f1c43ae5bd
Rename the function for consistency reason. The parent package is named SBOM (originally BOM). Signed-off-by: Tomáš Hozza <thozza@redhat.com>
76 lines
3.5 KiB
Python
76 lines
3.5 KiB
Python
import os
|
|
|
|
import pytest
|
|
|
|
import osbuild
|
|
from osbuild.util.sbom.spdx import create_spdx2_document, sbom_pkgset_to_spdx2_doc, spdx2_checksum_algorithm
|
|
from osbuild.util.sbom.spdx2.model import CreatorType, ExternalPackageRefCategory, RelationshipType
|
|
|
|
testutil_dnf4 = pytest.importorskip("osbuild.testutil.dnf4")
|
|
bom_dnf = pytest.importorskip("osbuild.util.sbom.dnf")
|
|
|
|
|
|
def test_create_spdx2_document():
|
|
doc1 = create_spdx2_document()
|
|
|
|
assert doc1.creation_info.spdx_version == "SPDX-2.3"
|
|
assert doc1.creation_info.spdx_id == "SPDXRef-DOCUMENT"
|
|
assert doc1.creation_info.name == f"sbom-by-osbuild-{osbuild.__version__}"
|
|
assert doc1.creation_info.data_license == "CC0-1.0"
|
|
assert doc1.creation_info.document_namespace.startswith("https://osbuild.org/spdxdocs/sbom-by-osbuild-")
|
|
assert len(doc1.creation_info.creators) == 1
|
|
assert doc1.creation_info.creators[0].creator_type == CreatorType.TOOL
|
|
assert doc1.creation_info.creators[0].name == f"osbuild-{osbuild.__version__}"
|
|
assert doc1.creation_info.created
|
|
|
|
doc2 = create_spdx2_document()
|
|
assert doc1.creation_info.document_namespace != doc2.creation_info.document_namespace
|
|
assert doc1.creation_info.created != doc2.creation_info.created
|
|
|
|
doc1_dict = doc1.to_dict()
|
|
doc2_dict = doc2.to_dict()
|
|
del doc1_dict["creationInfo"]["created"]
|
|
del doc2_dict["creationInfo"]["created"]
|
|
del doc1_dict["documentNamespace"]
|
|
del doc2_dict["documentNamespace"]
|
|
assert doc1_dict == doc2_dict
|
|
|
|
|
|
def test_sbom_pkgset_to_spdx2_doc():
|
|
dnf_pkgset = testutil_dnf4.depsolve_pkgset([os.path.abspath("./test/data/testrepos/baseos")], ["bash"])
|
|
bom_pkgset = bom_dnf.dnf_pkgset_to_sbom_pkgset(dnf_pkgset)
|
|
doc = sbom_pkgset_to_spdx2_doc(bom_pkgset)
|
|
|
|
assert len(doc.packages) == len(bom_pkgset)
|
|
for spdx_pkg, bom_pkg in zip(doc.packages, bom_pkgset):
|
|
assert spdx_pkg.spdx_id == f"SPDXRef-{bom_pkg.uuid()}"
|
|
assert spdx_pkg.name == bom_pkg.name
|
|
assert spdx_pkg.version == bom_pkg.version
|
|
assert not spdx_pkg.files_analyzed
|
|
assert spdx_pkg.license_declared == bom_pkg.license_declared
|
|
assert spdx_pkg.download_location == bom_pkg.download_url
|
|
assert spdx_pkg.homepage == bom_pkg.homepage
|
|
assert spdx_pkg.summary == bom_pkg.summary
|
|
assert spdx_pkg.description == bom_pkg.description
|
|
assert spdx_pkg.source_info == bom_pkg.source_info()
|
|
assert spdx_pkg.built_date == bom_pkg.build_date
|
|
|
|
assert len(spdx_pkg.checksums) == 1
|
|
assert spdx_pkg.checksums[0].algorithm == spdx2_checksum_algorithm(list(bom_pkg.checksums.keys())[0])
|
|
assert spdx_pkg.checksums[0].value == list(bom_pkg.checksums.values())[0]
|
|
|
|
assert len(spdx_pkg.external_references) == 1
|
|
assert spdx_pkg.external_references[0].category == ExternalPackageRefCategory.PACKAGE_MANAGER
|
|
assert spdx_pkg.external_references[0].reference_type == "purl"
|
|
assert spdx_pkg.external_references[0].locator == bom_pkg.purl()
|
|
|
|
assert len([rel for rel in doc.relationships if rel.relationship_type ==
|
|
RelationshipType.DESCRIBES]) == len(bom_pkgset)
|
|
|
|
deps_count = sum(len(bom_pkg.depends_on) for bom_pkg in bom_pkgset)
|
|
assert len([rel for rel in doc.relationships if rel.relationship_type ==
|
|
RelationshipType.DEPENDS_ON]) == deps_count
|
|
|
|
optional_deps_count = sum(len(bom_pkg.optional_depends_on) for bom_pkg in bom_pkgset)
|
|
assert len([rel for rel in doc.relationships if rel.relationship_type ==
|
|
RelationshipType.OPTIONAL_DEPENDENCY_OF]) == optional_deps_count
|