1#!/usr/bin/env python3 2# 3# Copyright (C) 2023 The Android Open Source Project 4# 5# Licensed under the Apache License, Version 2.0 (the "License"); 6# you may not use this file except in compliance with the License. 7# You may obtain a copy of the License at 8# 9# http://www.apache.org/licenses/LICENSE-2.0 10# 11# Unless required by applicable law or agreed to in writing, software 12# distributed under the License is distributed on an "AS IS" BASIS, 13# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 14# See the License for the specific language governing permissions and 15# limitations under the License. 16 17import argparse 18import hashlib 19import json 20import sbom_data 21import sbom_writers 22 23''' 24This script generates SBOM of framework_res.jar of layoutlib shipped with Android Studio. 25 26The generated SBOM contains some placeholders which should be substituted by release_layoutlib.sh. 27The placeholders include: document name, document namespace, organization, created timestamp and 28the SHA1 checksum of framework_res.jar. 29''' 30 31def get_args(): 32 parser = argparse.ArgumentParser() 33 parser.add_argument('-v', '--verbose', action='store_true', default=False, 34 help='Print more information.') 35 parser.add_argument('--output_file', required=True, 36 help='The generated SBOM file in SPDX format.') 37 parser.add_argument('--layoutlib_sbom', required=True, 38 help='The file path of the SBOM of layoutlib.') 39 40 return parser.parse_args() 41 42 43def main(): 44 global args 45 args = get_args() 46 47 doc = sbom_data.Document(name='<name>', 48 namespace='<namespace>', 49 creators=['Organization: <organization>'], 50 created='<created>') 51 52 filename = 'data/framework_res.jar' 53 file_id = f'SPDXRef-{sbom_data.encode_for_spdxid(filename)}' 54 file = sbom_data.File(id=file_id, name=filename, checksum='SHA1: <checksum>') 55 56 package_name = 'framework_res' 57 package_id = f'SPDXRef-PREBUILT-{sbom_data.encode_for_spdxid(package_name)}' 58 package = sbom_data.Package(id=package_id, name=package_name, version='<package_version>', 59 download_location=sbom_data.VALUE_NONE, 60 supplier='Organization: <organization>', 61 files_analyzed=True, 62 verification_code='<package_verification_code>') 63 package.file_ids.append(file_id) 64 65 doc.packages.append(package) 66 doc.files.append(file) 67 doc.describes = package_id 68 69 with open(args.layoutlib_sbom, 'r', encoding='utf-8') as f: 70 layoutlib_sbom = json.load(f) 71 72 with open(args.layoutlib_sbom, 'rb') as f: 73 sha1 = hashlib.file_digest(f, 'sha1') 74 75 layoutlib_sbom_namespace = layoutlib_sbom[sbom_writers.PropNames.DOCUMENT_NAMESPACE] 76 external_doc_ref = 'DocumentRef-layoutlib' 77 doc.external_refs = [ 78 sbom_data.DocumentExternalReference(external_doc_ref, layoutlib_sbom_namespace, 79 f'SHA1: {sha1.hexdigest()}')] 80 81 resource_file_spdxids = [] 82 for file in layoutlib_sbom[sbom_writers.PropNames.FILES]: 83 file_path = file[sbom_writers.PropNames.FILE_NAME] 84 if file_path.startswith('data/res/') or file_path.startswith('data/overlays/'): 85 resource_file_spdxids.append(file[sbom_writers.PropNames.SPDXID]) 86 87 doc.relationships = [ 88 sbom_data.Relationship(package_id, sbom_data.RelationshipType.CONTAINS, file_id) 89 ] 90 for spdxid in resource_file_spdxids: 91 doc.relationships.append( 92 sbom_data.Relationship(file_id, sbom_data.RelationshipType.GENERATED_FROM, 93 f'{external_doc_ref}:{spdxid}')) 94 95 # write sbom file 96 with open(args.output_file, 'w', encoding='utf-8') as f: 97 sbom_writers.JSONWriter.write(doc, f) 98 99 100if __name__ == '__main__': 101 main() 102