blob: c41f28dcbcaa8d15b1200e01aff507bc3cd23aad [file] [log] [blame]
Wei Li73032c82023-03-15 18:31:38 +00001#!/bin/bash
2
3# Copyright (C) 2023 The Android Open Source Project
4#
5# Licensed under the Apache License, Version 2.0 (the "License");
6# you may not use this file except in compliance with the License.
7# You may obtain a copy of the License at
8#
9# http://www.apache.org/licenses/LICENSE-2.0
10#
11# Unless required by applicable law or agreed to in writing, software
12# distributed under the License is distributed on an "AS IS" BASIS,
13# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14# See the License for the specific language governing permissions and
15# limitations under the License.
16
17set -uo pipefail
18
19# Integration test for verifying generated SBOM for cuttlefish device.
20
21if [ ! -e "build/make/core/Makefile" ]; then
22 echo "$0 must be run from the top of the Android source tree."
23 exit 1
24fi
25
Wei Licd9948f2023-06-22 17:52:31 -070026function setup {
27 tmp_dir="$(mktemp -d tmp.XXXXXX)"
28 trap 'cleanup "${tmp_dir}"' EXIT
29 echo "${tmp_dir}"
30}
31
Wei Li73032c82023-03-15 18:31:38 +000032function cleanup {
Wei Licd9948f2023-06-22 17:52:31 -070033 tmp_dir="$1"; shift
Wei Li73032c82023-03-15 18:31:38 +000034 rm -rf "${tmp_dir}"
35}
Wei Li8a8d5a92023-03-29 13:41:34 -070036
37function run_soong {
Wei Licd9948f2023-06-22 17:52:31 -070038 target_product="$1";shift
39 out_dir="$1"; shift
40 targets="$1"; shift
41 if [ "$#" -ge 1 ]; then
42 apps=$1; shift
43 TARGET_PRODUCT="${target_product}" TARGET_BUILD_VARIANT=userdebug OUT_DIR="${out_dir}" TARGET_BUILD_UNBUNDLED=true TARGET_BUILD_APPS=$apps build/soong/soong_ui.bash --make-mode ${targets}
44 else
45 TARGET_PRODUCT="${target_product}" TARGET_BUILD_VARIANT=userdebug OUT_DIR="${out_dir}" build/soong/soong_ui.bash --make-mode ${targets}
46 fi
Wei Li8a8d5a92023-03-29 13:41:34 -070047}
48
Wei Li7c1e7f02023-03-29 17:43:35 -070049function diff_files {
Wei Licd9948f2023-06-22 17:52:31 -070050 file_list_file="$1"; shift
51 files_in_spdx_file="$1"; shift
52 partition_name="$1"; shift
53 exclude=
54 if [ -v 'diff_excludes[$partition_name]' ]; then
55 exclude=${diff_excludes[$partition_name]}
Wei Li8a8d5a92023-03-29 13:41:34 -070056 fi
Wei Li8a8d5a92023-03-29 13:41:34 -070057
Wei Licd9948f2023-06-22 17:52:31 -070058 diff "$file_list_file" "$files_in_spdx_file" $exclude
59 if [ $? != "0" ]; then
60 echo Found diffs in $f and SBOM.
61 exit 1
62 else
63 echo No diffs.
64 fi
65}
Wei Li8a8d5a92023-03-29 13:41:34 -070066
Wei Licd9948f2023-06-22 17:52:31 -070067function test_sbom_aosp_cf_x86_64_phone {
68 # Setup
69 out_dir="$(setup)"
Wei Li8a8d5a92023-03-29 13:41:34 -070070
Wei Licd9948f2023-06-22 17:52:31 -070071 # Test
72 # m droid, build sbom later in case additional dependencies might be built and included in partition images.
