Coverage Report

Created: 2026-10-28 06:38

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/CMake/Source/cmSbomBuilder.cxx
Line
Count
Source
1
/* Distributed under the OSI-approved BSD 3-Clause License.  See accompanying
2
   file LICENSE.rst or https://cmake.org/licensing for details.  */
3
#include "cmSbomBuilder.h"
4
5
#include <algorithm>
6
#include <array>
7
#include <functional>
8
#include <map>
9
#include <memory>
10
#include <set>
11
#include <string>
12
#include <utility>
13
#include <vector>
14
15
#include <cm/optional>
16
#include <cmext/algorithm>
17
#include <cmext/string_view>
18
19
#include "cmArgumentParserTypes.h"
20
#include "cmDiagnostics.h"
21
#include "cmExportFileGenerator.h"
22
#include "cmExportSet.h"
23
#include "cmFindPackageStack.h"
24
#include "cmGeneratorExpression.h"
25
#include "cmGeneratorTarget.h"
26
#include "cmList.h"
27
#include "cmLocalGenerator.h"
28
#include "cmMakefile.h"
29
#include "cmMessageType.h"
30
#include "cmSbomArguments.h"
31
#include "cmSbomObject.h"
32
#include "cmSpdx.h"
33
#include "cmSpdxSerializer.h"
34
#include "cmStringAlgorithms.h"
35
#include "cmSystemTools.h"
36
#include "cmTarget.h"
37
#include "cmTargetExport.h"
38
#include "cmTargetTypes.h"
39
#include "cmValue.h"
40
41
cmSpdxPackage::PurposeId GetPurpose(cm::TargetType type)
42
0
{
43
0
  switch (type) {
44
0
    case cm::TargetType::EXECUTABLE:
45
0
      return cmSpdxPackage::PurposeId::APPLICATION;
46
0
    case cm::TargetType::STATIC_LIBRARY:
47
0
    case cm::TargetType::SHARED_LIBRARY:
48
0
    case cm::TargetType::MODULE_LIBRARY:
49
0
    case cm::TargetType::OBJECT_LIBRARY:
50
0
    case cm::TargetType::INTERFACE_LIBRARY:
51
0
      return cmSpdxPackage::PurposeId::LIBRARY;
52
0
    case cm::TargetType::UTILITY:
53
0
      return cmSpdxPackage::PurposeId::SOURCE;
54
0
    case cm::TargetType::GLOBAL_TARGET:
55
0
    case cm::TargetType::UNKNOWN_LIBRARY:
56
0
    default:
57
0
      return cmSpdxPackage::PurposeId::ARCHIVE;
58
0
  }
59
0
}
60
61
cmSbomBuilder::cmSbomBuilder(cmSbomArguments args,
62
                             std::vector<cmExportSet*> exportSets,
63
                             cmLocalGenerator* lg)
64
0
  : LocalGenerator(lg)
65
0
  , ExportSets(std::move(exportSets))
66
0
  , PackageName(std::move(args.PackageName))
67
0
  , Namespace(cmStrCat(this->PackageName, "::"_s))
68
0
  , PackageVersion(std::move(args.Version))
69
0
  , PackageDescription(std::move(args.Description))
70
0
  , PackageWebsite(std::move(args.Website))
71
0
  , PackageUrl(std::move(args.PackageUrl))
72
0
  , DataLicense(std::move(args.DataLicense))
73
0
  , DefaultLicense(std::move(args.DefaultLicense))
74
0
  , PackageFormat(args.GetFormat())
75
0
{
76
0
}
77
78
std::set<cmGeneratorTarget const*> cmSbomBuilder::CollectTargets() const
79
0
{
80
0
  std::set<cmGeneratorTarget const*> targets;
81
0
  for (cmExportSet* exportSet : this->ExportSets) {
82
0
    for (auto const& te : exportSet->GetTargetExports()) {
83
0
      if (cmGeneratorTarget const* gt =
84
0
            this->LocalGenerator->FindGeneratorTargetToUse(te->TargetName)) {
85
0
        targets.emplace(gt);
86
0
      }
87
0
    }
88
0
  }
89
0
  return targets;
90
0
}
91
92
void cmSbomBuilder::Compute(cmLocalGenerator* lg)
93
0
{
94
0
  this->LocalGenerator = lg;
95
0
  if (!lg) {
96
0
    return;
97
0
  }
98
0
  for (cmExportSet* es : this->ExportSets) {
99
0
    es->Compute(lg);
100
0
  }
101
  // Populate the cache now (rather than at Generate time) so peer SBOMs can
102
  // query CoversTarget() during their own NoteLinkedTarget walks.
