137 lines
4.4 KiB
Python
137 lines
4.4 KiB
Python
# Copyright 2022 Google LLC
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# https://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
"""SBOM generation"""
|
|
|
|
load(
|
|
"@rules_license//rules:gather_metadata.bzl",
|
|
"gather_metadata_info",
|
|
"gather_metadata_info_and_write",
|
|
"write_metadata_info",
|
|
)
|
|
load(
|
|
"@rules_license//rules/private:gathering_providers.bzl",
|
|
"TransitiveLicensesInfo",
|
|
)
|
|
|
|
# This rule is proof of concept, and may not represent the final
|
|
# form of a rule for compliance validation.
|
|
def _generate_sbom_impl(ctx):
|
|
# Gather all licenses and write information to one place
|
|
|
|
licenses_file = ctx.actions.declare_file("_%s_licenses_info.json" % ctx.label.name)
|
|
write_metadata_info(ctx, ctx.attr.deps, licenses_file)
|
|
|
|
# Now turn the big blob of data into something consumable.
|
|
inputs = [licenses_file]
|
|
outputs = [ctx.outputs.out]
|
|
args = ctx.actions.args()
|
|
args.add("--licenses_info", licenses_file.path)
|
|
args.add("--out", ctx.outputs.out.path)
|
|
ctx.actions.run(
|
|
mnemonic = "CreateSBOM",
|
|
progress_message = "Creating SBOM for %s" % ctx.label,
|
|
inputs = inputs,
|
|
outputs = outputs,
|
|
executable = ctx.executable._sbom_generator,
|
|
arguments = [args],
|
|
)
|
|
outputs.append(licenses_file) # also make the json file available.
|
|
return [DefaultInfo(files = depset(outputs))]
|
|
|
|
_generate_sbom = rule(
|
|
implementation = _generate_sbom_impl,
|
|
attrs = {
|
|
"deps": attr.label_list(
|
|
aspects = [gather_metadata_info],
|
|
),
|
|
"out": attr.output(mandatory = True),
|
|
"_sbom_generator": attr.label(
|
|
default = Label("@rules_license//tools:write_sbom"),
|
|
executable = True,
|
|
allow_files = True,
|
|
cfg = "exec",
|
|
),
|
|
},
|
|
)
|
|
|
|
def generate_sbom(**kwargs):
|
|
_generate_sbom(**kwargs)
|
|
|
|
def _manifest_impl(ctx):
|
|
# Gather all licenses and make it available as deps for downstream rules
|
|
# Additionally write the list of license filenames to a file that can
|
|
# also be used as an input to downstream rules.
|
|
licenses_file = ctx.actions.declare_file(ctx.attr.out.name)
|
|
mappings = get_licenses_mapping(ctx.attr.deps, ctx.attr.warn_on_legacy_licenses)
|
|
ctx.actions.write(
|
|
output = licenses_file,
|
|
content = "\n".join([",".join([f.path, p]) for (f, p) in mappings.items()]),
|
|
)
|
|
return [DefaultInfo(files = depset(mappings.keys()))]
|
|
|
|
_manifest = rule(
|
|
implementation = _manifest_impl,
|
|
doc = """Internal tmplementation method for manifest().""",
|
|
attrs = {
|
|
"deps": attr.label_list(
|
|
doc = """List of targets to collect license files for.""",
|
|
aspects = [gather_metadata_info],
|
|
),
|
|
"out": attr.output(
|
|
doc = """Output file.""",
|
|
mandatory = True,
|
|
),
|
|
"warn_on_legacy_licenses": attr.bool(default = False),
|
|
},
|
|
)
|
|
|
|
def manifest(name, deps, out = None, **kwargs):
|
|
if not out:
|
|
out = name + ".manifest"
|
|
|
|
_manifest(name = name, deps = deps, out = out, **kwargs)
|
|
|
|
def get_licenses_mapping(deps, warn = False):
|
|
"""Creates list of entries representing all licenses for the deps.
|
|
|
|
Args:
|
|
|
|
deps: a list of deps which should have TransitiveLicensesInfo providers.
|
|
This requires that you have run the gather_licenses_info
|
|
aspect over them
|
|
|
|
warn: boolean, if true, display output about legacy targets that need
|
|
update
|
|
|
|
Returns:
|
|
{File:package_name}
|
|
"""
|
|
tls = []
|
|
for dep in deps:
|
|
lds = dep[TransitiveLicensesInfo].licenses
|
|
tls.append(lds)
|
|
|
|
ds = depset(transitive = tls)
|
|
|
|
# Ignore any legacy licenses that may be in the report
|
|
mappings = {}
|
|
for lic in ds.to_list():
|
|
if type(lic.license_text) == "File":
|
|
mappings[lic.license_text] = lic.package_name
|
|
elif warn:
|
|
# buildifier: disable=print
|
|
print("Legacy license %s not included, rule needs updating" % lic.license_text)
|
|
|
|
return mappings
|