Gitiles
Code Review Sign In
gerrit.omnirom.org / android_build / f469fd6cc60b537e3600645d79d94aeafe8e7a44 / . / tools / sbom / sbom_writers_test.py
blob: 361dae6f5d4a605caae379412ed8a8ab26e431b5 [file] [log] [blame]
Wei Lidec97b12023-04-07 16:45:17 -0700[diff] [blame]1#!/usr/bin/env python3
2#
3# Copyright (C) 2023 The Android Open Source Project
4#
5# Licensed under the Apache License, Version 2.0 (the "License");
6# you may not use this file except in compliance with the License.
7# You may obtain a copy of the License at
8#
9# http://www.apache.org/licenses/LICENSE-2.0
10#
11# Unless required by applicable law or agreed to in writing, software
12# distributed under the License is distributed on an "AS IS" BASIS,
13# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14# See the License for the specific language governing permissions and
15# limitations under the License.
16
17import io
18import pathlib
19import unittest
20import sbom_data
21import sbom_writers
22
23BUILD_FINGER_PRINT = 'build_finger_print'
24SUPPLIER_GOOGLE = 'Organization: Google'
25SUPPLIER_UPSTREAM = 'Organization: upstream'
26
27SPDXID_PREBUILT_PACKAGE1 = 'SPDXRef-PREBUILT-package1'
28SPDXID_SOURCE_PACKAGE1 = 'SPDXRef-SOURCE-package1'
29SPDXID_UPSTREAM_PACKAGE1 = 'SPDXRef-UPSTREAM-package1'
30
31SPDXID_FILE1 = 'SPDXRef-file1'
32SPDXID_FILE2 = 'SPDXRef-file2'
33SPDXID_FILE3 = 'SPDXRef-file3'
34
35
36class SBOMWritersTest(unittest.TestCase):
37
38 def setUp(self):
39 # SBOM of a product
40 self.sbom_doc = sbom_data.Document(name='test doc',
41 namespace='http://www.google.com/sbom/spdx/android',
42 creators=[SUPPLIER_GOOGLE],
43 created='2023-03-31T22:17:58Z',
44 describes=sbom_data.SPDXID_PRODUCT)
45 self.sbom_doc.add_external_ref(
46 sbom_data.DocumentExternalReference(id='DocumentRef-external_doc_ref',
47 uri='external_doc_uri',
48 checksum='SHA1: 1234567890'))
49 self.sbom_doc.add_package(
50 sbom_data.Package(id=sbom_data.SPDXID_PRODUCT,
51 name=sbom_data.PACKAGE_NAME_PRODUCT,
Wei Li52908252023-04-14 18:49:42 -0700[diff] [blame]52 download_location=sbom_data.VALUE_NONE,
Wei Lidec97b12023-04-07 16:45:17 -0700[diff] [blame]53 supplier=SUPPLIER_GOOGLE,
54 version=BUILD_FINGER_PRINT,
55 files_analyzed=True,
56 verification_code='123456',
57 file_ids=[SPDXID_FILE1, SPDXID_FILE2, SPDXID_FILE3]))
58
59 self.sbom_doc.add_package(
60 sbom_data.Package(id=sbom_data.SPDXID_PLATFORM,
61 name=sbom_data.PACKAGE_NAME_PLATFORM,
Wei Li52908252023-04-14 18:49:42 -0700[diff] [blame]62 download_location=sbom_data.VALUE_NONE,
Wei Lidec97b12023-04-07 16:45:17 -0700[diff] [blame]63 supplier=SUPPLIER_GOOGLE,
64 version=BUILD_FINGER_PRINT,
65 ))
66
67 self.sbom_doc.add_package(
68 sbom_data.Package(id=SPDXID_PREBUILT_PACKAGE1,
69 name='Prebuilt package1',
Wei Li52908252023-04-14 18:49:42 -0700[diff] [blame]70 download_location=sbom_data.VALUE_NONE,
Wei Lidec97b12023-04-07 16:45:17 -0700[diff] [blame]71 supplier=SUPPLIER_GOOGLE,
72 version=BUILD_FINGER_PRINT,
73 ))
74
75 self.sbom_doc.add_package(
76 sbom_data.Package(id=SPDXID_SOURCE_PACKAGE1,
77 name='Source package1',
Wei Li52908252023-04-14 18:49:42 -0700[diff] [blame]78 download_location=sbom_data.VALUE_NONE,
Wei Lidec97b12023-04-07 16:45:17 -0700[diff] [blame]79 supplier=SUPPLIER_GOOGLE,
80 version=BUILD_FINGER_PRINT,