103
0
  this->SbomTargets = this->CollectTargets();
104
0
}
105
106
bool cmSbomBuilder::CoversTarget(cmGeneratorTarget const* target) const
107
0
{
108
0
  return cm::contains(this->SbomTargets, target);
109
0
}
110
111
bool cmSbomBuilder::CoversExportSet(cmExportSet const* set) const
112
0
{
113
0
  return std::find(this->ExportSets.cbegin(), this->ExportSets.cend(), set) !=
114
0
    this->ExportSets.cend();
115
0
}
116
117
bool cmSbomBuilder::GenerateForTargets(
118
  std::ostream& os, std::string const& config,
119
  cmGeneratorExpression::PreprocessContext preprocessContext)
120
0
{
121
0
  cmSbomDocument doc;
122
0
  doc.Graph.reserve(512);
123
124
0
  cmSpdxCreationInfo const* ci =
125
0
    insert_back(doc.Graph, this->GenerateCreationInfo());
126
0
  cmSpdxDocument* project = insert_back(doc.Graph, this->GenerateSbom(ci));
127
0
  std::vector<TargetProperties> targetProps;
128
0
  targetProps.reserve(this->SbomTargets.size());
129
130
0
  for (cmGeneratorTarget const* target : this->SbomTargets) {
131
0
    ImportPropertyMap properties;
132
0
    this->PopulateLinkLibrariesProperty(target, preprocessContext, properties);
133
0
    this->PopulateInterfaceLinkLibrariesProperty(target, preprocessContext,
134
0
                                                 properties);
135
0
    targetProps.push_back(TargetProperties{
136
0
      insert_back(project->RootElements,
137
0
                  this->GenerateImportTarget(ci, target)),
138
0
      target,
139
0
      std::move(properties),
140
0
    });
141
0
  }
142
143
0
  bool status = true;
144
0
  for (TargetProperties const& target : targetProps) {
145
0
    status &=
146
0
      this->GenerateProperties(doc, project, ci, target, targetProps, config);
147
0
  }
148
0
  if (status) {
149
0
    this->WriteSbom(doc, os);
150
0
  }
151
0
  return status;
152
0
}
153
154
void cmSbomBuilder::WriteSbom(cmSbomDocument& doc, std::ostream& os) const
155
0
{
156
0
  switch (this->PackageFormat) {
157
0
    case cmSbomArguments::SbomFormat::SPDX_3_0_JSON:
158
0
      cmSpdxSerializer{}.WriteSbom(os, cmSbomObject(doc));
159
0
      break;
160
0
    case cmSbomArguments::SbomFormat::NONE:
161
0
      break;
162
0
  }
163
0
}
164
165
bool cmSbomBuilder::AddPackageInformation(
166
  cmSpdxPackage& artifact, std::string const& name,
167
  cmPackageInformation const& package) const
168
0
{
169
0
  if (name.empty()) {
170
0
    return false;
171
0
  }
172
173
0
  cmSpdxOrganization org;
174
0
  org.SpdxId = cmStrCat("urn:", name, "#Organization");
175
0
  org.Name = name;
176
0
  org.CreationInfo = artifact.CreationInfo;
177
0
  artifact.OriginatedBy.emplace_back(std::move(org));
178
179
0
  if (package.Description) {
180
0
    artifact.Description = *package.Description;
181
0
  }
182
183
0
  if (package.Version) {
184
0
    artifact.PackageVersion = *package.Version;
185
0
  }
186
187
0
  if (package.PackageUrl) {
188
0
    artifact.PackageUrl = *package.PackageUrl;
189
0
  }
190
191
0
  if (package.License) {
192
0
    artifact.CopyrightText = *package.License;
193
0
  }
194
195
0
  artifact.BuiltTime = cmSystemTools::GetCurrentDateTime("%FT%TZ");
196
0
  cmSpdxExternalRef externalRef;
197
0
  externalRef.Locator = cmStrCat("cmake:find_package(", name, ')');
198
0
