Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
spdx: Add converter for index reports
Adding a function to be able to convert index reports into SPDX documents. Signed-off-by: crozzy <[email protected]>
- Loading branch information
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,74 @@ | ||
| package spdx | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "runtime/debug" | ||
| "time" | ||
|
|
||
| "github.com/spdx/tools-golang/spdx/v2/common" | ||
| spdxtools "github.com/spdx/tools-golang/spdx/v2/v2_3" | ||
|
|
||
| "github.com/quay/claircore" | ||
| ) | ||
|
|
||
| func ParseIndexReport(vr *claircore.IndexReport) (*spdxtools.Document, error) { | ||
| // Initial metadata | ||
| out := &spdxtools.Document{ | ||
| SPDXVersion: spdxtools.Version, | ||
| DataLicense: spdxtools.DataLicense, | ||
| SPDXIdentifier: "DOCUMENT", | ||
| DocumentName: "SPDX-claircore-" + vr.Hash.String(), | ||
| // This would be nice to have but don't know how we'd get context w/o | ||
| // having to accept it as an argument. | ||
| // DocumentNamespace: "https://clairproject.org/spdxdocs/spdx-example-444504E0-4F89-41D3-9A0C-0305E82C3301", | ||
| CreationInfo: &spdxtools.CreationInfo{ | ||
| Creators: []common.Creator{ | ||
| {CreatorType: "Tool", Creator: "Claircore"}, | ||
| {CreatorType: "Organization", Creator: "Clair"}, | ||
| }, | ||
| Created: time.Now().Format("2006-01-02T15:04:05Z"), | ||
| }, | ||
| DocumentComment: fmt.Sprintf("This document was created using claircore (%s).", getVersion()), | ||
| } | ||
|
|
||
| for _, p := range vr.Packages { | ||
| pkgDB := "" | ||
| for _, e := range vr.Environments[p.ID] { | ||
| if e.PackageDB != "" { | ||
| pkgDB = e.PackageDB | ||
| } | ||
| } | ||
| pkg := &spdxtools.Package{ | ||
| PackageName: p.Name, | ||
| PackageSPDXIdentifier: common.ElementID("SPDXRef-" + p.ID), | ||
| PackageVersion: p.Version, | ||
| PackageFileName: pkgDB, | ||
| PackageDownloadLocation: "NOASSERTION", | ||
| FilesAnalyzed: true, | ||
| } | ||
| out.Packages = append(out.Packages, pkg) | ||
| } | ||
| return out, nil | ||
| } | ||
|
|
||
| // GetVersion is copied from Clair and can hopefully give some | ||
| // context as to which revision of claircore was used. | ||
| func getVersion() string { | ||
| info, infoOK := debug.ReadBuildInfo() | ||
| var core string | ||
| if infoOK { | ||
| for _, m := range info.Deps { | ||
| if m.Path != "github.com/quay/claircore" { | ||
| continue | ||
| } | ||
| core = m.Version | ||
| if m.Replace != nil && m.Replace.Version != m.Version { | ||
| core = m.Replace.Version | ||
| } | ||
| } | ||
| } | ||
| if core == "" { | ||
| core = "unknown revision" | ||
| } | ||
| return core | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,120 @@ | ||
| package spdx | ||
|
|
||
| import ( | ||
| "bytes" | ||
| "strings" | ||
| "testing" | ||
|
|
||
| "github.com/quay/claircore" | ||
|
|
||
| "github.com/google/go-cmp/cmp" | ||
| "github.com/google/go-cmp/cmp/cmpopts" | ||
| "github.com/spdx/tools-golang/spdx/v2/common" | ||
| spdxtools "github.com/spdx/tools-golang/spdx/v2/v2_3" | ||
