Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add RPM checksums in purls #10

Merged
merged 5 commits into from
Aug 13, 2024
Merged

Add RPM checksums in purls #10

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
e6e22f1
Add RPM requirements and fix formatting
mprpic Aug 12, 2024
17d9c84
Rename generated SBOM files to adhere to naming conventions
mprpic Aug 12, 2024
e55c9a0
Generate RPM purls with checksums
mprpic Aug 12, 2024
a011e93
Update RPM example SBOMs with checksums in purls
mprpic Aug 12, 2024
e22a6df
Add hash algo into checksum value
mprpic Aug 13, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 7 additions & 4 deletions docs/purl.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,22 +40,25 @@ to not only identify a particular package (the file name already does that) but
package can be accessed. The emacs package example above can be represented using the following purl:

```
pkg:rpm/redhat/[email protected]?arch=x86_64&repository_id=rhel-9-for-x86_64-appstream-rpms
pkg:rpm/redhat/[email protected]?arch=x86_64&repository_id=rhel-9-for-x86_64-appstream-rpms&checksum=sha256:abcd1234
```

The namespace value of `redhat` signifies this as an RPM package produced and distributed by Red Hat.

If a purl identifies a Source RPM (SRPM, a package containing source code files that are used to build one or more
RPMs containing binary artifacts), the `arch` qualifier must use the special value `src`. In the NEVRA file name
pattern, SRPM packages use a `.src.rpm` suffix. Packages that are not architecture
specific must use the special `noarch` value in the arch qualifier.
pattern, SRPM packages use a `.src.rpm` suffix. Packages that are not architecture-specific must use the special
`noarch` value in the arch qualifier.

The value in the `checksum` qualifier represents the checksum digest of a given RPM file identified by the purl
string. Note that unsigned and signed versions of these files will have different checksum values.

An RPM package may also include an epoch number; if not present, it is assumed to be `0`. In a purl, epoch is
not part of the version field, but instead is specified using the `epoch` qualifier (e.g. `epoch=1`).
If the package version includes a non-zero epoch value, it must be specified using its own epoch qualifier:

```
pkg:rpm/redhat/[email protected]?epoch=1&arch=src&repository_id=rhel-9-for-x86_64-appstream-rpms
pkg:rpm/redhat/[email protected]?epoch=1&arch=src&repository_id=rhel-9-for-x86_64-appstream-rpms&checksum=sha256:abcd1234
```

The `rpm` purl type suggests the use of the `repository_url` qualifier to point to the base URL of the RPM
Expand Down
20 changes: 9 additions & 11 deletions sbom/examples/rpm/from-koji.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,10 +7,11 @@
import sys
from tempfile import TemporaryDirectory

# Script requires these RPMs: brewkoji, rpmdevtools, rpm-build
# Run with: ./from-koji.py brew <NVR>

source_re = re.compile(r"^(Source\d+):\s*((.*/)?(.*))$")
tarball_re = re.compile(
r"^([^0-9]*)-([0-9a-f\.-]*)[\.-][a-z]"
) # Obviously not universal
tarball_re = re.compile(r"^([^0-9]*)-([0-9a-f\.-]*)[\.-][a-z]") # Obviously not universal
mprpic marked this conversation as resolved.
Show resolved Hide resolved
koji_profile = sys.argv[1]
build_id = sys.argv[2]
profile = koji.get_profile_module(koji_profile)
Expand Down Expand Up @@ -71,11 +72,7 @@ def run_syft(builddir):
continue

# For the example data we only care about purl references
refs = [
ref
for ref in pkg["externalRefs"]
if ref["referenceCategory"] == "PACKAGE-MANAGER"
]
refs = [ref for ref in pkg["externalRefs"] if ref["referenceCategory"] == "PACKAGE-MANAGER"]
if refs:
pkg["externalRefs"] = refs
else:
Expand Down Expand Up @@ -299,6 +296,7 @@ def handle_srpm(filename, name):
if not data:
break
sha256.update(data)
digest = sha256.hexdigest()

