diff --git a/meta/classes/create-spdx-3.0.bbclass b/meta/classes/create-spdx-3.0.bbclass index 56fd01fd53..9955ffad85 100644 --- a/meta/classes/create-spdx-3.0.bbclass +++ b/meta/classes/create-spdx-3.0.bbclass @@ -163,6 +163,23 @@ SPDX_GIT_PURL_MAPPINGS[doc] = "A space separated list of domain:purl_type \ on gitlab.example.com to the pkg:gitlab PURL type. \ github.com is always mapped to pkg:github by default." +SPDX_INCLUDE_RELEASE_DATE ??= "1" +SPDX_INCLUDE_RELEASE_DATE[doc] = "If set to '1', record the release date of \ + each recipe in the software_Package releaseTime property, derived from \ + SOURCE_DATE_EPOCH. Set to '0' to omit the property entirely." + +SPDX_RELEASE_DATE_INCLUDE_PATCHES ??= "0" +SPDX_RELEASE_DATE_INCLUDE_PATCHES[doc] = "If set to '1', also consider the \ + Date: header of applied patches in SRC_URI when determining the release \ + date recorded in releaseTime, using the newest of SOURCE_DATE_EPOCH and \ + all patch dates found. Has no effect if SPDX_INCLUDE_RELEASE_DATE is '0'." + +SPDX_COMPONENT_RELEASE_DATE ??= "" +SPDX_COMPONENT_RELEASE_DATE[doc] = "Overrides the release date recorded in the \ + releaseTime property for this component. Expected format is full ISO 8601 \ + UTC (YYYY-MM-DDTHH:MM:SSZ). Takes precedence over SPDX_INCLUDE_RELEASE_DATE \ + and SPDX_RELEASE_DATE_INCLUDE_PATCHES." + IMAGE_CLASSES:append = " create-spdx-image-3.0" SDK_CLASSES += "create-spdx-sdk-3.0" @@ -192,7 +209,7 @@ python do_create_recipe_spdx() { import oe.spdx30_tasks oe.spdx30_tasks.create_recipe_spdx(d) } -addtask do_create_recipe_spdx +addtask do_create_recipe_spdx after do_deploy_source_date_epoch SSTATETASKS += "do_create_recipe_spdx" do_create_recipe_spdx[sstate-inputdirs] = "${SPDXRECIPEDEPLOY}" @@ -201,6 +218,7 @@ do_create_recipe_spdx[file-checksums] += "${SPDX3_DEP_FILES}" do_create_recipe_spdx[cleandirs] = "${SPDXRECIPEDEPLOY}" do_create_recipe_spdx[deptask] += "do_create_recipe_spdx" do_create_recipe_spdx[vardeps] += "${SPDX3_VAR_DEPS}" +do_create_recipe_spdx[vardeps] += "SPDX_INCLUDE_RELEASE_DATE SPDX_RELEASE_DATE_INCLUDE_PATCHES SPDX_COMPONENT_RELEASE_DATE" do_create_recipe_spdx[file-checksums] = "${@bb.fetch.get_checksum_file_list(d)}" python do_create_recipe_spdx_setscene () { diff --git a/meta/lib/oe/spdx30_tasks.py b/meta/lib/oe/spdx30_tasks.py index 9978ae731c..e6340c3678 100644 --- a/meta/lib/oe/spdx30_tasks.py +++ b/meta/lib/oe/spdx30_tasks.py @@ -36,6 +36,65 @@ def set_timestamp_now(d, o, prop): delattr(o, prop) +def get_release_date(d): + """Resolve the release date to record in a recipe's releaseTime property. + + Returns a datetime, or None if no release date should be recorded. + """ + override = d.getVar("SPDX_COMPONENT_RELEASE_DATE") + if override: + try: + return datetime.strptime(override, "%Y-%m-%dT%H:%M:%SZ").replace(tzinfo=timezone.utc) + except ValueError: + bb.fatal( + "SPDX_COMPONENT_RELEASE_DATE value '%s' is not valid. " + "Expected format: YYYY-MM-DDTHH:MM:SSZ (e.g. 2024-03-15T12:00:00Z)" % override + ) + + if d.getVar("SPDX_INCLUDE_RELEASE_DATE") != "1": + return None + + source_date_epoch = d.getVar("SOURCE_DATE_EPOCH") + if not source_date_epoch: + return None + + release_date = datetime.fromtimestamp(int(source_date_epoch), tz=timezone.utc) + + if d.getVar("SPDX_RELEASE_DATE_INCLUDE_PATCHES") == "1": + # Only the static Date: header is used, never "git log" on the + # layer's repo, since that varies with clone depth/history. + for url in oe.patch.src_patches(d): + patch_path = bb.fetch.decodeurl(url)[2] + patch_date = _get_patch_date_header(patch_path) + if patch_date and patch_date > release_date: + release_date = patch_date + + return release_date + + +def _get_patch_date_header(patch_path): + """Parse the 'Date:' header from a git-format-patch style file, if + present, and return it as a timezone-aware datetime, or None.""" + from email.utils import parsedate_to_datetime + + try: + with open(patch_path, errors="replace") as f: + for line in f: + if line.startswith("Date:"): + try: + parsed = parsedate_to_datetime(line[len("Date:"):].strip()) + except (ValueError, TypeError): + return None + if parsed.tzinfo is None: + return None + return parsed.astimezone(timezone.utc) + if line.startswith("---") or line.startswith("diff --git"): + break + except OSError: + return None + return None + + def add_license_expression( d, objset, license_expression, license_data, search_objsets=[] ): @@ -631,6 +690,12 @@ def create_recipe_spdx(d): if val := d.getVar("DESCRIPTION"): recipe.description = val + release_date = get_release_date(d) + if release_date is not None: + recipe.releaseTime = release_date + else: + delattr(recipe, "releaseTime") + for cpe_id in oe.cve_check.get_cpe_ids( d.getVar("CVE_PRODUCT"), d.getVar("CVE_VERSION") ): diff --git a/meta/lib/oeqa/selftest/cases/spdx.py b/meta/lib/oeqa/selftest/cases/spdx.py index 8285189382..3b6d02d38c 100644 --- a/meta/lib/oeqa/selftest/cases/spdx.py +++ b/meta/lib/oeqa/selftest/cases/spdx.py @@ -6,8 +6,11 @@ import textwrap import hashlib +import os +from datetime import datetime, timezone from oeqa.selftest.case import OESelftestTestCase from oeqa.utils.commands import bitbake, get_bb_var, get_bb_vars +import oeqa.utils.ftools as ftools import oe.spdx30 @@ -443,3 +446,142 @@ class SPDX30Check(SPDX3CheckBase, OESelftestTestCase): r'\d', f"Version '{version}' for package '{name}' should contain digits" ) + + def test_release_date_source_date_epoch(self): + """releaseTime should be derived from SOURCE_DATE_EPOCH by default.""" + objset = self.check_recipe_spdx( + "base-files", + "{DEPLOY_DIR_SPDX}/{MACHINE_ARCH}/static/static-base-files.spdx.json", + task="create_recipe_spdx", + ) + + # Query after the build so the do_unpack stamp file exists. + source_date_epoch = get_bb_var("SOURCE_DATE_EPOCH", "base-files") + expected = datetime.fromtimestamp(int(source_date_epoch), tz=timezone.utc) + + recipe = None + for pkg in objset.foreach_type(oe.spdx30.software_Package): + if pkg.name == "base-files": + recipe = pkg + break + + self.assertIsNotNone(recipe, "Unable to find base-files software_Package") + self.assertEqual(recipe.releaseTime, expected) + + def test_release_date_disabled(self): + """SPDX_INCLUDE_RELEASE_DATE = "0" should omit releaseTime entirely.""" + objset = self.check_recipe_spdx( + "base-files", + "{DEPLOY_DIR_SPDX}/{MACHINE_ARCH}/static/static-base-files.spdx.json", + task="create_recipe_spdx", + extraconf="""\ + SPDX_INCLUDE_RELEASE_DATE = "0" + """, + ) + + recipe = None + for pkg in objset.foreach_type(oe.spdx30.software_Package): + if pkg.name == "base-files": + recipe = pkg + break + + self.assertIsNotNone(recipe, "Unable to find base-files software_Package") + self.assertIsNone( + recipe.releaseTime, + "releaseTime should not be set when SPDX_INCLUDE_RELEASE_DATE is '0'", + ) + + def test_release_date_override(self): + """SPDX_COMPONENT_RELEASE_DATE overrides the resolved date.""" + override_date = "2020-01-01T00:00:00Z" + + objset = self.check_recipe_spdx( + "base-files", + "{DEPLOY_DIR_SPDX}/{MACHINE_ARCH}/static/static-base-files.spdx.json", + task="create_recipe_spdx", + extraconf=f"""\ + SPDX_COMPONENT_RELEASE_DATE = "{override_date}" + """, + ) + + recipe = None + for pkg in objset.foreach_type(oe.spdx30.software_Package): + if pkg.name == "base-files": + recipe = pkg + break + + self.assertIsNotNone(recipe, "Unable to find base-files software_Package") + self.assertEqual( + recipe.releaseTime, + datetime(2020, 1, 1, tzinfo=timezone.utc), + ) + + def _write_test_patch(self, recipe, date_header): + """Write a no-op patch against a fixture file (not part of the + recipe's real source, so it isn't coupled to its content) with the + given Date: header, and point FILESEXTRAPATHS at it.""" + inc_file = self.write_recipeinc( + recipe, + textwrap.dedent( + """\ + FILESEXTRAPATHS:prepend := "${THISDIR}/files:" + SRC_URI += "file://release-date-test-file" + SRC_URI += "file://release-date-test.patch" + """ + ), + ) + patch_dir = os.path.join(os.path.dirname(inc_file), "files") + os.makedirs(patch_dir, exist_ok=True) + ftools.write_file( + os.path.join(patch_dir, "release-date-test-file"), + "original content\n", + ) + patch_path = os.path.join(patch_dir, "release-date-test.patch") + ftools.write_file( + patch_path, + textwrap.dedent( + f"""\ + From: Test Author + Date: {date_header} + Subject: [PATCH] modify release-date-test-file + + Upstream-Status: Inappropriate [test patch, not intended for upstream] + + --- + --- a/release-date-test-file + +++ b/release-date-test-file + @@ -1 +1 @@ + -original content + +patched content + """ + ), + ) + self.track_for_cleanup(patch_dir) + return patch_path + + def test_release_date_include_patches(self): + """SPDX_RELEASE_DATE_INCLUDE_PATCHES = "1" makes a newer patch + Date: header win over SOURCE_DATE_EPOCH.""" + newer_patch_date = "Mon, 15 Jun 2099 00:00:00 +0000" + + self._write_test_patch("base-files", newer_patch_date) + self.add_command_to_tearDown("bitbake -c clean base-files") + + objset = self.check_recipe_spdx( + "base-files", + "{DEPLOY_DIR_SPDX}/{MACHINE_ARCH}/static/static-base-files.spdx.json", + task="create_recipe_spdx", + extraconf="""\ + SPDX_RELEASE_DATE_INCLUDE_PATCHES = "1" + """, + ) + recipe = None + for pkg in objset.foreach_type(oe.spdx30.software_Package): + if pkg.name == "base-files": + recipe = pkg + break + self.assertIsNotNone(recipe, "Unable to find base-files software_Package") + self.assertEqual( + recipe.releaseTime, + datetime(2099, 6, 15, tzinfo=timezone.utc), + )