Initial implementation of layoutlib SBOM generation.
1) Build/dist build.prop, resource files
2) Generate layoutlib SBOM that includes build.prop, resource files,
font files and font configuration files
3) Generate SBOM of framework_res.jar with placeholders for substitution
in release_layoutlib.sh
Bug: 303903787
Bug: 303904046
Bug: 303904808
Bug: 303905932
Bug: 303906000
Bug: 303906275
Test: lunch sdk_phone64_arm64-userdebug && m layoutlib dist
Change-Id: Ib004e199e740ccc901e93b11201db2477464be1d
diff --git a/tools/sbom/Android.bp b/tools/sbom/Android.bp
index 519251e..27a160e 100644
--- a/tools/sbom/Android.bp
+++ b/tools/sbom/Android.bp
@@ -77,3 +77,18 @@
},
test_suites: ["general-tests"],
}
+
+python_binary_host {
+ name: "generate-sbom-framework_res",
+ srcs: [
+ "generate-sbom-framework_res.py",
+ ],
+ version: {
+ py3: {
+ embedded_launcher: true,
+ },
+ },
+ libs: [
+ "sbom_lib",
+ ],
+}
\ No newline at end of file
diff --git a/tools/sbom/generate-sbom-framework_res.py b/tools/sbom/generate-sbom-framework_res.py
new file mode 100644
index 0000000..d6be734
--- /dev/null
+++ b/tools/sbom/generate-sbom-framework_res.py
@@ -0,0 +1,80 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2023 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import argparse
+import hashlib
+import json
+import sbom_data
+import sbom_writers
+
+
+def get_args():
+ parser = argparse.ArgumentParser()
+ parser.add_argument('-v', '--verbose', action='store_true', default=False,
+ help='Print more information.')
+ parser.add_argument('--output_file', required=True,
+ help='The generated SBOM file in SPDX format.')
+ parser.add_argument('--layoutlib_sbom', required=True,
+ help='The file path of the SBOM of layoutlib.')
+
+ return parser.parse_args()
+
+
+def main():
+ global args
+ args = get_args()
+
+ doc = sbom_data.Document(name='<name>',
+ namespace='<namespace>',
+ creators=['Organization: <organization>'],
+ created='<created>')
+
+ filename = 'data/framework_res.jar'
+ file_id = f'SPDXRef-{sbom_data.encode_for_spdxid(filename)}'
+ file = sbom_data.File(id=file_id, name=filename, checksum='SHA1: <checksum>')
+ doc.files.append(file)
+ doc.describes = file_id
+
+ with open(args.layoutlib_sbom, 'r', encoding='utf-8') as f:
+ layoutlib_sbom = json.load(f)
+
+ with open(args.layoutlib_sbom, 'rb') as f:
+ sha1 = hashlib.file_digest(f, 'sha1')
+
+ layoutlib_sbom_namespace = layoutlib_sbom[sbom_writers.PropNames.DOCUMENT_NAMESPACE]
+ external_doc_ref = 'DocumentRef-layoutlib'
+ doc.external_refs = [
+ sbom_data.DocumentExternalReference(external_doc_ref, layoutlib_sbom_namespace,
+ f'SHA1: {sha1.hexdigest()}')]
+
+ resource_file_spdxids = []
+ for file in layoutlib_sbom[sbom_writers.PropNames.FILES]:
+ if file[sbom_writers.PropNames.FILE_NAME].startswith('data/res/'):
+ resource_file_spdxids.append(file[sbom_writers.PropNames.SPDXID])
+
+ doc.relationships = []
+ for spdxid in resource_file_spdxids:
+ doc.relationships.append(
+ sbom_data.Relationship(file_id, sbom_data.RelationshipType.GENERATED_FROM,
+ f'{external_doc_ref}:{spdxid}'))
+
+ # write sbom file
+ with open(args.output_file, 'w', encoding='utf-8') as f:
+ sbom_writers.JSONWriter.write(doc, f)
+
+
+if __name__ == '__main__':
+ main()
diff --git a/tools/sbom/generate-sbom.py b/tools/sbom/generate-sbom.py
index b19be87..4d090eb 100755
--- a/tools/sbom/generate-sbom.py
+++ b/tools/sbom/generate-sbom.py
@@ -103,26 +103,12 @@
print(i)
-def encode_for_spdxid(s):
- """Simple encode for string values used in SPDXID which uses the charset of A-Za-Z0-9.-"""
- result = ''
- for c in s:
- if c.isalnum() or c in '.-':
- result += c
- elif c in '_@/':
- result += '-'
- else:
- result += '0x' + c.encode('utf-8').hex()
-
- return result.lstrip('-')
-
-
def new_package_id(package_name, type):
- return f'SPDXRef-{type}-{encode_for_spdxid(package_name)}'
+ return f'SPDXRef-{type}-{sbom_data.encode_for_spdxid(package_name)}'
def new_file_id(file_path):
- return f'SPDXRef-{encode_for_spdxid(file_path)}'
+ return f'SPDXRef-{sbom_data.encode_for_spdxid(file_path)}'
def checksum(file_path):
diff --git a/tools/sbom/sbom_data.py b/tools/sbom/sbom_data.py
index 71f8660..b5ac8a5 100644
--- a/tools/sbom/sbom_data.py
+++ b/tools/sbom/sbom_data.py
@@ -138,3 +138,16 @@
h = hashlib.sha1()
h.update(''.join(checksums).encode(encoding='utf-8'))
package.verification_code = h.hexdigest()
+
+def encode_for_spdxid(s):
+ """Simple encode for string values used in SPDXID which uses the charset of A-Za-Z0-9.-"""
+ result = ''
+ for c in s:
+ if c.isalnum() or c in '.-':
+ result += c
+ elif c in '_@/':
+ result += '-'
+ else:
+ result += '0x' + c.encode('utf-8').hex()
+
+ return result.lstrip('-')
\ No newline at end of file