
"annotator": "Tool: trivy-dev",
"annotationDate": "2021-08-25T12:20:30Z",
"annotationType": "OTHER",
"comment": "PkgType: conda-pkg"
}
]
},
{
"name": "pip",
Expand All @@ -55,20 +60,30 @@
"referenceLocator": "pkg:conda/[email protected]"
}
],
"attributionTexts": [
"PkgType: conda-pkg"
],
"primaryPackagePurpose": "LIBRARY"
"primaryPackagePurpose": "LIBRARY",
"annotations": [
{
"annotator": "Tool: trivy-dev",
"annotationDate": "2021-08-25T12:20:30Z",
"annotationType": "OTHER",
"comment": "PkgType: conda-pkg"
}
]
},
{
"name": "testdata/fixtures/repo/conda",
"SPDXID": "SPDXRef-Filesystem-2e2426fd0f2580ef",
"downloadLocation": "NONE",
"filesAnalyzed": false,
"attributionTexts": [
"SchemaVersion: 2"
],
"primaryPackagePurpose": "SOURCE"
"primaryPackagePurpose": "SOURCE",
"annotations": [
{
"annotator": "Tool: trivy-dev",
"annotationDate": "2021-08-25T12:20:30Z",
"annotationType": "OTHER",
"comment": "SchemaVersion: 2"
}
]
}
],
"files": [
Expand Down
93 changes: 69 additions & 24 deletions integration/testdata/julia-spdx.json.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,11 +17,21 @@
"SPDXID": "SPDXRef-Application-18fc3597717a3e56",
"downloadLocation": "NONE",
"filesAnalyzed": false,
"attributionTexts": [
"Class: lang-pkgs",
"Type: julia"
],
"primaryPackagePurpose": "APPLICATION"
"primaryPackagePurpose": "APPLICATION",
"annotations": [
{
"annotator": "Tool: trivy-dev",
"annotationDate": "2021-08-25T12:20:30Z",
"annotationType": "OTHER",
"comment": "Class: lang-pkgs"
},
{
"annotator": "Tool: trivy-dev",
"annotationDate": "2021-08-25T12:20:30Z",
"annotationType": "OTHER",
"comment": "Type: julia"
}
]
},
{
"name": "A",
Expand All @@ -40,11 +50,21 @@
"referenceLocator": "pkg:julia/[email protected]?uuid=ead4f63c-334e-11e9-00e6-e7f0a5f21b60"
}
],
"attributionTexts": [
"PkgID: ead4f63c-334e-11e9-00e6-e7f0a5f21b60",
"PkgType: julia"
],
"primaryPackagePurpose": "LIBRARY"
"primaryPackagePurpose": "LIBRARY",
"annotations": [
{
"annotator": "Tool: trivy-dev",
"annotationDate": "2021-08-25T12:20:30Z",
"annotationType": "OTHER",
"comment": "PkgID: ead4f63c-334e-11e9-00e6-e7f0a5f21b60"
},
{
"annotator": "Tool: trivy-dev",
"annotationDate": "2021-08-25T12:20:30Z",
"annotationType": "OTHER",
"comment": "PkgType: julia"
}
]
},
{
"name": "B",
Expand All @@ -63,11 +83,21 @@
"referenceLocator": "pkg:julia/[email protected]?uuid=f41f7b98-334e-11e9-1257-49272045fb24"
}
],
"attributionTexts": [
"PkgID: f41f7b98-334e-11e9-1257-49272045fb24",
"PkgType: julia"
],
"primaryPackagePurpose": "LIBRARY"
"primaryPackagePurpose": "LIBRARY",
"annotations": [
{
"annotator": "Tool: trivy-dev",
"annotationDate": "2021-08-25T12:20:30Z",
"annotationType": "OTHER",
"comment": "PkgID: f41f7b98-334e-11e9-1257-49272045fb24"
},
{
"annotator": "Tool: trivy-dev",
"annotationDate": "2021-08-25T12:20:30Z",
"annotationType": "OTHER",
"comment": "PkgType: julia"
}
]
},
{
"name": "B",
Expand All @@ -86,21 +116,36 @@
"referenceLocator": "pkg:julia/[email protected]?uuid=edca9bc6-334e-11e9-3554-9595dbb4349c"
}
],
"attributionTexts": [
"PkgID: edca9bc6-334e-11e9-3554-9595dbb4349c",
"PkgType: julia"
],
"primaryPackagePurpose": "LIBRARY"
"primaryPackagePurpose": "LIBRARY",
"annotations": [
{
"annotator": "Tool: trivy-dev",
"annotationDate": "2021-08-25T12:20:30Z",
"annotationType": "OTHER",
"comment": "PkgID: edca9bc6-334e-11e9-3554-9595dbb4349c"
},
{
"annotator": "Tool: trivy-dev",
"annotationDate": "2021-08-25T12:20:30Z",
"annotationType": "OTHER",
"comment": "PkgType: julia"
}
]
},
{
"name": "testdata/fixtures/repo/julia",
"SPDXID": "SPDXRef-Filesystem-1be792dd0077c431",
"downloadLocation": "NONE",
"filesAnalyzed": false,
"attributionTexts": [
"SchemaVersion: 2"
],
"primaryPackagePurpose": "SOURCE"
"primaryPackagePurpose": "SOURCE",
"annotations": [
{
"annotator": "Tool: trivy-dev",
"annotationDate": "2021-08-25T12:20:30Z",
"annotationType": "OTHER",
"comment": "SchemaVersion: 2"
}
]
}
],
"relationships": [
Expand Down
42 changes: 27 additions & 15 deletions pkg/sbom/spdx/marshal.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,8 @@ const (
PackageSupplierNoAssertion = "NOASSERTION"
PackageSupplierOrganization = "Organization"