license = get_license(filename)
package = {
Expand All @@ -313,13 +311,13 @@ def handle_srpm(filename, name):
{
"referenceCategory": "PACKAGE-MANAGER",
"referenceType": "purl",
"referenceLocator": f"pkg:rpm/redhat/{name}@{version}-{release}?arch={arch}",
"referenceLocator": f"pkg:rpm/redhat/{name}@{version}-{release}?arch={arch}&checksum=sha256:{digest}",
}
],
"checksums": [
{
"algorithm": "SHA256",
"checksumValue": sha256.hexdigest(),
"checksumValue": digest,
},
],
}
Expand Down Expand Up @@ -364,5 +362,5 @@ def handle_srpm(filename, name):
"relationships": relationships,
}

with open(f"{build_id}-sbom.json", "w") as fp:
with open(f"{build_id}.spdx.json", "w") as fp:
json.dump(spdx, fp, indent=2)
18 changes: 9 additions & 9 deletions sbom/examples/rpm/openshift-pipelines-client-1.14.3-11352.el8.spdx.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18692,7 +18692,7 @@
{
"referenceCategory": "PACKAGE-MANAGER",
"referenceType": "purl",
"referenceLocator": "pkg:rpm/redhat/[email protected]?arch=src"
"referenceLocator": "pkg:rpm/redhat/[email protected]?arch=src&checksum=f260ee743e4d1e3a989657c6c5ad854affa200fb91b0cca3594160a17b4fe384"
}
],
"checksums": [
Expand Down Expand Up @@ -18753,7 +18753,7 @@
{
"referenceCategory": "PACKAGE-MANAGER",
"referenceType": "purl",
"referenceLocator": "pkg:rpm/redhat/[email protected]?arch=x86_64"
"referenceLocator": "pkg:rpm/redhat/[email protected]?arch=x86_64&checksum=baa0c6523d91d99dbab8043f97790c1393b73fbbc711e9b07bd83f49ad91a800"
}
],
"checksums": [
Expand All @@ -18775,7 +18775,7 @@
{
"referenceCategory": "PACKAGE-MANAGER",
"referenceType": "purl",
"referenceLocator": "pkg:rpm/redhat/[email protected]?arch=x86_64"
"referenceLocator": "pkg:rpm/redhat/[email protected]?arch=x86_64&checksum=e7f74f4ced31a2bd3e329e64f9c3d0a09eef34c32d44799086443f7a56e8029e"
}
],
"checksums": [
Expand All @@ -18797,7 +18797,7 @@
{
"referenceCategory": "PACKAGE-MANAGER",
"referenceType": "purl",
"referenceLocator": "pkg:rpm/redhat/[email protected]?arch=s390x"
"referenceLocator": "pkg:rpm/redhat/[email protected]?arch=s390x&checksum=c401f381568196437007f5b7ad4c28c1926954c3331f51e944f46857e46d262c"
}
],
"checksums": [
Expand All @@ -18819,7 +18819,7 @@
{
"referenceCategory": "PACKAGE-MANAGER",
"referenceType": "purl",
"referenceLocator": "pkg:rpm/redhat/[email protected]?arch=s390x"
"referenceLocator": "pkg:rpm/redhat/[email protected]?arch=s390x&checksum=e9d93086f6388d46323996c5ae312c579e333e4bc7b6749d1a67ac052a274052"
}
],
"checksums": [
Expand All @@ -18841,7 +18841,7 @@
{
"referenceCategory": "PACKAGE-MANAGER",
"referenceType": "purl",
"referenceLocator": "pkg:rpm/redhat/[email protected]?arch=ppc64le"
"referenceLocator": "pkg:rpm/redhat/[email protected]?arch=ppc64le&checksum=3fd37914601456f58e41482489e3a78d895b005b761f9f6ec90253c4f734bc12"
}
],
"checksums": [
Expand All @@ -18863,7 +18863,7 @@
{
"referenceCategory": "PACKAGE-MANAGER",
"referenceType": "purl",
"referenceLocator": "pkg:rpm/redhat/[email protected]?arch=ppc64le"
"referenceLocator": "pkg:rpm/redhat/[email protected]?arch=ppc64le&checksum=816732946439dc442cdfb846be1b807b90dac7bd5c2384b1f1b825240150ed5d"
}
],
"checksums": [
Expand All @@ -18885,7 +18885,7 @@
{
"referenceCategory": "PACKAGE-MANAGER",
"referenceType": "purl",
"referenceLocator": "pkg:rpm/redhat/[email protected]?arch=aarch64"
"referenceLocator": "pkg:rpm/redhat/[email protected]?arch=aarch64&checksum=18281527bfcdc8b81153062bcece92f4ba293d343af07ff0b8dc11a3a8584d02"
}
],
"checksums": [
Expand All @@ -18907,7 +18907,7 @@
{
"referenceCategory": "PACKAGE-MANAGER",
"referenceType": "purl",