| "github.com/spdx/tools-golang/tagvalue" | ||
| ) | ||
|
|
||
| func TestParseIndexReport(t *testing.T) { | ||
| opts := cmp.Options{ | ||
| cmp.AllowUnexported(spdxtools.Package{}), | ||
| cmpopts.IgnoreFields(spdxtools.CreationInfo{}, "Created"), | ||
| } | ||
| //ctx := context.Background() | ||
| for _, tt := range testIndexReports { | ||
| t.Run(tt.name, func(t *testing.T) { | ||
|
|
||
| s, err := ParseIndexReport(tt.indexReport) | ||
| if err != nil { | ||
| t.Fatal(err) | ||
| } | ||
| w := &bytes.Buffer{} | ||
| err = tagvalue.Write(s, w) | ||
| if err != nil { | ||
| t.Fatal(err) | ||
| } | ||
| if !cmp.Equal(s, tt.SPDXReport, opts) { | ||
| t.Error(cmp.Diff(tt.SPDXReport, s, opts)) | ||
| } | ||
| }) | ||
| } | ||
| } | ||
|
|
||
| type testcase struct { | ||
| name string | ||
| indexReport *claircore.IndexReport | ||
| SPDXReport *spdxtools.Document | ||
| } | ||
|
|
||
| var testIndexReports = []testcase{ | ||
| { | ||
| name: "simple index report", | ||
| indexReport: &claircore.IndexReport{ | ||
| Hash: claircore.MustParseDigest(`sha256:` + strings.Repeat(`a`, 64)), | ||
| Packages: map[string]*claircore.Package{ | ||
| "123": { | ||
| ID: "123", | ||
| Name: "package A", | ||
| Version: "v1.0.0", | ||
| }, | ||
| "456": { | ||
| ID: "456", | ||
| Name: "package B", | ||
| Version: "v2.0.0", | ||
| }, | ||
| }, | ||
| Environments: map[string][]*claircore.Environment{ | ||
| "123": { | ||
| { | ||
| PackageDB: "var/lib/dpkg/status", | ||
| IntroducedIn: claircore.MustParseDigest(`sha256:` + strings.Repeat(`b`, 64)), | ||
| RepositoryIDs: []string{"11"}, | ||
| }, | ||
| }, | ||
| "456": { | ||
| { | ||
| PackageDB: "maven:opt/couchbase/lib/cbas/repo/eventstream-1.0.1.jar", | ||
| IntroducedIn: claircore.MustParseDigest(`sha256:` + strings.Repeat(`c`, 64)), | ||
| RepositoryIDs: []string{"12"}, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| SPDXReport: &spdxtools.Document{ | ||
| SPDXVersion: "SPDX-2.3", | ||
| DataLicense: "CC0-1.0", | ||
| SPDXIdentifier: "DOCUMENT", | ||
| DocumentName: "SPDX-claircore-sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", | ||
| DocumentComment: "This document was created using claircore (unknown revision).", | ||
| CreationInfo: &spdxtools.CreationInfo{ | ||
| Creators: []common.Creator{ | ||
| { | ||
| Creator: "Claircore", | ||
| CreatorType: "Tool", | ||
| }, | ||
| { | ||
| Creator: "Clair", | ||
| CreatorType: "Organization", | ||
| }, | ||
| }, | ||
| }, | ||
| Packages: []*spdxtools.Package{ | ||
| { | ||
| PackageName: "package A", | ||
| PackageSPDXIdentifier: "SPDXRef-123", | ||
| PackageVersion: "v1.0.0", | ||
| PackageFileName: "var/lib/dpkg/status", | ||
| PackageDownloadLocation: "NOASSERTION", | ||
| FilesAnalyzed: true, | ||
| }, | ||
| { | ||
| PackageName: "package B", | ||
| PackageSPDXIdentifier: "SPDXRef-456", | ||
| PackageVersion: "v2.0.0", | ||
| PackageFileName: "maven:opt/couchbase/lib/cbas/repo/eventstream-1.0.1.jar", | ||
| PackageDownloadLocation: "NOASSERTION", | ||
| FilesAnalyzed: true, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| } |