  externalRef.ExternalRefType = "buildSystem";
199
0
  return true;
200
0
}
201
202
cmSpdxCreationInfo cmSbomBuilder::GenerateCreationInfo() const
203
0
{
204
0
  cmSpdxCreationInfo ci;
205
0
  ci.SpdxId = "_:Build#CreationInfo";
206
0
  ci.Created = cmSystemTools::GetCurrentDateTime("%FT%TZ");
207
0
  ci.CreatedBy = { "https://gitlab.kitware.com/cmake/cmake" };
208
0
  ci.Comment = "This SBOM was generated from the CMakeLists.txt File";
209
0
  ci.SpecVersion = "3.0.1";
210
0
  return ci;
211
0
}
212
213
cmSpdxDocument cmSbomBuilder::GenerateSbom(cmSpdxCreationInfo const* ci) const
214
0
{
215
0
  cmSpdxDocument proj;
216
0
  proj.Name = PackageName;
217
0
  proj.SpdxId = cmStrCat("urn:", PackageName, "#SPDXDocument");
218
0
  proj.ProfileConformance = { "core", "software" };
219
0
  proj.CreationInfo = ci;
220
221
0
  if (!this->PackageDescription.empty()) {
222
0
    proj.Description = this->PackageDescription;
223
0
  }
224
225
0
  if (!this->DataLicense.empty()) {
226
0
    cmSpdxLicenseExpression license;
227
0
    license.SpdxId = cmStrCat("urn:", PackageName, "#LicenseExpression");
228
0
    license.CreationInfo = ci;
229
0
    license.LicenseExpression = this->DataLicense;
230
0
    proj.DataLicense = license;
231
0
  }
232
233
0
  return proj;
234
0
}
235
236
cmSpdxPackage cmSbomBuilder::GenerateImportTarget(
237
  cmSpdxCreationInfo const* ci, cmGeneratorTarget const* target) const
238
0
{
239
0
  cmSpdxPackage package;
240
0
  package.SpdxId = cmStrCat("urn:", target->GetName(), "#Package");
241
0
  package.Name = target->GetName();
242
0
  package.PrimaryPurpose = GetPurpose(target->GetType());
243
0
  package.CreationInfo = ci;
244
245
0
  if (!this->PackageVersion.empty()) {
246
0
    package.PackageVersion = this->PackageVersion;
247
0
  }
248
249
0
  if (!this->PackageWebsite.empty()) {
250
0
    package.Homepage = this->PackageWebsite;
251
0
  }
252
253
0
  if (!this->PackageUrl.empty()) {
254
0
    package.DownloadLocation = this->PackageUrl;
255
0
  }
256
257
0
  return package;
258
0
}
259
260
bool cmSbomBuilder::GenerateLinkProperties(
261
  cmSbomDocument& doc, cmSpdxDocument* project, cmSpdxCreationInfo const* ci,
262
  std::string const& libraries, TargetProperties const& current,
263
  std::vector<TargetProperties> const& allTargets,
264
  std::string const& config) const
265
0
{
266
0
  auto itProp = current.Properties.find(libraries);
267
0
  if (itProp == current.Properties.end()) {
268
0
    return true;
269
0
  }
270
271
0
  cmGeneratorExpression ge(*current.Target->Makefile->GetCMakeInstance());
272
0
  std::unique_ptr<cmCompiledGeneratorExpression> cge =
273
0
    ge.Parse(itProp->second);
274
0
  std::string evaluatedLibraries =
275
0
    cge->Evaluate(current.Target->GetLocalGenerator(), config, current.Target);
276
277
0
  if (cge->GetHadHeadSensitiveCondition()) {
278
0
    current.Target->Makefile->IssueMessage(
279
0
      MessageType::FATAL_ERROR,
280
0
      cmStrCat("Property \"", libraries, "\" of target \"",
281
0
               current.Target->GetName(),
282
0
               "\" contains a generator expression that is not allowed for "
283
0
               "SBOM generation."));
284
0
    return false;
285
0
  }
286
287
0
  auto makeRel = [&](char const* id, char const* desc) {
288
0
    cmSpdxRelationship r;