"referenceLocator": "pkg:rpm/redhat/[email protected]?arch=aarch64"
"referenceLocator": "pkg:rpm/redhat/[email protected]?arch=aarch64&checksum=2c0043a7de4302e7406cdea88e7c3289c188babd1dc2742e57109d282b0f08a6"
}
],
"checksums": [
Expand Down
42 changes: 21 additions & 21 deletions sbom/examples/rpm/openssl-3.0.7-18.el9_2.spdx.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@
{
"referenceCategory": "PACKAGE-MANAGER",
"referenceType": "purl",
"referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=src"
"referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=src&checksum=9215c64e7289a058248728089e4d98ed1cc392bb5eb9b8fcbe661d57e8145bbd"
}
],
"checksums": [
Expand Down Expand Up @@ -85,7 +85,7 @@
{
"referenceCategory": "PACKAGE-MANAGER",
"referenceType": "purl",
"referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=aarch64"
"referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=aarch64&checksum=fbdd94bb6ce796441e4d4b9b04a960b41f6f7577e51c764e2befe9226e71da4b"
}
],
"checksums": [
Expand All @@ -107,7 +107,7 @@
{
"referenceCategory": "PACKAGE-MANAGER",
"referenceType": "purl",
"referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=aarch64"
"referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=aarch64&checksum=832757f9bcb231e954fb390b835fb833b9046594aa3c6387eeaadd9af592f40f"
}
],
"checksums": [
Expand All @@ -129,7 +129,7 @@
{
"referenceCategory": "PACKAGE-MANAGER",
"referenceType": "purl",
"referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=aarch64"
"referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=aarch64&checksum=9538011195d4997d7be4bba8cd01473abbf50e397dea06b6545d1d5fbd04817d"
}
],
"checksums": [
Expand All @@ -151,7 +151,7 @@
{
"referenceCategory": "PACKAGE-MANAGER",
"referenceType": "purl",
"referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=aarch64"
"referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=aarch64&checksum=af7342cf0b04d24e8055f364d67afd705fbb94c7ec2460999a59cacfdf554920"
}
],
"checksums": [
Expand All @@ -173,7 +173,7 @@
{
"referenceCategory": "PACKAGE-MANAGER",
"referenceType": "purl",
"referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=ppc64le"
"referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=ppc64le&checksum=bf63da42704f9da1e9eeefab808900f521a357b9a07433c0973965a02a2bb915"
}
],
"checksums": [
Expand All @@ -195,7 +195,7 @@
{
"referenceCategory": "PACKAGE-MANAGER",
"referenceType": "purl",
"referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=ppc64le"
"referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=ppc64le&checksum=71cb34e11fa6bda16512f0dbb314ac761348cf907b3e49fa54c7576305ed6afb"
}
],
"checksums": [
Expand All @@ -217,7 +217,7 @@
{
"referenceCategory": "PACKAGE-MANAGER",
"referenceType": "purl",
"referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=ppc64le"
"referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=ppc64le&checksum=36d11f2f192aef3abf391e4cf6699a24a303f09d68b2477595bb12af82b26e48"
}
],
"checksums": [
Expand All @@ -239,7 +239,7 @@
{
"referenceCategory": "PACKAGE-MANAGER",
"referenceType": "purl",
"referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=ppc64le"
"referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=ppc64le&checksum=c96d6029cfa0e6a01c4419c154cbf98c08ab9bb69cc756d81350ab77b4d1f44c"
}
],
"checksums": [
Expand All @@ -261,7 +261,7 @@
{
"referenceCategory": "PACKAGE-MANAGER",
"referenceType": "purl",
"referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=i686"
"referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=i686&checksum=69e098aceca261b8cdd127b78c90868d40d39c3cb94e37b07703b3f7a85f832f"
}
],
