Merge pull request #124 from TheGrizzlyDev/introduce-workspace-sbom-g…

…enerator

Introduce workspace SBOM generator

tools/BUILD

@@ -14,7 +14,7 @@
 
 """License declaration and compliance checking tools."""
 
-load("@rules_python//python:defs.bzl", "py_binary")
+load("@rules_python//python:defs.bzl", "py_binary", "py_library")
 
 package(
     default_applicable_licenses = ["//:license", "//:package_info"],
@@ -38,9 +38,24 @@ py_binary(
     visibility = ["//visibility:public"],
 )
 
+py_library(
+    name = "sbom_lib",
+    srcs = ["sbom.py"],
+    visibility = ["//visibility:public"],
+)
+
 py_binary(
     name = "write_sbom",
     srcs = ["write_sbom.py"],
+    deps = [":sbom_lib"],
+    python_version = "PY3",
+    visibility = ["//visibility:public"],
+)
+
+py_binary(
+    name = "write_workspace_sbom",
+    srcs = ["write_workspace_sbom.py"],
+    deps = [":sbom_lib"],
     python_version = "PY3",
     visibility = ["//visibility:public"],
 )

tools/sbom.py

@@ -0,0 +1,51 @@
+import datetime
+import getpass
+import json
+
+
+class SBOMWriter:
+    def __init__(self, tool, out):
+        self.out = out
+        self.tool = tool
+
+    def write_header(self, package):
+        header = [
+            'SPDXVersion: SPDX-2.2',
+            'DataLicense: CC0-1.0',
+            'SPDXID: SPDXRef-DOCUMENT',
+            'DocumentName: %s' % package,
+            # TBD
+            # 'DocumentNamespace: https://swinslow.net/spdx-examples/example1/hello-v3
+            'Creator: Person: %s' % getpass.getuser(),
+            'Creator: Tool: %s' % self.tool,
+            datetime.datetime.utcnow().strftime('Created: %Y-%m-%d-%H:%M:%SZ'),
+            '',
+            '##### Package: %s' % package,
+        ]
+        self.out.write('\n'.join(header))
+
+    def write_packages(self, packages):
+        for p in packages:
+            name = p.get('package_name') or '<unknown>'
+            self.out.write('\n')
+            self.out.write('SPDXID: "%s"\n' % name)
+            self.out.write('  name: "%s"\n' % name)
+
+            if p.get('package_version'):
+                self.out.write('  versionInfo: "%s"\n' % p['package_version'])
+
+            # IGNORE_COPYRIGHT: Not a copyright notice. It is a variable holding one.
+            cn = p.get('copyright_notice')
+            if cn:
+                self.out.write('  copyrightText: "%s"\n' % cn)
+
+            kinds = p.get('license_kinds')
+            if kinds:
+                self.out.write('  licenseDeclared: "%s"\n' %
+                    ','.join([k['name'] for k in kinds]))
+
+            url = p.get('package_url')
+            if url:
+                self.out.write('  downloadLocation: %s\n' % url)
+
+

tools/write_sbom.py

@@ -20,62 +20,15 @@
 
 import argparse
 import codecs
-import datetime
-import getpass
 import json
-
+import sbom
 
 TOOL = 'https//github.com/bazelbuild/rules_license/tools:write_sbom'
 
 def _load_package_data(package_info):
   with codecs.open(package_info, encoding='utf-8') as inp:
     return json.loads(inp.read())
 
