Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add SPDX format support for SBOM #608

Open
wants to merge 5 commits into
base: main
Choose a base branch
from
Open

Add SPDX format support for SBOM #608

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
2eb50b7
SPDX initial implementation
midnightercz Aug 22, 2024
ac0525b
Moving merge_outputs again to prevent a loop
a-ovchinnikov Dec 25, 2024
66ca765
SPDX restructuring: initial step
a-ovchinnikov Dec 8, 2024
e2daf82
SPDX rework: additional code cleanup
a-ovchinnikov Dec 24, 2024
7b109d1
SPDX: Making packages more unique
a-ovchinnikov Jan 6, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions cachi2/core/models/output.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,7 @@
import pydantic

from cachi2.core.errors import Cachi2Error
from cachi2.core.models.property_semantics import merge_component_properties
from cachi2.core.models.sbom import Component, Sbom
from cachi2.core.models.sbom import Component, Sbom, merge_component_properties
from cachi2.core.models.validators import unique_sorted

log = logging.getLogger(__name__)
Expand Down
30 changes: 15 additions & 15 deletions cachi2/core/models/property_semantics.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,27 +1,27 @@
import functools
from dataclasses import dataclass, field
from itertools import groupby
from typing import TYPE_CHECKING, Iterable, Optional
from typing import TYPE_CHECKING, Iterable, Literal, Optional

import pydantic

if TYPE_CHECKING:
from typing_extensions import Self, assert_never

from cachi2.core.models.sbom import Component, Property

PropertyName = Literal[
"cachi2:bundler:package:binary",
"cachi2:found_by",
"cachi2:missing_hash:in_file",
"cachi2:pip:package:binary",
"cdx:npm:package:bundled",
"cdx:npm:package:development",
]

def merge_component_properties(components: Iterable[Component]) -> list[Component]:
"""Sort and de-duplicate components while merging their `properties`."""
components = sorted(components, key=Component.key)
grouped_components = groupby(components, key=Component.key)

def merge_component_group(component_group: Iterable[Component]) -> Component:
component_group = list(component_group)
prop_sets = (PropertySet.from_properties(c.properties) for c in component_group)
merged_prop_set = functools.reduce(PropertySet.merge, prop_sets)
component = component_group[0]
return component.model_copy(update={"properties": merged_prop_set.to_properties()})
class Property(pydantic.BaseModel):
"""A property inside an SBOM component."""
Comment on lines +10 to +20
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This hunk isn't strictly SPDX related, is it? IOW Could we introduce it at the beginning of the series so that reviewers can see it and forget about it as they go through the PR?


return [merge_component_group(g) for _, g in grouped_components]
name: PropertyName
value: str


@dataclass(frozen=True)
Expand Down
Loading
Loading