scripts/sbom/sbom.py

#!/usr/bin/env python3
# SPDX-License-Identifier: GPL-2.0-only OR MIT
# Copyright (C) 2025 TNG Technology Consulting GmbH

"""
Compute software bill of materials in SPDX format describing a kernel build.
"""

import json
import logging
import os
import sys
import time
import uuid
import sbom.sbom_logging as sbom_logging
from sbom.config import get_config
from sbom.path_utils import is_relative_to
from sbom.spdx import JsonLdSpdxDocument, SpdxIdGenerator
from sbom.spdx.core import CreationInfo, SpdxDocument
from sbom.spdx_graph import SpdxIdGeneratorCollection, build_spdx_graphs
from sbom.cmd_graph import CmdGraph


def _exit_with_summary(write_output_on_error: bool = False) -> None:
    warning_summary = sbom_logging.summarize_warnings()
    error_summary = sbom_logging.summarize_errors()
    if warning_summary:
        logging.warning(warning_summary)
    if error_summary:
        logging.error(error_summary)
        if not write_output_on_error:
            logging.info(
                "Use --write-output-on-error to generate output documents even when errors occur. "
                "Note that in this case the generated documents may be incomplete."
            )
        sys.exit(1)


def main():
    # Read config
    config = get_config()

    # Configure logging
    logging.basicConfig(
        level=logging.DEBUG if config.debug else logging.INFO,
        format="[%(levelname)s] %(message)s",
    )

    # Build cmd graph
    logging.debug("Start building cmd graph")
    start_time = time.time()
    cmd_graph = CmdGraph.create(config.root_paths, config)
    logging.debug(f"Built cmd graph in {time.time() - start_time} seconds")

    # Save used files document
    if config.generate_used_files:
        if config.src_tree == config.obj_tree:
            logging.info(
                f"Extracting all files from the cmd graph to {config.used_files_file_name} "
                "instead of only source files because source files cannot be "
                "reliably classified when the source and object trees are identical.",
            )
            used_files = [os.path.relpath(node.absolute_path, config.src_tree) for node in cmd_graph]
            logging.debug(f"Found {len(used_files)} files in cmd graph.")
        else:
            used_files = [
                os.path.relpath(node.absolute_path, config.src_tree)
                for node in cmd_graph
                if is_relative_to(node.absolute_path, config.src_tree)
                and not is_relative_to(node.absolute_path, config.obj_tree)
            ]
            logging.debug(f"Found {len(used_files)} source files in cmd graph")
        if not sbom_logging.has_errors() or config.write_output_on_error:
            used_files_path = os.path.join(config.output_directory, config.used_files_file_name)
            with open(used_files_path, "w", encoding="utf-8") as f:
                f.write("\n".join(str(file_path) for file_path in used_files))
            logging.debug(f"Successfully saved {used_files_path}")

    if config.generate_spdx is False:
        _exit_with_summary(config.write_output_on_error)
        return

    # Build SPDX Documents
    logging.debug("Start generating SPDX graph based on cmd graph")
    start_time = time.time()

    # The real uuid will be generated based on the content of the SPDX graphs
    # to ensure that the same SPDX document is always assigned the same uuid.
    PLACEHOLDER_UUID = "00000000-0000-0000-0000-000000000000"
    spdx_id_base_namespace = f"{config.spdxId_prefix}{PLACEHOLDER_UUID}/"
    spdx_id_generators = SpdxIdGeneratorCollection(
        base=SpdxIdGenerator(prefix="p", namespace=spdx_id_base_namespace),
        source=SpdxIdGenerator(prefix="s", namespace=f"{spdx_id_base_namespace}source/"),
        build=SpdxIdGenerator(prefix="b", namespace=f"{spdx_id_base_namespace}build/"),
        output=SpdxIdGenerator(prefix="o", namespace=f"{spdx_id_base_namespace}output/"),
    )

    spdx_graphs = build_spdx_graphs(
        cmd_graph,
        spdx_id_generators,
        config,
    )
    spdx_id_uuid = uuid.uuid5(
        uuid.NAMESPACE_URL,
        "".join(
            json.dumps(element.to_dict()) for spdx_graph in spdx_graphs.values() for element in spdx_graph.to_list()
        ),
    )
    logging.debug(f"Generated SPDX graph in {time.time() - start_time} seconds")

    if not sbom_logging.has_errors() or config.write_output_on_error:
        for kernel_sbom_kind, spdx_graph in spdx_graphs.items():
            spdx_graph_objects = spdx_graph.to_list()
            # Add warning and error summary to creation info comment
            creation_info = next(element for element in spdx_graph_objects if isinstance(element, CreationInfo))
            creation_info.comment = "\n".join([
                sbom_logging.summarize_warnings(),
                sbom_logging.summarize_errors(),
            ]).strip()
            # Replace Placeholder uuid with real uuid for spdxIds
            spdx_document = next(element for element in spdx_graph_objects if isinstance(element, SpdxDocument))
            for namespaceMap in spdx_document.namespaceMap:
                namespaceMap.namespace = namespaceMap.namespace.replace(PLACEHOLDER_UUID, str(spdx_id_uuid))
            # Serialize SPDX graph to JSON-LD
            spdx_doc = JsonLdSpdxDocument(graph=spdx_graph_objects)
            save_path = os.path.join(config.output_directory, config.spdx_file_names[kernel_sbom_kind])
            spdx_doc.save(save_path, config.prettify_json)
            logging.debug(f"Successfully saved {save_path}")

    _exit_with_summary(config.write_output_on_error)


# Call main method
if __name__ == "__main__":
    main()