73 run_soong "aosp_cf_x86_64_phone" "${out_dir}" "droid dump.erofs lz4"
Wei Li8a8d5a92023-03-29 13:41:34 -070074
Wei Licd9948f2023-06-22 17:52:31 -070075 product_out=$out_dir/target/product/vsoc_x86_64
76 sbom_test=$product_out/sbom_test
77 mkdir -p $sbom_test
78 cp $product_out/*.img $sbom_test
79
80 # m sbom
81 run_soong "aosp_cf_x86_64_phone" "${out_dir}" sbom
82
83 # Generate installed file list from .img files in PRODUCT_OUT
84 dump_erofs=$out_dir/host/linux-x86/bin/dump.erofs
85 lz4=$out_dir/host/linux-x86/bin/lz4
86
87 declare -A diff_excludes
Wei Li08246b92023-07-17 11:24:54 -070088 diff_excludes[vendor]="\
Wei Lidbedb0c2023-08-08 17:31:08 -070089 -I /vendor/lib64/libkeystore2_crypto.so"
Wei Licd9948f2023-06-22 17:52:31 -070090 diff_excludes[system]="\
Wei Li06343972023-08-10 18:13:41 -070091 -I /system/bin/assemble_cvd
92 -I /system/bin/console_forwarder
93 -I /system/bin/kernel_log_monitor
94 -I /system/bin/logcat_receiver
95 -I /system/bin/mkenvimage_slim
96 -I /system/bin/run_cvd
97 -I /system/bin/simg2img
98 -I /system/bin/log_tee
Wei Licd9948f2023-06-22 17:52:31 -070099 -I /system/lib64/android.hardware.confirmationui@1.0.so \
100 -I /system/lib64/android.hardware.confirmationui-V1-ndk.so \
101 -I /system/lib64/android.hardware.keymaster@4.1.so \
102 -I /system/lib64/android.hardware.security.rkp-V3-ndk.so \
103 -I /system/lib64/android.hardware.security.sharedsecret-V1-ndk.so \
104 -I /system/lib64/android.security.compat-ndk.so \
Wei Li9a8df662023-07-13 10:29:55 -0700105 -I /system/lib64/libcuttlefish_allocd_utils.so \
106 -I /system/lib64/libcuttlefish_device_config_proto.so \
107 -I /system/lib64/libcuttlefish_device_config.so \
108 -I /system/lib64/libcuttlefish_fs.so \
109 -I /system/lib64/libcuttlefish_kernel_log_monitor_utils.so \
110 -I /system/lib64/libcuttlefish_utils.so \
111 -I /system/lib64/libfruit.so \
112 -I /system/lib64/libgflags.so \
Wei Licd9948f2023-06-22 17:52:31 -0700113 -I /system/lib64/libkeymaster4_1support.so \
114 -I /system/lib64/libkeymaster4support.so \
115 -I /system/lib64/libkeymint.so \
116 -I /system/lib64/libkeystore2_aaid.so \
117 -I /system/lib64/libkeystore2_apc_compat.so \
118 -I /system/lib64/libkeystore2_crypto.so \
119 -I /system/lib64/libkeystore-attestation-application-id.so \
120 -I /system/lib64/libkm_compat_service.so \
121 -I /system/lib64/libkm_compat.so \
122 -I /system/lib64/vndk-29 \
123 -I /system/lib64/vndk-sp-29 \
124 -I /system/lib/vndk-29 \
125 -I /system/lib/vndk-sp-29 \
Wei Li06343972023-08-10 18:13:41 -0700126 -I /system/usr/icu"
Wei Licd9948f2023-06-22 17:52:31 -0700127
128 # Example output of dump.erofs is as below, and the data used in the test start
129 # at line 11. Column 1 is inode id, column 2 is inode type and column 3 is name.
130 # Each line is captured in variable "entry", awk is used to get type and name.
131 # Output of dump.erofs:
132 # File : /
133 # Size: 160 On-disk size: 160 directory
134 # NID: 39 Links: 10 Layout: 2 Compression ratio: 100.00%
135 # Inode size: 64 Extent size: 0 Xattr size: 16
136 # Uid: 0 Gid: 0 Access: 0755/rwxr-xr-x
137 # Timestamp: 2023-02-14 01:15:54.000000000
138 #
139 # NID TYPE FILENAME
140 # 39 2 .
141 # 39 2 ..