-def _write_sbom_header(out, package):
-  header = [
-    'SPDXVersion: SPDX-2.2',
-    'DataLicense: CC0-1.0',
-    'SPDXID: SPDXRef-DOCUMENT',
-    'DocumentName: %s' % package,
-    # TBD
-    # 'DocumentNamespace: https://swinslow.net/spdx-examples/example1/hello-v3
-    'Creator: Person: %s' % getpass.getuser(),
-    'Creator: Tool: %s' % TOOL,
-    datetime.datetime.utcnow().strftime('Created: %Y-%m-%d-%H:%M:%SZ'),
-    '',
-    '##### Package: %s' % package,
-  ]
-  out.write('\n'.join(header))
-
-
-
-def _write_sbom(out, packages):
-  """Produce a basic SBOM
-
-  Args:
-    out: file object to write to
-    packages: package metadata. A big blob of JSON.
-  """
-  for p in packages:
-    name = p.get('package_name') or '<unknown>'
-    out.write('\n')
-    out.write('SPDXID: "%s"\n' % name)
-    out.write('  name: "%s"\n' % name)
-    if p.get('package_version'):
-      out.write('  versionInfo: "%s"\n' % p['package_version'])
-    # IGNORE_COPYRIGHT: Not a copyright notice. It is a variable holding one.
-    cn = p.get('copyright_notice')
-    if cn:
-      out.write('  copyrightText: "%s"\n' % cn)
-    kinds = p.get('license_kinds')
-    if kinds:
-      out.write('  licenseDeclared: "%s"\n' %
-                ','.join([k['name'] for k in kinds]))
-    url = p.get('package_url')
-    if url:
-      out.write('  downloadLocation: %s\n' % url)
-
-
 def main():
   parser = argparse.ArgumentParser(
       description='Demonstraton license compliance checker')
@@ -106,11 +59,10 @@ def main():
     else:
       all[pi['bazel_package']] = pi
 
-  err = 0
   with codecs.open(args.out, mode='w', encoding='utf-8') as out:
-    _write_sbom_header(out, package=top_level_target)
-    _write_sbom(out, all.values())
-  return err
+    sbom_writer = sbom.SBOMWriter(TOOL, out)
+    sbom_writer.write_header(package=top_level_target)
+    sbom_writer.write_packages(packages=all.values())
 
 
 if __name__ == '__main__':

tools/write_workspace_sbom.py

@@ -0,0 +1,76 @@
+#!/usr/bin/env python3
+# Copyright 2020 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Proof of a WORKSPACE SBOM generator.
+
+This is only a demonstration. It will be replaced with other tools.
+"""
+
+import argparse
+import codecs
+import json
+import sbom
+import subprocess
+import os
+
+TOOL = 'https//github.com/bazelbuild/rules_license/tools:write_workspace_sbom'
+
+def main():
+    parser = argparse.ArgumentParser(
+      description='Demonstraton license compliance checker')
+
+    parser.add_argument('--out', default='sbom.out', help='SBOM output')
+    args = parser.parse_args()
+
+    if "BUILD_WORKING_DIRECTORY" in os.environ:
+        os.chdir(os.environ["BUILD_WORKING_DIRECTORY"])
+
+    external_query_process = subprocess.run(
+        ['bazel', 'query', '--output', 'streamed_jsonproto', '//external:*'],
+        stdout=subprocess.PIPE,
+    )
+    sbom_packages = []
+    for dep_string in external_query_process.stdout.decode('utf-8').splitlines():
+        dep = json.loads(dep_string)
+        if dep["type"] != "RULE":
+            continue
+
+        rule = dep["rule"]
+        if rule["ruleClass"] == "http_archive":
+            sbom_package = {}
+            sbom_packages.append(sbom_package)
+
+            if "attribute" not in rule:
+                continue
+
+            attributes = {attribute["name"]: attribute for attribute in rule["attribute"]}
+
+            if "name" in attributes:
+                sbom_package["package_name"] = attributes["name"]["stringValue"]
+
+            if "url" in attributes:
+                sbom_package["package_url"] = attributes["url"]["stringValue"]
+            elif "urls" in attributes:
+                urls = attributes["urls"]["stringListValue"]
+                if urls and len(urls) > 0:
+                    sbom_package["package_url"] = attributes["urls"]["stringListValue"][0]
+
+    with codecs.open(args.out, mode='w', encoding='utf-8') as out:
+        sbom_writer = sbom.SBOMWriter(TOOL, out)
+        sbom_writer.write_header(package="Bazel's Workspace SBOM")
+        sbom_writer.write_packages(packages=sbom_packages)
+
+if __name__ == '__main__':
+  main()