Merge pull request #12 from RedHatProductSecurity/debuginfo

Don't exclude debuginfo RPM packages
RedHatProductSecurity · Aug 14, 2024 · 2750691 · 2750691
2 parents 5206e73 + 8e9199a
commit 2750691
Show file tree

Hide file tree

Showing 4 changed files with 1,458 additions and 245 deletions.
diff --git a/sbom/examples/rpm/from-koji.py b/sbom/examples/rpm/from-koji.py
@@ -267,7 +267,7 @@ def handle_srpm(filename, name):
         cwd=str(downloaddir),
         check=True,
         stdout=None,
-        args=["koji", "-p", koji_profile, "download-build", build_id],
+        args=["koji", "-p", koji_profile, "download-build", "--debuginfo", build_id],
     )
 except FileExistsError:
     pass
@@ -281,8 +281,6 @@ def handle_srpm(filename, name):
         rpm["nvr"],
         rpm["arch"],
     )
-    if name.endswith("-debuginfo") or name.endswith("-debugsource"):
-        continue
     filename = f"{downloaddir}/{name}-{version}-{release}.{arch}.rpm"
     if arch == "src":
         spdxid = "SPDXRef-SRPM"

diff --git a/sbom/examples/rpm/openshift-pipelines-client-1.14.3-11352.el8.spdx.json b/sbom/examples/rpm/openshift-pipelines-client-1.14.3-11352.el8.spdx.json
@@ -18692,7 +18692,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:rpm/redhat/[email protected]?arch=src&checksum=f260ee743e4d1e3a989657c6c5ad854affa200fb91b0cca3594160a17b4fe384"
+          "referenceLocator": "pkg:rpm/redhat/[email protected]?arch=src&checksum=sha256:f260ee743e4d1e3a989657c6c5ad854affa200fb91b0cca3594160a17b4fe384"
         }
       ],
       "checksums": [
@@ -18753,7 +18753,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:rpm/redhat/[email protected]?arch=x86_64&checksum=baa0c6523d91d99dbab8043f97790c1393b73fbbc711e9b07bd83f49ad91a800"
+          "referenceLocator": "pkg:rpm/redhat/[email protected]?arch=x86_64&checksum=sha256:baa0c6523d91d99dbab8043f97790c1393b73fbbc711e9b07bd83f49ad91a800"
         }
       ],
       "checksums": [
@@ -18775,7 +18775,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:rpm/redhat/[email protected]?arch=x86_64&checksum=e7f74f4ced31a2bd3e329e64f9c3d0a09eef34c32d44799086443f7a56e8029e"
+          "referenceLocator": "pkg:rpm/redhat/[email protected]?arch=x86_64&checksum=sha256:e7f74f4ced31a2bd3e329e64f9c3d0a09eef34c32d44799086443f7a56e8029e"
         }
       ],
       "checksums": [
@@ -18797,7 +18797,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:rpm/redhat/[email protected]?arch=s390x&checksum=c401f381568196437007f5b7ad4c28c1926954c3331f51e944f46857e46d262c"
+          "referenceLocator": "pkg:rpm/redhat/[email protected]?arch=s390x&checksum=sha256:c401f381568196437007f5b7ad4c28c1926954c3331f51e944f46857e46d262c"
         }
       ],
       "checksums": [
@@ -18819,7 +18819,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:rpm/redhat/[email protected]?arch=s390x&checksum=e9d93086f6388d46323996c5ae312c579e333e4bc7b6749d1a67ac052a274052"
+          "referenceLocator": "pkg:rpm/redhat/[email protected]?arch=s390x&checksum=sha256:e9d93086f6388d46323996c5ae312c579e333e4bc7b6749d1a67ac052a274052"
         }
       ],
       "checksums": [
@@ -18841,7 +18841,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:rpm/redhat/[email protected]?arch=ppc64le&checksum=3fd37914601456f58e41482489e3a78d895b005b761f9f6ec90253c4f734bc12"
+          "referenceLocator": "pkg:rpm/redhat/[email protected]?arch=ppc64le&checksum=sha256:3fd37914601456f58e41482489e3a78d895b005b761f9f6ec90253c4f734bc12"
         }
       ],
       "checksums": [
@@ -18863,7 +18863,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:rpm/redhat/[email protected]?arch=ppc64le&checksum=816732946439dc442cdfb846be1b807b90dac7bd5c2384b1f1b825240150ed5d"
+          "referenceLocator": "pkg:rpm/redhat/[email protected]?arch=ppc64le&checksum=sha256:816732946439dc442cdfb846be1b807b90dac7bd5c2384b1f1b825240150ed5d"
         }
       ],
       "checksums": [
@@ -18885,7 +18885,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:rpm/redhat/[email protected]?arch=aarch64&checksum=18281527bfcdc8b81153062bcece92f4ba293d343af07ff0b8dc11a3a8584d02"
+          "referenceLocator": "pkg:rpm/redhat/[email protected]?arch=aarch64&checksum=sha256:18281527bfcdc8b81153062bcece92f4ba293d343af07ff0b8dc11a3a8584d02"
         }
       ],
       "checksums": [
@@ -18907,7 +18907,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:rpm/redhat/[email protected]?arch=aarch64&checksum=2c0043a7de4302e7406cdea88e7c3289c188babd1dc2742e57109d282b0f08a6"
+          "referenceLocator": "pkg:rpm/redhat/[email protected]?arch=aarch64&checksum=sha256:2c0043a7de4302e7406cdea88e7c3289c188babd1dc2742e57109d282b0f08a6"
         }
       ],
       "checksums": [