"checksums": [
Expand All @@ -283,7 +283,7 @@
{
"referenceCategory": "PACKAGE-MANAGER",
"referenceType": "purl",
"referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=i686"
"referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=i686&checksum=689777a4cc483b0cbb3757da0e3274b49d6e697f8174405df415e0018cef7646"
}
],
"checksums": [
Expand All @@ -305,7 +305,7 @@
{
"referenceCategory": "PACKAGE-MANAGER",
"referenceType": "purl",
"referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=i686"
"referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=i686&checksum=9b529f697702037b712e81778fa4e222d385568e4b3be167e6e42431a3270bfd"
}
],
"checksums": [
Expand All @@ -327,7 +327,7 @@
{
"referenceCategory": "PACKAGE-MANAGER",
"referenceType": "purl",
"referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=i686"
"referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=i686&checksum=0bc733036256ec160b8ca5ed6bc1082e4d4c15f84cf6ff141f02d8e45d73b4b8"
}
],
"checksums": [
Expand All @@ -349,7 +349,7 @@
{
"referenceCategory": "PACKAGE-MANAGER",
"referenceType": "purl",
"referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=x86_64"
"referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=x86_64&checksum=b2fe5b3a9230446e6e8119cd24eef1bee107b8d5ac37d2c5442d524bf5745a4e"
}
],
"checksums": [
Expand All @@ -371,7 +371,7 @@
{
"referenceCategory": "PACKAGE-MANAGER",
"referenceType": "purl",
"referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=x86_64"
"referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=x86_64&checksum=0cb4cd2487dcbc2c0d97ded42f7998ff5f27c6e38ad40b204cce1e22c9966148"
}
],
"checksums": [
Expand All @@ -393,7 +393,7 @@
{
"referenceCategory": "PACKAGE-MANAGER",
"referenceType": "purl",
"referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=x86_64"
"referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=x86_64&checksum=82b40f3403399fc808bd26f1a91edb7855e8f10087b925651001c17cb17a38ed"
}
],
"checksums": [
Expand All @@ -415,7 +415,7 @@
{
"referenceCategory": "PACKAGE-MANAGER",
"referenceType": "purl",
"referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=x86_64"
"referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=x86_64&checksum=0af316c88f24a4a3df742376b8875c89137acec5df2b40717dcc3d81789f52f0"
}
],
"checksums": [
Expand All @@ -437,7 +437,7 @@
{
"referenceCategory": "PACKAGE-MANAGER",
"referenceType": "purl",
"referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=s390x"
"referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=s390x&checksum=3a92cded871cffdb2290d078fe4cf300bc9d74fd0af612a607898d9b6c7967fd"
}
],
"checksums": [
Expand All @@ -459,7 +459,7 @@
{
"referenceCategory": "PACKAGE-MANAGER",
"referenceType": "purl",
"referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=s390x"
"referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=s390x&checksum=1c4e7f767b47e9dd36f00c1c213328ab84f0c1516d17b17f068eadefd5cc706d"
}
],
"checksums": [
Expand All @@ -481,7 +481,7 @@
{
"referenceCategory": "PACKAGE-MANAGER",
"referenceType": "purl",
"referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=s390x"
"referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=s390x&checksum=c99bf4a5bf29434baca2e30e40fc9f6c7152ec9c372a48b79dbc9294d08a7774"
}
],
"checksums": [
Expand All @@ -503,7 +503,7 @@
{
"referenceCategory": "PACKAGE-MANAGER",
"referenceType": "purl",
"referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=s390x"
"referenceLocator": "pkg:rpm/redhat/[email protected]_2?arch=s390x&checksum=fe1ef3b6550b1f4153ac2d280f84d46bb36bb63a11ddaec7f76ff7fc0770d2db"
}
],
"checksums": [
Expand Down
Loading