diff --git a/meta/lib/oe/sbom30.py b/meta/lib/oe/sbom30.py index 0a7b4c05fb..28d251a7ac 100644 --- a/meta/lib/oe/sbom30.py +++ b/meta/lib/oe/sbom30.py @@ -217,9 +217,11 @@ def to_list(l): class ObjectSet(oe.spdx30.SHACLObjectSet): - def __init__(self, d): + def __init__(self, d, name=None, link_prefix=None): super().__init__() self.d = d + self.name = name + self.link_prefix = link_prefix def create_index(self): self.by_sha256_hash = {} @@ -322,6 +324,8 @@ class ObjectSet(oe.spdx30.SHACLObjectSet): uuid.NAMESPACE_DNS, self.d.getVar("SPDX_UUID_NAMESPACE") ) pn = self.d.getVar("PN") + if self.link_prefix and self.name: + pn = "%s-%s" % (self.link_prefix, self.name) return "%s/%s-%s" % ( self.d.getVar("SPDX_NAMESPACE_PREFIX"), pn, @@ -341,12 +345,15 @@ class ObjectSet(oe.spdx30.SHACLObjectSet): elif namespace not in e._id: bb.warn(f"Namespace {namespace} not found in {e._id}") else: + pn = self.d.getVar("PN") + if self.link_prefix and self.name: + pn = "%s-%s" % (self.link_prefix, self.name) alias_ext = set_alias( e, e._id.replace(unihash, "UNIHASH").replace( namespace, - "http://spdx.org/spdxdocs/openembedded-alias/" - + self.d.getVar("PN"), + f"{self.d.getVar('SPDX_NAMESPACE_PREFIX')}/openembedded-alias/" + + pn, ), ) @@ -805,8 +812,8 @@ class ObjectSet(oe.spdx30.SHACLObjectSet): ) @classmethod - def new_objset(cls, d, name, copy_from_bitbake_doc=True): - objset = cls(d) + def new_objset(cls, d, name, copy_from_bitbake_doc=True, link_prefix=None): + objset = cls(d, name=name, link_prefix=link_prefix) document = oe.spdx30.SpdxDocument( _id=objset.new_spdxid("document", name), @@ -887,9 +894,9 @@ class ObjectSet(oe.spdx30.SHACLObjectSet): return missing_spdxids -def load_jsonld(d, path, required=False): +def load_jsonld(d, path, required=False, name=None, link_prefix=None): deserializer = oe.spdx30.JSONLDDeserializer() - objset = ObjectSet(d) + objset = ObjectSet(d, name=name, link_prefix=link_prefix) try: with path.open("rb") as f: deserializer.read(f, objset) @@ -918,9 +925,9 @@ def jsonld_hash_path(_id): return Path("by-spdxid-hash") / h[:2], h -def load_jsonld_by_arch(d, arch, subdir, name, *, required=False): +def load_jsonld_by_arch(d, arch, subdir, name, *, required=False, link_prefix=None): path = jsonld_arch_path(d, arch, subdir, name) - objset = load_jsonld(d, path, required=required) + objset = load_jsonld(d, path, required=required, name=name, link_prefix=link_prefix) if objset is not None: return (objset, path) return (None, None) @@ -1049,8 +1056,8 @@ def find_root_obj_in_jsonld(d, subdir, fn_name, obj_type, **attr_filter): return spdx_obj, objset -def load_obj_in_jsonld(d, arch, subdir, fn_name, obj_type, **attr_filter): - objset, fn = load_jsonld_by_arch(d, arch, subdir, fn_name, required=True) +def load_obj_in_jsonld(d, arch, subdir, fn_name, obj_type, link_prefix=None, **attr_filter): + objset, fn = load_jsonld_by_arch(d, arch, subdir, fn_name, required=True, link_prefix=link_prefix) spdx_obj = objset.find_filter(obj_type, **attr_filter) if not spdx_obj: diff --git a/meta/lib/oe/spdx30_tasks.py b/meta/lib/oe/spdx30_tasks.py index 5aeed5cd6f..ef829fbbf1 100644 --- a/meta/lib/oe/spdx30_tasks.py +++ b/meta/lib/oe/spdx30_tasks.py @@ -461,7 +461,7 @@ def create_spdx(d): if not include_vex in ("none", "current", "all"): bb.fatal("SPDX_INCLUDE_VEX must be one of 'none', 'current', 'all'") - build_objset = oe.sbom30.ObjectSet.new_objset(d, d.getVar("PN")) + build_objset = oe.sbom30.ObjectSet.new_objset(d, d.getVar("PN"), link_prefix="recipe") build = build_objset.new_task_build("recipe", "recipe") build_objset.set_element_alias(build) @@ -574,7 +574,7 @@ def create_spdx(d): bb.debug(1, "Creating SPDX for package %s" % pkg_name) - pkg_objset = oe.sbom30.ObjectSet.new_objset(d, pkg_name) + pkg_objset = oe.sbom30.ObjectSet.new_objset(d, pkg_name, link_prefix="package") spdx_package = pkg_objset.add_root( oe.spdx30.software_Package( @@ -793,7 +793,7 @@ def create_package_spdx(d): # Any element common to all packages that need to be referenced by ID # should be written into this objset set common_objset = oe.sbom30.ObjectSet.new_objset( - d, "%s-package-common" % d.getVar("PN") + d, "%s-package-common" % d.getVar("PN"), link_prefix="package" ) pkgdest = Path(d.getVar("PKGDEST")) @@ -812,6 +812,7 @@ def create_package_spdx(d): "packages-staging", pkg_name, oe.spdx30.software_Package, + link_prefix="package", software_primaryPurpose=oe.spdx30.software_SoftwarePurpose.install, ) @@ -1002,7 +1003,7 @@ def create_rootfs_spdx(d): with root_packages_file.open("r") as f: packages = json.load(f) - objset = oe.sbom30.ObjectSet.new_objset(d, "%s-%s" % (image_basename, machine)) + objset = oe.sbom30.ObjectSet.new_objset(d, "%s-%s" % (image_basename, machine), link_prefix="rootfs") rootfs = objset.add_root( oe.spdx30.software_Package( @@ -1037,7 +1038,7 @@ def create_image_spdx(d): image_basename = d.getVar("IMAGE_BASENAME") machine = d.getVar("MACHINE") - objset = oe.sbom30.ObjectSet.new_objset(d, "%s-%s" % (image_basename, machine)) + objset = oe.sbom30.ObjectSet.new_objset(d, "%s-%s" % (image_basename, machine), link_prefix="image") with manifest_path.open("r") as f: manifest = json.load(f) @@ -1150,7 +1151,7 @@ def sdk_create_spdx(d, sdk_type, spdx_work_dir, toolchain_outputname): sdk_name = toolchain_outputname + "-" + sdk_type sdk_packages = oe.sdk.sdk_list_installed_packages(d, sdk_type == "target") - objset = oe.sbom30.ObjectSet.new_objset(d, sdk_name) + objset = oe.sbom30.ObjectSet.new_objset(d, sdk_name, link_prefix="sdk") sdk_rootfs = objset.add_root( oe.spdx30.software_Package(