1#!/usr/bin/env python3
2#
3# Copyright (C) 2023 The Android Open Source Project
4#
5# Licensed under the Apache License, Version 2.0 (the "License");
6# you may not use this file except in compliance with the License.
7# You may obtain a copy of the License at
8#
9#      http://www.apache.org/licenses/LICENSE-2.0
10#
11# Unless required by applicable law or agreed to in writing, software
12# distributed under the License is distributed on an "AS IS" BASIS,
13# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14# See the License for the specific language governing permissions and
15# limitations under the License.
16
17import hashlib
18import unittest
19import sbom_data
20
21BUILD_FINGER_PRINT = 'build_finger_print'
22SUPPLIER_GOOGLE = 'Organization: Google'
23SUPPLIER_UPSTREAM = 'Organization: upstream'
24
25SPDXID_PREBUILT_PACKAGE1 = 'SPDXRef-PREBUILT-package1'
26SPDXID_SOURCE_PACKAGE1 = 'SPDXRef-SOURCE-package1'
27SPDXID_UPSTREAM_PACKAGE1 = 'SPDXRef-UPSTREAM-package1'
28
29SPDXID_FILE1 = 'SPDXRef-file1'
30SPDXID_FILE2 = 'SPDXRef-file2'
31SPDXID_FILE3 = 'SPDXRef-file3'
32SPDXID_FILE4 = 'SPDXRef-file4'
33
34
35class SBOMDataTest(unittest.TestCase):
36
37  def setUp(self):
38    # SBOM of a product
39    self.sbom_doc = sbom_data.Document(name='test doc',
40                                       namespace='http://www.google.com/sbom/spdx/android',
41                                       creators=[SUPPLIER_GOOGLE],
42                                       created='2023-03-31T22:17:58Z',
43                                       describes=sbom_data.SPDXID_PRODUCT)
44    self.sbom_doc.add_external_ref(
45        sbom_data.DocumentExternalReference(id='DocumentRef-external_doc_ref',
46                                            uri='external_doc_uri',
47                                            checksum='SHA1: 1234567890'))
48    self.sbom_doc.add_package(
49        sbom_data.Package(id=sbom_data.SPDXID_PRODUCT,
50                          name=sbom_data.PACKAGE_NAME_PRODUCT,
51                          download_location=sbom_data.VALUE_NONE,
52                          supplier=SUPPLIER_GOOGLE,
53                          version=BUILD_FINGER_PRINT,
54                          files_analyzed=True,
55                          verification_code='',
56                          file_ids=[SPDXID_FILE1, SPDXID_FILE2, SPDXID_FILE3, SPDXID_FILE4]))
57
58    self.sbom_doc.add_package(
59        sbom_data.Package(id=sbom_data.SPDXID_PLATFORM,
60                          name=sbom_data.PACKAGE_NAME_PLATFORM,
61                          download_location=sbom_data.VALUE_NONE,
62                          supplier=SUPPLIER_GOOGLE,
63                          version=BUILD_FINGER_PRINT,
64                          ))
65
66    self.sbom_doc.add_package(
67        sbom_data.Package(id=SPDXID_PREBUILT_PACKAGE1,
68                          name='Prebuilt package1',
69                          download_location=sbom_data.VALUE_NONE,
70                          supplier=SUPPLIER_GOOGLE,
71                          version=BUILD_FINGER_PRINT,
72                          ))
73
74    self.sbom_doc.add_package(
75        sbom_data.Package(id=SPDXID_SOURCE_PACKAGE1,
76                          name='Source package1',
77                          download_location=sbom_data.VALUE_NONE,
78                          supplier=SUPPLIER_GOOGLE,
79                          version=BUILD_FINGER_PRINT,
80                          external_refs=[sbom_data.PackageExternalRef(
81                              category=sbom_data.PackageExternalRefCategory.SECURITY,
82                              type=sbom_data.PackageExternalRefType.cpe22Type,
83                              locator='cpe:/a:jsoncpp_project:jsoncpp:1.9.4')]
84                          ))
85
86    self.sbom_doc.add_package(
87        sbom_data.Package(id=SPDXID_UPSTREAM_PACKAGE1,
88                          name='Upstream package1',
89                          supplier=SUPPLIER_UPSTREAM,
90                          version='1.1',
91                          ))
92
93    self.sbom_doc.add_relationship(sbom_data.Relationship(id1=SPDXID_SOURCE_PACKAGE1,
94                                                          relationship=sbom_data.RelationshipType.VARIANT_OF,
95                                                          id2=SPDXID_UPSTREAM_PACKAGE1))
96
97    self.sbom_doc.files.append(
98        sbom_data.File(id=SPDXID_FILE1, name='/bin/file1',
99                       checksum='SHA1: 356a192b7913b04c54574d18c28d46e6395428ab'))  # sha1 hash of 1
100    self.sbom_doc.files.append(
101        sbom_data.File(id=SPDXID_FILE2, name='/bin/file2',
102                       checksum='SHA1: da4b9237bacccdf19c0760cab7aec4a8359010b0'))  # sha1 hash of 2
103    self.sbom_doc.files.append(
104        sbom_data.File(id=SPDXID_FILE3, name='/bin/file3',
105                       checksum='SHA1: 77de68daecd823babbb58edb1c8e14d7106e83bb'))  # sha1 hash of 3
106    self.sbom_doc.files.append(
107        sbom_data.File(id=SPDXID_FILE4, name='file4.a',
108                       checksum='SHA1: 1b6453892473a467d07372d45eb05abc2031647a'))  # sha1 of 4
109
110    self.sbom_doc.add_relationship(sbom_data.Relationship(id1=SPDXID_FILE1,
111                                                          relationship=sbom_data.RelationshipType.GENERATED_FROM,
112                                                          id2=sbom_data.SPDXID_PLATFORM))
113    self.sbom_doc.add_relationship(sbom_data.Relationship(id1=SPDXID_FILE2,
114                                                          relationship=sbom_data.RelationshipType.GENERATED_FROM,
115                                                          id2=SPDXID_PREBUILT_PACKAGE1))
116    self.sbom_doc.add_relationship(sbom_data.Relationship(id1=SPDXID_FILE3,
117                                                          relationship=sbom_data.RelationshipType.GENERATED_FROM,
118                                                          id2=SPDXID_SOURCE_PACKAGE1
119                                                          ))
120    self.sbom_doc.add_relationship(sbom_data.Relationship(id1=SPDXID_FILE1,
121                                                          relationship=sbom_data.RelationshipType.STATIC_LINK,
122                                                          id2=SPDXID_FILE4
123                                                          ))
124
125  def test_package_verification_code(self):
126    checksums = []
127    for file in self.sbom_doc.files:
128      checksums.append(file.checksum.split(': ')[1])
129      checksums.sort()
130    h = hashlib.sha1()
131    h.update(''.join(checksums).encode(encoding='utf-8'))
132    expected_package_verification_code = h.hexdigest()
133
134    self.sbom_doc.generate_packages_verification_code()
135    self.assertEqual(expected_package_verification_code, self.sbom_doc.packages[0].verification_code)
136
137
138if __name__ == '__main__':
139  unittest.main(verbosity=2)
140