289
0
    r.SpdxId = cmStrCat("urn:", id, "#Relationship");
290
0
    r.RelationshipType = cmSpdxRelationship::RelationshipTypeId::DEPENDS_ON;
291
0
    r.Description = desc;
292
0
    r.From = current.Package;
293
0
    r.CreationInfo = ci;
294
0
    return r;
295
0
  };
296
297
0
  auto linkLibraries = makeRel("Static", "Linked Libraries");
298
0
  auto linkRequires = makeRel("Dynamic", "Required Runtime Libraries");
299
0
  auto buildRequires = makeRel("Shared", "Required Build-Time Libraries");
300
301
0
  auto addArtifact =
302
0
    [&](std::string const& name) -> std::pair<bool, cmSpdxPackage const*> {
303
0
    auto it = this->LinkTargets.find(name);
304
0
    if (it != this->LinkTargets.end()) {
305
0
      LinkInfo const& linkInfo = it->second;
306
0
      if (linkInfo.Package.empty()) {
307
0
        for (auto const& t : allTargets) {
308
0
          if (t.Target->GetName() == linkInfo.Component) {
309
0
            return { true, t.Package };
310
0
          }
311
0
        }
312
0
      }
313
0
      std::string pkgName =
314
0
        cmStrCat(linkInfo.Package, ':', linkInfo.Component);
315
0
      cmSpdxPackage pkg;
316
0
      pkg.Name = pkgName;
317
0
      pkg.SpdxId = cmStrCat("urn:", pkgName, "#Package");
318
0
      pkg.CreationInfo = ci;
319
0
      if (!linkInfo.Package.empty()) {
320
0
        auto const& pkgIt = this->Requirements.find(linkInfo.Package);
321
0
        if (pkgIt != this->Requirements.end() &&
322
0
            pkgIt->second.Components.count(linkInfo.Component) > 0) {
323
0
          this->AddPackageInformation(pkg, pkgIt->first, pkgIt->second);
324
0
        }
325
0
      }
326
327
0
      cmSpdxPackage const* pkgPtr =
328
0
        insert_back(project->Elements, std::move(pkg));
329
0
      if (!linkInfo.License.empty() &&
330
0
          !cm::contains(this->GeneratedLinkLicenses, name)) {
331
0
        this->GeneratedLinkLicenses.emplace(name);
332
333
0
        cmSpdxLicenseExpression license;
334
0
        license.SpdxId = cmStrCat("urn:", name, "#LicenseExpression");
335
0
        license.CreationInfo = ci;
336
0
        license.LicenseExpression = linkInfo.License;
337
338
0
        cmSpdxRelationship relHasLicense;
339
0
        relHasLicense.SpdxId =
340
0
          cmStrCat("urn:", name, "#DeclaredLicenseRelationship");
341
0
        relHasLicense.CreationInfo = ci;
342
0
        relHasLicense.RelationshipType =
343
0
          cmSpdxRelationship::HAS_DECLARED_LICENSE;
344
0
        relHasLicense.From = pkgPtr;
345
0
        relHasLicense.To.emplace_back(std::move(license));
346
347
0
        insert_back(doc.Graph, std::move(relHasLicense));
348
0
      }
349
350
0
      return { true, pkgPtr };
351
0
    }
352
353
0
    cmSpdxPackage pkg;
354
0
    pkg.SpdxId = cmStrCat("urn:", name, "#Package");
355
0
    pkg.Name = name;
356
0
    pkg.CreationInfo = ci;
357
0
    return { false, insert_back(project->Elements, std::move(pkg)) };
358
0
  };
359
360
0
  cmList names{ evaluatedLibraries };
361
0
  names.sort();
362
0
  names.remove_duplicates();
363
0
  for (std::string const& n : names) {
364
0
    auto res = addArtifact(n);
365
0
    if (!res.second) {
366
0
      continue;
367
0
    }
368
369
0
    if (res.first) {
370
0
      linkLibraries.To.push_back(res.second);
