Merge pull request #10 from RedHatProductSecurity/add-rpm-checksums

Add RPM checksums in purls
RedHatProductSecurity · Aug 13, 2024 · 5206e73 · 5206e73
2 parents 0d6421c + e22a6df
commit 5206e73
Show file tree

Hide file tree

Showing 5 changed files with 93 additions and 92 deletions.
diff --git a/docs/purl.md b/docs/purl.md
@@ -40,22 +40,25 @@ to not only identify a particular package (the file name already does that) but
 package can be accessed. The emacs package example above can be represented using the following purl:
 
 ```
-pkg:rpm/redhat/[email protected]?arch=x86_64&repository_id=rhel-9-for-x86_64-appstream-rpms
+pkg:rpm/redhat/[email protected]?arch=x86_64&repository_id=rhel-9-for-x86_64-appstream-rpms&checksum=sha256:abcd1234
 ```
 
 The namespace value of `redhat` signifies this as an RPM package produced and distributed by Red Hat.
 
 If a purl identifies a Source RPM (SRPM, a package containing source code files that are used to build one or more
 RPMs containing binary artifacts), the `arch` qualifier must use the special value `src`. In the NEVRA file name
-pattern, SRPM packages use a `.src.rpm` suffix. Packages that are not architecture
-specific must use the special `noarch` value in the arch qualifier.
+pattern, SRPM packages use a `.src.rpm` suffix. Packages that are not architecture-specific must use the special
+`noarch` value in the arch qualifier.
+
+The value in the `checksum` qualifier represents the checksum digest of a given RPM file identified by the purl
+string. Note that unsigned and signed versions of these files will have different checksum values.
 
 An RPM package may also include an epoch number; if not present, it is assumed to be `0`. In a purl, epoch is
 not part of the version field, but instead is specified using the `epoch` qualifier (e.g. `epoch=1`).
 If the package version includes a non-zero epoch value, it must be specified using its own epoch qualifier:
 
 ```
-pkg:rpm/redhat/[email protected]?epoch=1&arch=src&repository_id=rhel-9-for-x86_64-appstream-rpms
+pkg:rpm/redhat/[email protected]?epoch=1&arch=src&repository_id=rhel-9-for-x86_64-appstream-rpms&checksum=sha256:abcd1234
 ```
 
 The `rpm` purl type suggests the use of the `repository_url` qualifier to point to the base URL of the RPM

diff --git a/sbom/examples/rpm/from-koji.py b/sbom/examples/rpm/from-koji.py
@@ -7,10 +7,11 @@
 import sys
 from tempfile import TemporaryDirectory
 
+# Script requires these RPMs: brewkoji, rpmdevtools, rpm-build
+# Run with: ./from-koji.py brew <NVR>
+
 source_re = re.compile(r"^(Source\d+):\s*((.*/)?(.*))$")
-tarball_re = re.compile(
-    r"^([^0-9]*)-([0-9a-f\.-]*)[\.-][a-z]"
-)  # Obviously not universal
+tarball_re = re.compile(r"^([^0-9]*)-([0-9a-f\.-]*)[\.-][a-z]")  # Obviously not universal
 koji_profile = sys.argv[1]
 build_id = sys.argv[2]
 profile = koji.get_profile_module(koji_profile)
@@ -71,11 +72,7 @@ def run_syft(builddir):
             continue
 
         # For the example data we only care about purl references
-        refs = [
-            ref
-            for ref in pkg["externalRefs"]
-            if ref["referenceCategory"] == "PACKAGE-MANAGER"
-        ]
+        refs = [ref for ref in pkg["externalRefs"] if ref["referenceCategory"] == "PACKAGE-MANAGER"]
         if refs:
             pkg["externalRefs"] = refs
         else:
@@ -299,6 +296,7 @@ def handle_srpm(filename, name):
             if not data:
                 break
             sha256.update(data)
+    digest = sha256.hexdigest()
 
     license = get_license(filename)
     package = {
@@ -313,13 +311,13 @@ def handle_srpm(filename, name):
             {
                 "referenceCategory": "PACKAGE-MANAGER",
                 "referenceType": "purl",
-                "referenceLocator": f"pkg:rpm/redhat/{name}@{version}-{release}?arch={arch}",
+                "referenceLocator": f"pkg:rpm/redhat/{name}@{version}-{release}?arch={arch}&checksum=sha256:{digest}",
             }
         ],
         "checksums": [
             {
                 "algorithm": "SHA256",
-                "checksumValue": sha256.hexdigest(),
+                "checksumValue": digest,
             },
         ],
     }
@@ -364,5 +362,5 @@ def handle_srpm(filename, name):
     "relationships": relationships,
 }
 
