commit 5290825452f61013ea692d1113649c0de08e3e3c
author Wei Li <weiwli@google.com> Fri Apr 14 18:49:42 2023 -0700
committer Wei Li <weiwli@google.com> Sat Apr 15 06:05:32 2023 +0000
tree a80acf664d9bea2b9ecb0bee4866af9d701c303b
parent ebf41e9a917d2b77837446fddb1bb27e1fd6cbab

Fix the following issues mentioned in Pixel SBOM review.

1) PackageSupplier should be NOASSERTION if there is no homepage
   information in METADATA file of source packages
2) PackageDownloadLocation of upstream packages should be NOASSERTION if
   there is no code repository URL in METADATA file of source packages

Test: CIs
Test: atest --host sbom_writers_test
Change-Id: I8a0298b7bacc2f96555f9d7dde0d21ada8c6b564

tools/sbom/generate-sbom.py

diff --git a/tools/sbom/generate-sbom.py b/tools/sbom/generate-sbom.py
index 0c5deb2..192061e 100755
--- a/tools/sbom/generate-sbom.py
+++ b/tools/sbom/generate-sbom.py
@@ -279,12 +279,13 @@
     name, external_refs = get_source_package_info(installed_file_metadata, metadata_file_path)
     source_package_id = new_package_id(name, PKG_SOURCE)
     source_package = sbom_data.Package(id=source_package_id, name=name, version=args.build_version,
+                                       download_location=sbom_data.VALUE_NONE,
                                        supplier='Organization: ' + args.product_mfr,
                                        external_refs=external_refs)
 
     upstream_package_id = new_package_id(name, PKG_UPSTREAM)
     upstream_package = sbom_data.Package(id=upstream_package_id, name=name, version=version,
-                                         supplier='Organization: ' + homepage if homepage else None,
+                                         supplier=('Organization: ' + homepage) if homepage else sbom_data.VALUE_NOASSERTION,
                                          download_location=download_location)
     packages += [source_package, upstream_package]
     relationships.append(sbom_data.Relationship(id1=source_package_id,
@@ -296,6 +297,7 @@
     prebuilt_package_id = new_package_id(name, PKG_PREBUILT)
     prebuilt_package = sbom_data.Package(id=prebuilt_package_id,
                                          name=name,
+                                         download_location=sbom_data.VALUE_NONE,
                                          version=args.build_version,
                                          supplier='Organization: ' + args.product_mfr)
     packages.append(prebuilt_package)
@@ -438,6 +440,7 @@
 
   product_package = sbom_data.Package(id=sbom_data.SPDXID_PRODUCT,
                                       name=sbom_data.PACKAGE_NAME_PRODUCT,
+                                      download_location=sbom_data.VALUE_NONE,
                                       version=args.build_version,
                                       supplier='Organization: ' + args.product_mfr,
                                       files_analyzed=True)
@@ -445,6 +448,7 @@
 
   doc.packages.append(sbom_data.Package(id=sbom_data.SPDXID_PLATFORM,
                                         name=sbom_data.PACKAGE_NAME_PLATFORM,
+                                        download_location=sbom_data.VALUE_NONE,
                                         version=args.build_version,
                                         supplier='Organization: ' + args.product_mfr))