371
0
    } else {
372
0
      buildRequires.To.push_back(res.second);
373
0
    }
374
0
  }
375
376
0
  if (!linkLibraries.To.empty()) {
377
0
    insert_back(doc.Graph, std::move(linkLibraries));
378
0
  }
379
0
  if (!linkRequires.To.empty()) {
380
0
    insert_back(doc.Graph, std::move(linkRequires));
381
0
  }
382
0
  if (!buildRequires.To.empty()) {
383
0
    insert_back(doc.Graph, std::move(buildRequires));
384
0
  }
385
0
  return true;
386
0
}
387
388
bool cmSbomBuilder::GenerateProperties(
389
  cmSbomDocument& doc, cmSpdxDocument* proj, cmSpdxCreationInfo const* ci,
390
  TargetProperties const& current,
391
  std::vector<TargetProperties> const& allTargets,
392
  std::string const& config) const
393
0
{
394
0
  bool status = true;
395
0
  status &= this->GenerateLinkProperties(doc, proj, ci, "LINK_LIBRARIES",
396
0
                                         current, allTargets, config);
397
0
  status &= this->GenerateLinkProperties(
398
0
    doc, proj, ci, "INTERFACE_LINK_LIBRARIES", current, allTargets, config);
399
0
  status &= this->GenerateMetaProperties(doc, proj, ci, current);
400
0
  return status;
401
0
}
402
403
bool cmSbomBuilder::GenerateMetaProperties(
404
  cmSbomDocument& doc, cmSpdxDocument* /*project*/,
405
  cmSpdxCreationInfo const* ci, TargetProperties const& current) const
406
0
{
407
0
  std::string licenseExpr = this->DefaultLicense;
408
0
  cmValue licenseExprProp = current.Target->GetProperty("SPDX_LICENSE");
409
0
  if (licenseExprProp) {
410
0
    licenseExpr = licenseExprProp;
411
0
  }
412
0
  if (!licenseExpr.empty()) {
413
0
    auto const& tgtName = current.Target->GetName();
414
415
0
    cmSpdxLicenseExpression license;
416
0
    license.SpdxId = cmStrCat("urn:", tgtName, "#LicenseExpression");
417
0
    license.CreationInfo = ci;
418
0
    license.LicenseExpression = std::move(licenseExpr);
419
420
0
    cmSpdxRelationship relHasLicense;
421
0
    relHasLicense.SpdxId =
422
0
      cmStrCat("urn:", tgtName, "#DeclaredLicenseRelationship");
423
0
    relHasLicense.CreationInfo = ci;
424
0
    relHasLicense.RelationshipType = cmSpdxRelationship::HAS_DECLARED_LICENSE;
425
0
    relHasLicense.From = current.Package;
426
0
    relHasLicense.To.emplace_back(std::move(license));
427
428
0
    insert_back(doc.Graph, std::move(relHasLicense));
429
0
  }
430
0
  return true;
431
0
}
432
433
bool cmSbomBuilder::PopulateLinkLibrariesProperty(
434
  cmGeneratorTarget const* target,
435
  cmGeneratorExpression::PreprocessContext preprocessRule,
436
  ImportPropertyMap& properties)
437
0
{
438
0
  static std::array<std::string, 3> const linkIfaceProps = { {
439
0
    "LINK_LIBRARIES",
440
0
    "LINK_LIBRARIES_DIRECT",
441
0
    "LINK_LIBRARIES_DIRECT_EXCLUDE",
442
0
  } };
443
0
  bool hadLINK_LIBRARIES = false;
444
0
  for (std::string const& linkIfaceProp : linkIfaceProps) {
445
0
    if (cmValue input = target->GetProperty(linkIfaceProp)) {
446
0
      std::string prepro =
447
0
        cmGeneratorExpression::Preprocess(*input, preprocessRule);
448
0
      if (!prepro.empty()) {
449
0
        this->ResolveTargetsInGeneratorExpressions(prepro, target);
450
0
        properties[linkIfaceProp] = prepro;
451
0
        hadLINK_LIBRARIES = true;
452
0
      }
453
0
    }
454
0
  }
455
0