-with open(f"{build_id}-sbom.json", "w") as fp:
+with open(f"{build_id}.spdx.json", "w") as fp:
     json.dump(spdx, fp, indent=2)
diff --git a/sbom/examples/rpm/openshift-pipelines-client-1.14.3-11352.el8.spdx.json b/sbom/examples/rpm/openshift-pipelines-client-1.14.3-11352.el8.spdx.json
@@ -18692,7 +18692,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:rpm/redhat/[email protected]?arch=src"
+          "referenceLocator": "pkg:rpm/redhat/[email protected]?arch=src&checksum=f260ee743e4d1e3a989657c6c5ad854affa200fb91b0cca3594160a17b4fe384"
         }
       ],
       "checksums": [
@@ -18753,7 +18753,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:rpm/redhat/[email protected]?arch=x86_64"
+          "referenceLocator": "pkg:rpm/redhat/[email protected]?arch=x86_64&checksum=baa0c6523d91d99dbab8043f97790c1393b73fbbc711e9b07bd83f49ad91a800"
         }
       ],
       "checksums": [
@@ -18775,7 +18775,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:rpm/redhat/[email protected]?arch=x86_64"
+          "referenceLocator": "pkg:rpm/redhat/[email protected]?arch=x86_64&checksum=e7f74f4ced31a2bd3e329e64f9c3d0a09eef34c32d44799086443f7a56e8029e"
         }
       ],
       "checksums": [
@@ -18797,7 +18797,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:rpm/redhat/[email protected]?arch=s390x"
+          "referenceLocator": "pkg:rpm/redhat/[email protected]?arch=s390x&checksum=c401f381568196437007f5b7ad4c28c1926954c3331f51e944f46857e46d262c"
         }
       ],
       "checksums": [
@@ -18819,7 +18819,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:rpm/redhat/[email protected]?arch=s390x"
+          "referenceLocator": "pkg:rpm/redhat/[email protected]?arch=s390x&checksum=e9d93086f6388d46323996c5ae312c579e333e4bc7b6749d1a67ac052a274052"
         }
       ],
       "checksums": [
@@ -18841,7 +18841,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:rpm/redhat/[email protected]?arch=ppc64le"
+          "referenceLocator": "pkg:rpm/redhat/[email protected]?arch=ppc64le&checksum=3fd37914601456f58e41482489e3a78d895b005b761f9f6ec90253c4f734bc12"
         }
       ],
       "checksums": [
@@ -18863,7 +18863,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:rpm/redhat/[email protected]?arch=ppc64le"
+          "referenceLocator": "pkg:rpm/redhat/[email protected]?arch=ppc64le&checksum=816732946439dc442cdfb846be1b807b90dac7bd5c2384b1f1b825240150ed5d"
         }
       ],
       "checksums": [
@@ -18885,7 +18885,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:rpm/redhat/[email protected]?arch=aarch64"
+          "referenceLocator": "pkg:rpm/redhat/[email protected]?arch=aarch64&checksum=18281527bfcdc8b81153062bcece92f4ba293d343af07ff0b8dc11a3a8584d02"
         }
       ],
       "checksums": [
@@ -18907,7 +18907,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:rpm/redhat/[email protected]?arch=aarch64"
+          "referenceLocator": "pkg:rpm/redhat/[email protected]?arch=aarch64&checksum=2c0043a7de4302e7406cdea88e7c3289c188babd1dc2742e57109d282b0f08a6"
         }
       ],
       "checksums": [

