Gitiles
Code Review Sign In
gerrit.omnirom.org / android_build / f99db9977c8e86d4d1f541c95094d4c75e6d8e0a / . / tools / sbom / sbom_data_test.py
blob: 69bc9d2d29cc5762dd2c104fd009ce88ed18de1b [file] [log] [blame]
Wei Lif99db992023-07-31 14:12:52 -0700[diff] [blame^]1#!/usr/bin/env python3
2#
3# Copyright (C) 2023 The Android Open Source Project
4#
5# Licensed under the Apache License, Version 2.0 (the "License");
6# you may not use this file except in compliance with the License.
7# You may obtain a copy of the License at
8#
9# http://www.apache.org/licenses/LICENSE-2.0
10#
11# Unless required by applicable law or agreed to in writing, software
12# distributed under the License is distributed on an "AS IS" BASIS,
13# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14# See the License for the specific language governing permissions and
15# limitations under the License.
16
17import hashlib
18import unittest
19import sbom_data
20
21BUILD_FINGER_PRINT = 'build_finger_print'
22SUPPLIER_GOOGLE = 'Organization: Google'
23SUPPLIER_UPSTREAM = 'Organization: upstream'
24
25SPDXID_PREBUILT_PACKAGE1 = 'SPDXRef-PREBUILT-package1'
26SPDXID_SOURCE_PACKAGE1 = 'SPDXRef-SOURCE-package1'
27SPDXID_UPSTREAM_PACKAGE1 = 'SPDXRef-UPSTREAM-package1'
28
29SPDXID_FILE1 = 'SPDXRef-file1'
30SPDXID_FILE2 = 'SPDXRef-file2'
31SPDXID_FILE3 = 'SPDXRef-file3'
32SPDXID_FILE4 = 'SPDXRef-file4'
33
34
35class SBOMDataTest(unittest.TestCase):
36
37 def setUp(self):
38 # SBOM of a product
39 self.sbom_doc = sbom_data.Document(name='test doc',
40 namespace='http://www.google.com/sbom/spdx/android',
41 creators=[SUPPLIER_GOOGLE],
42 created='2023-03-31T22:17:58Z',
43 describes=sbom_data.SPDXID_PRODUCT)
44 self.sbom_doc.add_external_ref(
45 sbom_data.DocumentExternalReference(id='DocumentRef-external_doc_ref',
46 uri='external_doc_uri',
47 checksum='SHA1: 1234567890'))
48 self.sbom_doc.add_package(
49 sbom_data.Package(id=sbom_data.SPDXID_PRODUCT,
50 name=sbom_data.PACKAGE_NAME_PRODUCT,
51 download_location=sbom_data.VALUE_NONE,
52 supplier=SUPPLIER_GOOGLE,
53 version=BUILD_FINGER_PRINT,
54 files_analyzed=True,
55 verification_code='',
56 file_ids=[SPDXID_FILE1, SPDXID_FILE2, SPDXID_FILE3, SPDXID_FILE4]))
57
58 self.sbom_doc.add_package(
59 sbom_data.Package(id=sbom_data.SPDXID_PLATFORM,
60 name=sbom_data.PACKAGE_NAME_PLATFORM,
61 download_location=sbom_data.VALUE_NONE,
62 supplier=SUPPLIER_GOOGLE,
63 version=BUILD_FINGER_PRINT,
64 ))
65
66 self.sbom_doc.add_package(
67 sbom_data.Package(id=SPDXID_PREBUILT_PACKAGE1,
68 name='Prebuilt package1',
69 download_location=sbom_data.VALUE_NONE,
70 supplier=SUPPLIER_GOOGLE,
71 version=BUILD_FINGER_PRINT,
72 ))
73
74 self.sbom_doc.add_package(
75 sbom_data.Package(id=SPDXID_SOURCE_PACKAGE1,
76 name='Source package1',
77 download_location=sbom_data.VALUE_NONE,
78 supplier=SUPPLIER_GOOGLE,
79 version=BUILD_FINGER_PRINT,
80 external_refs=[sbom_data.PackageExternalRef(
81 category=sbom_data.PackageExternalRefCategory.SECURITY,
82 type=sbom_data.PackageExternalRefType.cpe22Type,
83 locator='cpe:/a:jsoncpp_project:jsoncpp:1.9.4')]
84 ))
85
86 self.sbom_doc.add_package(
87 sbom_data.Package(id=SPDXID_UPSTREAM_PACKAGE1,
88 name='Upstream package1',
89 supplier=SUPPLIER_UPSTREAM,
90 version='1.1',
91 ))
92
93 self.sbom_doc.add_relationship(sbom_data.Relationship(id1=SPDXID_SOURCE_PACKAGE1,
94 relationship=sbom_data.RelationshipType.VARIANT_OF,
95 id2=SPDXID_UPSTREAM_PACKAGE1))
96
97 self.sbom_doc.files.append(
98 sbom_data.File(id=SPDXID_FILE1, name='/bin/file1',
99 checksum='SHA1: 356a192b7913b04c54574d18c28d46e6395428ab')) # sha1 hash of 1
100 self.sbom_doc.files.append(
101 sbom_data.File(id=SPDXID_FILE2, name='/bin/file2',
102 checksum='SHA1: da4b9237bacccdf19c0760cab7aec4a8359010b0')) # sha1 hash of 2
103 self.sbom_doc.files.append(
104 sbom_data.File(id=SPDXID_FILE3, name='/bin/file3',
105 checksum='SHA1: 77de68daecd823babbb58edb1c8e14d7106e83bb')) # sha1 hash of 3
106 self.sbom_doc.files.append(
107 sbom_data.File(id=SPDXID_FILE4, name='file4.a',
108 checksum='SHA1: 1b6453892473a467d07372d45eb05abc2031647a')) # sha1 of 4
109
110 self.sbom_doc.add_relationship(sbom_data.Relationship(id1=SPDXID_FILE1,
111 relationship=sbom_data.RelationshipType.GENERATED_FROM,
112 id2=sbom_data.SPDXID_PLATFORM))
113 self.sbom_doc.add_relationship(sbom_data.Relationship(id1=SPDXID_FILE2,
114 relationship=sbom_data.RelationshipType.GENERATED_FROM,
115 id2=SPDXID_PREBUILT_PACKAGE1))
116 self.sbom_doc.add_relationship(sbom_data.Relationship(id1=SPDXID_FILE3,
117 relationship=sbom_data.RelationshipType.GENERATED_FROM,
118 id2=SPDXID_SOURCE_PACKAGE1
119 ))
120 self.sbom_doc.add_relationship(sbom_data.Relationship(id1=SPDXID_FILE1,
121 relationship=sbom_data.RelationshipType.STATIC_LINK,
122 id2=SPDXID_FILE4
123 ))
124
125 def test_package_verification_code(self):
126 checksums = []
127 for file in self.sbom_doc.files:
128 checksums.append(file.checksum.split(': ')[1])
129 checksums.sort()
130 h = hashlib.sha1()
131 h.update(''.join(checksums).encode(encoding='utf-8'))
132 expected_package_verification_code = h.hexdigest()
133
134 self.sbom_doc.generate_packages_verification_code()
135 self.assertEqual(expected_package_verification_code, self.sbom_doc.packages[0].verification_code)
136
137
138if __name__ == '__main__':
139 unittest.main(verbosity=2)