  return hadLINK_LIBRARIES;
456
0
}
457
458
bool cmSbomBuilder::AddTargetNamespace(std::string& input,
459
                                       cmGeneratorTarget const* target,
460
                                       cmLocalGenerator const* lg)
461
0
{
462
0
  cmGeneratorTarget::TargetOrString resolved =
463
0
    target->ResolveTargetReference(input, lg);
464
465
0
  cmGeneratorTarget* tgt = resolved.Target;
466
0
  if (!tgt) {
467
0
    input = resolved.String;
468
0
    return false;
469
0
  }
470
471
0
  if (tgt->IsImported()) {
472
0
    input = tgt->GetName();
473
0
    return this->NoteLinkedTarget(target, input, tgt);
474
0
  }
475
476
0
  if (this->SbomTargets.find(tgt) != this->SbomTargets.end()) {
477
0
    input = this->Namespace + tgt->GetExportName();
478
0
  } else {
479
0
    input = tgt->GetName();
480
0
  }
481
482
0
  return this->NoteLinkedTarget(target, input, tgt);
483
0
}
484
485
bool cmSbomBuilder::NoteLinkedTarget(cmGeneratorTarget const* target,
486
                                     std::string const& linkedName,
487
                                     cmGeneratorTarget const* linkedTarget)
488
0
{
489
0
  auto linkedLicense = linkedTarget->GetSafeProperty("SPDX_LICENSE");
490
491
0
  if (cm::contains(this->SbomTargets, linkedTarget)) {
492
0
    this->LinkTargets.emplace(
493
0
      linkedName,
494
0
      LinkInfo{ "", linkedTarget->GetExportName(), linkedLicense });
495
0
    return true;
496
0
  }
497
498
0
  if (linkedTarget->IsImported()) {
499
0
    using Package = cm::optional<std::pair<std::string, cmPackageInformation>>;
500
0
    auto pkgInfo = [](cmTarget* t) -> Package {
501
0
      cmFindPackageStack pkgStack = t->GetFindPackageStack();
502
0
      if (!pkgStack.Empty()) {
503
0
        return std::make_pair(pkgStack.Top().Name,
504
0
                              *pkgStack.Top().PackageInfo);
505
0
      }
506
0
      std::string const pkgName =
507
0
        t->GetSafeProperty("EXPORT_FIND_PACKAGE_NAME");
508
0
      if (pkgName.empty()) {
509
0
        return cm::nullopt;
510
0
      }
511
0
      cmPackageInformation package;
512
0
      return std::make_pair(pkgName, package);
513
0
    }(linkedTarget->Target);
514
515
0
    if (!pkgInfo) {
516
0
      target->Makefile->IssueDiagnostic(
517
0
        cmDiagnostics::CMD_AUTHOR,
518
0
        cmStrCat("Target \"", target->GetName(),
519
0
                 "\" references imported target \"", linkedName,
520
0
                 "\" which does not come from any known package."));
521
0
      return false;
522
0
    }
523
524
0
    std::string const& pkgName = pkgInfo->first;
525
0
    auto const& prefix = cmStrCat(pkgName, "::");
526
0
    std::string component;
527
0
    if (!cmHasPrefix(linkedName, prefix)) {
528
0
      component = linkedName;
529
0
    } else {
530
0
      component = linkedName.substr(prefix.length());
531
0
    }
532
0
    this->LinkTargets.emplace(linkedName,
533
0
                              LinkInfo{ pkgName, component, linkedLicense });
534
0
    cmPackageInformation& req =
535
0
      this->Requirements.insert(std::move(*pkgInfo)).first->second;
536
0
    req.Components.emplace(std::move(component));
537
0
    return true;
538
0
  }
539
540
  // Target belongs to another export from this build or install.