81 external_refs=[sbom_data.PackageExternalRef(
82 category=sbom_data.PackageExternalRefCategory.SECURITY,
83 type=sbom_data.PackageExternalRefType.cpe22Type,
84 locator='cpe:/a:jsoncpp_project:jsoncpp:1.9.4')]
85 ))
86
87 self.sbom_doc.add_package(
88 sbom_data.Package(id=SPDXID_UPSTREAM_PACKAGE1,
89 name='Upstream package1',
90 supplier=SUPPLIER_UPSTREAM,
91 version='1.1',
92 ))
93
94 self.sbom_doc.add_relationship(sbom_data.Relationship(id1=SPDXID_SOURCE_PACKAGE1,
95 relationship=sbom_data.RelationshipType.VARIANT_OF,
96 id2=SPDXID_UPSTREAM_PACKAGE1))
97
98 self.sbom_doc.files.append(
99 sbom_data.File(id=SPDXID_FILE1, name='/bin/file1', checksum='SHA1: 11111'))
100 self.sbom_doc.files.append(
101 sbom_data.File(id=SPDXID_FILE2, name='/bin/file2', checksum='SHA1: 22222'))
102 self.sbom_doc.files.append(
103 sbom_data.File(id=SPDXID_FILE3, name='/bin/file3', checksum='SHA1: 33333'))
104
105 self.sbom_doc.add_relationship(sbom_data.Relationship(id1=SPDXID_FILE1,
106 relationship=sbom_data.RelationshipType.GENERATED_FROM,
107 id2=sbom_data.SPDXID_PLATFORM))
108 self.sbom_doc.add_relationship(sbom_data.Relationship(id1=SPDXID_FILE2,
109 relationship=sbom_data.RelationshipType.GENERATED_FROM,
110 id2=SPDXID_PREBUILT_PACKAGE1))
111 self.sbom_doc.add_relationship(sbom_data.Relationship(id1=SPDXID_FILE3,
112 relationship=sbom_data.RelationshipType.GENERATED_FROM,
113 id2=SPDXID_SOURCE_PACKAGE1
114 ))
115
116 # SBOM fragment of a APK
117 self.unbundled_sbom_doc = sbom_data.Document(name='test doc',
118 namespace='http://www.google.com/sbom/spdx/android',
119 creators=[SUPPLIER_GOOGLE],
120 created='2023-03-31T22:17:58Z',
121 describes=SPDXID_FILE1)
122
123 self.unbundled_sbom_doc.files.append(
124 sbom_data.File(id=SPDXID_FILE1, name='/bin/file1.apk', checksum='SHA1: 11111'))
125 self.unbundled_sbom_doc.add_package(
126 sbom_data.Package(id=SPDXID_SOURCE_PACKAGE1,
127 name='Unbundled apk package',
Wei Li52908252023-04-14 18:49:42 -0700[diff] [blame]128 download_location=sbom_data.VALUE_NONE,
Wei Lidec97b12023-04-07 16:45:17 -0700[diff] [blame]129 supplier=SUPPLIER_GOOGLE,
130 version=BUILD_FINGER_PRINT))
131 self.unbundled_sbom_doc.add_relationship(sbom_data.Relationship(id1=SPDXID_FILE1,
132 relationship=sbom_data.RelationshipType.GENERATED_FROM,
133 id2=SPDXID_SOURCE_PACKAGE1))
134
135 def test_tagvalue_writer(self):
136 with io.StringIO() as output:
137 sbom_writers.TagValueWriter.write(self.sbom_doc, output)
138 expected_output = pathlib.Path('testdata/expected_tagvalue_sbom.spdx').read_text()
139 self.maxDiff = None
140 self.assertEqual(expected_output, output.getvalue())
141
142 def test_tagvalue_writer_unbundled(self):
143 with io.StringIO() as output:
144 sbom_writers.TagValueWriter.write(self.unbundled_sbom_doc, output, fragment=True)
145 expected_output = pathlib.Path('testdata/expected_tagvalue_sbom_unbundled.spdx').read_text()
146 self.maxDiff = None
147 self.assertEqual(expected_output, output.getvalue())
148
149 def test_json_writer(self):
150 with io.StringIO() as output:
151 sbom_writers.JSONWriter.write(self.sbom_doc, output)
152 expected_output = pathlib.Path('testdata/expected_json_sbom.spdx.json').read_text()
153 self.maxDiff = None
154 self.assertEqual(expected_output, output.getvalue())
155
156
157if __name__ == '__main__':
158 unittest.main(verbosity=2)