diff --git a/sbom/examples/rpm/openssl-3.0.7-18.el9_2.spdx.json b/sbom/examples/rpm/openssl-3.0.7-18.el9_2.spdx.json
@@ -23,7 +23,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=src"
+          "referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=src&checksum=9215c64e7289a058248728089e4d98ed1cc392bb5eb9b8fcbe661d57e8145bbd"
         }
       ],
       "checksums": [
@@ -85,7 +85,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=aarch64"
+          "referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=aarch64&checksum=fbdd94bb6ce796441e4d4b9b04a960b41f6f7577e51c764e2befe9226e71da4b"
         }
       ],
       "checksums": [
@@ -107,7 +107,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=aarch64"
+          "referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=aarch64&checksum=832757f9bcb231e954fb390b835fb833b9046594aa3c6387eeaadd9af592f40f"
         }
       ],
       "checksums": [
@@ -129,7 +129,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=aarch64"
+          "referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=aarch64&checksum=9538011195d4997d7be4bba8cd01473abbf50e397dea06b6545d1d5fbd04817d"
         }
       ],
       "checksums": [
@@ -151,7 +151,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=aarch64"
+          "referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=aarch64&checksum=af7342cf0b04d24e8055f364d67afd705fbb94c7ec2460999a59cacfdf554920"
         }
       ],
       "checksums": [
@@ -173,7 +173,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=ppc64le"
+          "referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=ppc64le&checksum=bf63da42704f9da1e9eeefab808900f521a357b9a07433c0973965a02a2bb915"
         }
       ],
       "checksums": [
@@ -195,7 +195,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=ppc64le"
+          "referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=ppc64le&checksum=71cb34e11fa6bda16512f0dbb314ac761348cf907b3e49fa54c7576305ed6afb"
         }
       ],
       "checksums": [
@@ -217,7 +217,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=ppc64le"
+          "referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=ppc64le&checksum=36d11f2f192aef3abf391e4cf6699a24a303f09d68b2477595bb12af82b26e48"
         }
       ],
       "checksums": [
@@ -239,7 +239,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=ppc64le"
+          "referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=ppc64le&checksum=c96d6029cfa0e6a01c4419c154cbf98c08ab9bb69cc756d81350ab77b4d1f44c"
         }
       ],
       "checksums": [
@@ -261,7 +261,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=i686"
+          "referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=i686&checksum=69e098aceca261b8cdd127b78c90868d40d39c3cb94e37b07703b3f7a85f832f"
         }
       ],
       "checksums": [
@@ -283,7 +283,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=i686"
+          "referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=i686&checksum=689777a4cc483b0cbb3757da0e3274b49d6e697f8174405df415e0018cef7646"
         }
       ],
       "checksums": [
@@ -305,7 +305,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=i686"
+          "referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=i686&checksum=9b529f697702037b712e81778fa4e222d385568e4b3be167e6e42431a3270bfd"
         }
       ],
       "checksums": [
@@ -327,7 +327,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=i686"
+          "referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=i686&checksum=0bc733036256ec160b8ca5ed6bc1082e4d4c15f84cf6ff141f02d8e45d73b4b8"
         }
       ],
       "checksums": [
@@ -349,7 +349,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=x86_64"
+          "referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=x86_64&checksum=b2fe5b3a9230446e6e8119cd24eef1bee107b8d5ac37d2c5442d524bf5745a4e"
         }
       ],
       "checksums": [
@@ -371,7 +371,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=x86_64"
+          "referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=x86_64&checksum=0cb4cd2487dcbc2c0d97ded42f7998ff5f27c6e38ad40b204cce1e22c9966148"
         }
       ],
       "checksums": [
@@ -393,7 +393,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=x86_64"
+          "referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=x86_64&checksum=82b40f3403399fc808bd26f1a91edb7855e8f10087b925651001c17cb17a38ed"
         }
       ],
       "checksums": [
@@ -415,7 +415,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=x86_64"
+          "referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=x86_64&checksum=0af316c88f24a4a3df742376b8875c89137acec5df2b40717dcc3d81789f52f0"
         }
       ],
       "checksums": [
@@ -437,7 +437,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=s390x"
+          "referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=s390x&checksum=3a92cded871cffdb2290d078fe4cf300bc9d74fd0af612a607898d9b6c7967fd"
         }
       ],
       "checksums": [
@@ -459,7 +459,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=s390x"
+          "referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=s390x&checksum=1c4e7f767b47e9dd36f00c1c213328ab84f0c1516d17b17f068eadefd5cc706d"
         }
       ],
       "checksums": [
@@ -481,7 +481,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=s390x"
+          "referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=s390x&checksum=c99bf4a5bf29434baca2e30e40fc9f6c7152ec9c372a48b79dbc9294d08a7774"
         }
       ],
       "checksums": [
@@ -503,7 +503,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=s390x"
+          "referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=s390x&checksum=fe1ef3b6550b1f4153ac2d280f84d46bb36bb63a11ddaec7f76ff7fc0770d2db"
         }
       ],
       "checksums": [