PackageAnnotatorToolField = "Tool"

RelationShipContains = common.TypeRelationshipContains
RelationShipDescribe = common.TypeRelationshipDescribe
RelationShipDependsOn = common.TypeRelationshipDependsOn
Expand Down Expand Up @@ -122,14 +124,17 @@ func (m *Marshaler) Marshal(ctx context.Context, bom *core.BOM) (*spdx.Document,
packages []*spdx.Package
)

// Lock time to use same time for all spdx fields
timeNow := clock.Now(ctx).UTC().Format(time.RFC3339)

root := bom.Root()
pkgDownloadLocation := m.packageDownloadLocation(root)

// Component ID => SPDX ID
packageIDs := make(map[uuid.UUID]spdx.ElementID)

// Root package contains OS, OS packages, language-specific packages and so on.
rootPkg, err := m.rootSPDXPackage(root, pkgDownloadLocation)
rootPkg, err := m.rootSPDXPackage(root, timeNow, pkgDownloadLocation)
if err != nil {
return nil, xerrors.Errorf("failed to generate a root package: %w", err)
}
Expand All @@ -144,7 +149,7 @@ func (m *Marshaler) Marshal(ctx context.Context, bom *core.BOM) (*spdx.Document,
if c.Root {
continue
}
spdxPackage, err := m.spdxPackage(c, pkgDownloadLocation)
spdxPackage, err := m.spdxPackage(c, timeNow, pkgDownloadLocation)
if err != nil {
return nil, xerrors.Errorf("spdx package error: %w", err)
}
Expand Down Expand Up @@ -216,7 +221,7 @@ func (m *Marshaler) Marshal(ctx context.Context, bom *core.BOM) (*spdx.Document,
CreatorType: "Tool",
},
},
Created: clock.Now(ctx).UTC().Format(time.RFC3339),
Created: timeNow,
},
Packages: packages,
Relationships: relationShips,
Expand All @@ -237,7 +242,7 @@ func (m *Marshaler) packageDownloadLocation(root *core.Component) string {
return location
}