541
  // The leaf class chooses which export map to consult.
542
0
  auto const& exportInfo = this->FindExportInfoFor(linkedTarget);
543
0
  if (exportInfo.Namespaces.size() == 1 && exportInfo.Sets.size() == 1) {
544
0
    auto const& linkNamespace = *exportInfo.Namespaces.begin();
545
0
    if (!cmHasSuffix(linkNamespace, "::")) {
546
0
      target->Makefile->IssueDiagnostic(
547
0
        cmDiagnostics::CMD_AUTHOR,
548
0
        cmStrCat("Target \"", target->GetName(), "\" references target \"",
549
0
                 linkedName,
550
0
                 "\", whose export does not use the standard namespace "
551
0
                 "separator.  The dependency will be recorded by its bare "
552
0
                 "target name without provenance."));
553
0
      return false;
554
0
    }
555
556
0
    std::string pkgName{ linkNamespace.data(), linkNamespace.size() - 2 };
557
0
    std::string component = linkedTarget->GetExportName();
558
0
    if (pkgName == this->GetPackageName()) {
559
0
      this->LinkTargets.emplace(linkedName,
560
0
                                LinkInfo{ "", component, linkedLicense });
561
0
    } else {
562
0
      this->LinkTargets.emplace(linkedName,
563
0
                                LinkInfo{ pkgName, component, linkedLicense });
564
0
      this->Requirements[pkgName].Components.emplace(std::move(component));
565
0
    }
566
0
    return true;
567
0
  }
568
569
0
  if (exportInfo.Sets.empty()) {
570
    // install(export) provenance is unavailable.  Fall back to SBOM-level
571
    // attribution: any peer SBOM (of the same build/install mode) that
572
    // covers this target lends its package name.  install(export) wins
573
    // when both are available; only reached here when install(export) is
574
    // absent.
575
0
    auto const& sbomInfo = this->FindSbomInfoFor(linkedTarget);
576
0
    if (sbomInfo.Packages.empty()) {
577
0
      target->Makefile->IssueMessage(
578
0
        MessageType::FATAL_ERROR,
579
0
        cmStrCat("Target \"", target->GetName(), "\" references target \"",
580
0
                 linkedName,
581
0
                 "\" which has no install(EXPORT)/export(EXPORT) namespace "
582
0
                 "and is not covered by any SBOM.  An SBOM cannot attribute "
583
0
                 "this dependency.  Give \"",
584
0
                 linkedTarget->GetName(),
585
0
                 "\" an install(EXPORT)/export(EXPORT) with a NAMESPACE, or "
586
0
                 "include it in an install(SBOM)/export(SBOM)."));
587
0
      return false;
588
0
    }
589
0
    std::string const& pkgName = sbomInfo.Packages.front();
590
0
    if (sbomInfo.Packages.size() > 1) {
591
0
      target->Makefile->IssueDiagnostic(
592
0
        cmDiagnostics::CMD_AUTHOR,
593
0
        cmStrCat(
594
0
          "Target \"", target->GetName(), "\" references target \"",
595
0
          linkedName,
596
0
          "\" which has no install(EXPORT)/export(EXPORT) namespace and is "
597
0
          "covered by multiple SBOMs: ",
598
0
          cmJoin(sbomInfo.Packages, ", "), ".  Attributing to \"", pkgName,
599
0
          "\" (first alphabetically)."));
600
0
    }
601
0
    std::string component = linkedTarget->GetExportName();
602
0
    this->LinkTargets.emplace(linkedName,
603
0
                              LinkInfo{ pkgName, component, linkedLicense });