142 # 47 2 app
143 # 1286748 2 bin
144 # 1286754 2 etc
145 # 5304814 2 lib
146 # 5309056 2 lib64
147 # 5309130 2 media
148 # 5388910 2 overlay
149 # 5479537 2 priv-app
150 EROFS_IMAGES="\
151 $sbom_test/product.img \
152 $sbom_test/system.img \
153 $sbom_test/system_ext.img \
154 $sbom_test/system_dlkm.img \
155 $sbom_test/system_other.img \
156 $sbom_test/odm.img \
157 $sbom_test/odm_dlkm.img \
158 $sbom_test/vendor.img \
159 $sbom_test/vendor_dlkm.img"
160 for f in $EROFS_IMAGES; do
161 partition_name=$(basename $f | cut -d. -f1)
162 file_list_file="${sbom_test}/sbom-${partition_name}-files.txt"
163 files_in_spdx_file="${sbom_test}/sbom-${partition_name}-files-in-spdx.txt"
164 rm "$file_list_file" > /dev/null 2>&1 || true
165 all_dirs="/"
166 while [ ! -z "$all_dirs" ]; do
167 dir=$(echo "$all_dirs" | cut -d ' ' -f1)
168 all_dirs=$(echo "$all_dirs" | cut -d ' ' -f1 --complement -s)
169 entries=$($dump_erofs --ls --path "$dir" $f | tail -n +11)
170 while read -r entry; do
171 inode_type=$(echo $entry | awk -F ' ' '{print $2}')
172 name=$(echo $entry | awk -F ' ' '{print $3}')
173 case $inode_type in
174 "2") # directory
175 all_dirs=$(echo "$all_dirs $dir/$name" | sed 's/^\s*//')
176 ;;
177 "1"|"7") # 1: file, 7: symlink
178 (
179 if [ "$partition_name" != "system" ]; then
180 # system partition is mounted to /, not to prepend partition name.
181 printf %s "/$partition_name"
182 fi
183 echo "$dir/$name" | sed 's#^//#/#'
184 ) >> "$file_list_file"
185 ;;
186 esac
187 done <<< "$entries"
188 done
189 sort -n -o "$file_list_file" "$file_list_file"
190
191 grep "FileName: /${partition_name}/" $product_out/sbom.spdx | sed 's/^FileName: //' > "$files_in_spdx_file"
192 if [ "$partition_name" = "system" ]; then
193 # system partition is mounted to /, so include FileName starts with /root/ too.
194 grep "FileName: /root/" $product_out/sbom.spdx | sed 's/^FileName: \/root//' >> "$files_in_spdx_file"
195 fi
196 sort -n -o "$files_in_spdx_file" "$files_in_spdx_file"
197
198 echo ============ Diffing files in $f and SBOM
199 diff_files "$file_list_file" "$files_in_spdx_file" "$partition_name"
200 done
201
202 RAMDISK_IMAGES="$product_out/ramdisk.img"
203 for f in $RAMDISK_IMAGES; do
204 partition_name=$(basename $f | cut -d. -f1)
205 file_list_file="${sbom_test}/sbom-${partition_name}-files.txt"
206 files_in_spdx_file="${sbom_test}/sbom-${partition_name}-files-in-spdx.txt"
207 # lz4 decompress $f to stdout
208 # cpio list all entries like ls -l
209 # grep filter normal files and symlinks
210 # awk get entry names
211 # sed remove partition name from entry names
212 $lz4 -c -d $f | cpio -tv 2>/dev/null | grep '^[-l]' | awk -F ' ' '{print $9}' | sed "s:^:/$partition_name/:" | sort -n > "$file_list_file"
213
214 grep "FileName: /${partition_name}/" $product_out/sbom.spdx | sed 's/^FileName: //' | sort -n > "$files_in_spdx_file"
215
216 echo ============ Diffing files in $f and SBOM
217 diff_files "$file_list_file" "$files_in_spdx_file" "$partition_name"
218 done
219
Wei Li8ea2ffc2023-08-01 15:20:38 -0700220 verify_package_verification_code "$product_out/sbom.spdx"
221
Wei Licd9948f2023-06-22 17:52:31 -0700222 # Teardown