func (m *Marshaler) rootSPDXPackage(root *core.Component, pkgDownloadLocation string) (*spdx.Package, error) {
func (m *Marshaler) rootSPDXPackage(root *core.Component, timeNow, pkgDownloadLocation string) (*spdx.Package, error) {
var externalReferences []*spdx.PackageExternalReference
// When the target is a container image, add PURL to the external references of the root package.
if root.PkgIdentifier.PURL != nil {
Expand All @@ -258,17 +263,25 @@ func (m *Marshaler) rootSPDXPackage(root *core.Component, pkgDownloadLocation st
PackageName: root.Name,
PackageSPDXIdentifier: elementID(camelCase(string(root.Type)), pkgID),
PackageDownloadLocation: pkgDownloadLocation,
PackageAttributionTexts: m.spdxAttributionTexts(root),
Annotations: m.spdxAnnotations(root, timeNow),
PackageExternalReferences: externalReferences,
PrimaryPackagePurpose: pkgPurpose,
}, nil
}

func (m *Marshaler) appendAttributionText(attributionTexts []string, key, value string) []string {
func (m *Marshaler) appendAnnotation(annotations []spdx.Annotation, timeNow, key, value string) []spdx.Annotation {
if value == "" {
return attributionTexts
return annotations
}
return append(attributionTexts, fmt.Sprintf("%s: %s", key, value))
return append(annotations, spdx.Annotation{
AnnotationDate: timeNow,
AnnotationType: spdx.CategoryOther,
Annotator: spdx.Annotator{
Annotator: fmt.Sprintf("%s-%s", CreatorTool, m.appVersion),
AnnotatorType: PackageAnnotatorToolField,
},
AnnotationComment: fmt.Sprintf("%s: %s", key, value),
})
}

func (m *Marshaler) purlExternalReference(packageURL string) *spdx.PackageExternalReference {
Expand All @@ -287,7 +300,7 @@ func (m *Marshaler) advisoryExternalReference(primaryURL string) *spdx.PackageEx
}
}

func (m *Marshaler) spdxPackage(c *core.Component, pkgDownloadLocation string) (spdx.Package, error) {
func (m *Marshaler) spdxPackage(c *core.Component, timeNow, pkgDownloadLocation string) (spdx.Package, error) {
pkgID, err := calcPkgID(m.hasher, c)
if err != nil {
return spdx.Package{}, xerrors.Errorf("failed to get os metadata package ID: %w", err)
Expand Down Expand Up @@ -343,7 +356,7 @@ func (m *Marshaler) spdxPackage(c *core.Component, pkgDownloadLocation string) (
PrimaryPackagePurpose: purpose,
PackageDownloadLocation: pkgDownloadLocation,
PackageExternalReferences: pkgExtRefs,
PackageAttributionTexts: m.spdxAttributionTexts(c),
Annotations: m.spdxAnnotations(c, timeNow),
PackageSourceInfo: sourceInfo,
PackageSupplier: supplier,
PackageChecksums: m.spdxChecksums(digests),
Expand All @@ -365,16 +378,15 @@ func spdxPkgName(component *core.Component) string {
}
return component.Name
}

func (m *Marshaler) spdxAttributionTexts(c *core.Component) []string {
var texts []string
func (m *Marshaler) spdxAnnotations(c *core.Component, timeNow string) []spdx.Annotation {
var annotations []spdx.Annotation
for _, p := range c.Properties {
// Add properties that are not in other fields.
if !slices.Contains(duplicateProperties, p.Name) {
texts = m.appendAttributionText(texts, p.Name, p.Value)
annotations = m.appendAnnotation(annotations, timeNow, p.Name, p.Value)
}
}
return texts
return annotations
}

func (m *Marshaler) spdxLicense(c *core.Component) string {
Expand Down
Loading