604
0
    this->Requirements[pkgName].Components.emplace(std::move(component));
605
0
    return true;
606
0
  }
607
608
0
  target->Makefile->IssueMessage(
609
0
    MessageType::FATAL_ERROR,
610
0
    cmStrCat("Target \"", target->GetName(), "\" references target \"",
611
0
             linkedName, "\" ",
612
0
             exportInfo.Sets.size() == 1
613
0
               ? "that is in an export set which is exported multiple times "
614
0
                 "with different namespaces: "
615
0
               : "that is in multiple export sets: ",
616
0
             cmJoin(exportInfo.Files, ", "),
617
0
             ".\n"
618
0
             "An SBOM cannot attribute a dependency exported in more than one "
619
0
             "export set or with more than one namespace.  Consider "
620
0
             "consolidating the exports of the \"",
621
0
             linkedTarget->GetName(), "\" target to a single export."));
622
0
  return false;
623
0
}
624
625
void cmSbomBuilder::ResolveTargetsInGeneratorExpression(
626
  std::string& input, cmGeneratorTarget const* target,
627
  cmLocalGenerator const* lg)
628
0
{
629
0
  auto err = cmResolveTargetsInGeneratorExpression(
630
0
    input, [this, target, lg](std::string& name) {
631
0
      return this->AddTargetNamespace(name, target, lg);
632
0
    });
633
0
  if (err) {
634
0
    target->GetLocalGenerator()->IssueMessage(MessageType::FATAL_ERROR, *err);
635
0
  }
636
0
}
637
638
void cmSbomBuilder::ResolveTargetsInGeneratorExpressions(
639
  std::string& input, cmGeneratorTarget const* target)
640
0
{
641
0
  cmLocalGenerator const* lg = target->GetLocalGenerator();
642
0
  std::vector<std::string> parts;
643
0
  cmGeneratorExpression::Split(input, parts);
644
645
0
  std::string sep;
646
0
  input.clear();
647
0
  for (std::string& li : parts) {
648
0
    if (target->IsLinkLookupScope(li, lg)) {
649
0
      continue;
650
0
    }
651
0
    if (cmGeneratorExpression::Find(li) == std::string::npos) {
652
0
      this->AddTargetNamespace(li, target, lg);
653
0
    } else {
654
0
      this->ResolveTargetsInGeneratorExpression(li, target, lg);
655
0
    }
656
0
    input = cmStrCat(std::move(input), sep, li);
657
0
    sep = ";";
658
0
  }
659
0
}
660
661
bool cmSbomBuilder::PopulateInterfaceLinkLibrariesProperty(
662
  cmGeneratorTarget const* target,
663
  cmGeneratorExpression::PreprocessContext preprocessRule,
664
  ImportPropertyMap& properties)
665
0
{
666
0
  if (!target->IsLinkable()) {
667
0
    return false;
668
0
  }
669
0
  static std::array<std::string, 3> const linkIfaceProps = {
670
0
    { "INTERFACE_LINK_LIBRARIES", "INTERFACE_LINK_LIBRARIES_DIRECT",
671
0
      "INTERFACE_LINK_LIBRARIES_DIRECT_EXCLUDE" }
672
0
  };
673
0
  bool hadINTERFACE_LINK_LIBRARIES = false;
674
0
  for (std::string const& linkIfaceProp : linkIfaceProps) {
675
0
    if (cmValue input = target->GetProperty(linkIfaceProp)) {
676
0
      std::string prepro =
677
0
        cmGeneratorExpression::Preprocess(*input, preprocessRule);
678
0
      if (!prepro.empty()) {
679
0
        this->ResolveTargetsInGeneratorExpressions(prepro, target);
680
0
        properties[linkIfaceProp] = prepro;
681
0
        hadINTERFACE_LINK_LIBRARIES = true;
682
0
      }
683
0
    }
684
0
  }
685
0
  return hadINTERFACE_LINK_LIBRARIES;
686
0
}