223 cleanup "${out_dir}"
224}
225
Wei Li8ea2ffc2023-08-01 15:20:38 -0700226function verify_package_verification_code {
227 local sbom_file="$1"; shift
228
229 local -a file_checksums
230 local package_product_found=
231 while read -r line;
232 do
233 if grep -q 'PackageVerificationCode' <<<"$line"
234 then
235 package_product_found=true
236 fi
237 if [ -n "$package_product_found" ]
238 then
239 if grep -q 'FileChecksum' <<< "$line"
240 then
241 checksum=$(echo $line | sed 's/^.*: //')
242 file_checksums+=("$checksum")
243 fi
244 fi
245 done <<< "$(grep -E 'PackageVerificationCode|FileChecksum' $sbom_file)"
246 IFS=$'\n' file_checksums=($(sort <<<"${file_checksums[*]}")); unset IFS
247 IFS= expected_package_verification_code=$(printf "${file_checksums[*]}" | sha1sum | sed 's/[[:space:]]*-//'); unset IFS
248
249 actual_package_verification_code=$(grep PackageVerificationCode $sbom_file | sed 's/PackageVerificationCode: //g')
250 if [ $actual_package_verification_code = $expected_package_verification_code ]
251 then
252 echo "Package verification code is correct."
253 else
254 echo "Unexpected package verification code."
255 exit 1
256 fi
257}
258
Wei Li59df0ee2023-07-10 15:50:38 -0700259function test_sbom_unbundled_apex {
260 # Setup
261 out_dir="$(setup)"
262
263 # run_soong to build com.android.adbd.apex
264 run_soong "module_arm64" "${out_dir}" "sbom deapexer" "com.android.adbd"
265
266 deapexer=${out_dir}/host/linux-x86/bin/deapexer
267 debugfs=${out_dir}/host/linux-x86/bin/debugfs_static
268 apex_file=${out_dir}/target/product/module_arm64/system/apex/com.android.adbd.apex
269 echo "============ Diffing files in $apex_file and SBOM"
270 set +e
271 # deapexer prints the list of all files and directories
272 # sed extracts the file/directory names
273 # grep removes directories
274 # sed removes leading ./ in file names
275 diff -I /system/apex/com.android.adbd.apex -I apex_manifest.pb \
276 <($deapexer --debugfs_path=$debugfs list --extents ${apex_file} | sed -E 's#(.*) \[.*\]$#\1#' | grep -v "/$" | sed -E 's#^\./(.*)#\1#' | sort -n) \
277 <(grep '"fileName": ' ${apex_file}.spdx.json | sed -E 's/.*"fileName": "(.*)",/\1/' | sort -n )
278
279 if [ $? != "0" ]; then
280 echo "Diffs found in $apex_file and SBOM"
281 exit 1
282 else
283 echo "No diffs."
284 fi
285 set -e
286
287 # Teardown
288 cleanup "${out_dir}"
289}
290
291function test_sbom_unbundled_apk {
292 # Setup
293 out_dir="$(setup)"
294
295 # run_soong to build Browser2.apk
296 run_soong "module_arm64" "${out_dir}" "sbom" "Browser2"
297
298 sbom_file=${out_dir}/target/product/module_arm64/system/product/app/Browser2/Browser2.apk.spdx.json
299 echo "============ Diffing files in Browser2.apk and SBOM"
300 set +e
301 # There is only one file in SBOM of APKs
302 diff \
303 <(echo "/system/product/app/Browser2/Browser2.apk" ) \
304 <(grep '"fileName": ' ${sbom_file} | sed -E 's/.*"fileName": "(.*)",/\1/' )
305
306 if [ $? != "0" ]; then
307 echo "Diffs found in $sbom_file"
308 exit 1
309 else
310 echo "No diffs."
311 fi
312 set -e
313
314 # Teardown
315 cleanup "${out_dir}"
316}
317
318test_sbom_aosp_cf_x86_64_phone
319test_sbom_unbundled_apex
320test_sbom_unbundled_apk