/src/CMake/Source/cmSbomBuilder.cxx
Line | Count | Source |
1 | | /* Distributed under the OSI-approved BSD 3-Clause License. See accompanying |
2 | | file LICENSE.rst or https://cmake.org/licensing for details. */ |
3 | | #include "cmSbomBuilder.h" |
4 | | |
5 | | #include <algorithm> |
6 | | #include <array> |
7 | | #include <functional> |
8 | | #include <map> |
9 | | #include <memory> |
10 | | #include <set> |
11 | | #include <string> |
12 | | #include <utility> |
13 | | #include <vector> |
14 | | |
15 | | #include <cm/optional> |
16 | | #include <cmext/algorithm> |
17 | | #include <cmext/string_view> |
18 | | |
19 | | #include "cmArgumentParserTypes.h" |
20 | | #include "cmDiagnostics.h" |
21 | | #include "cmExportFileGenerator.h" |
22 | | #include "cmExportSet.h" |
23 | | #include "cmFindPackageStack.h" |
24 | | #include "cmGeneratorExpression.h" |
25 | | #include "cmGeneratorTarget.h" |
26 | | #include "cmList.h" |
27 | | #include "cmLocalGenerator.h" |
28 | | #include "cmMakefile.h" |
29 | | #include "cmMessageType.h" |
30 | | #include "cmSbomArguments.h" |
31 | | #include "cmSbomObject.h" |
32 | | #include "cmSpdx.h" |
33 | | #include "cmSpdxSerializer.h" |
34 | | #include "cmStringAlgorithms.h" |
35 | | #include "cmSystemTools.h" |
36 | | #include "cmTarget.h" |
37 | | #include "cmTargetExport.h" |
38 | | #include "cmTargetTypes.h" |
39 | | #include "cmValue.h" |
40 | | |
41 | | cmSpdxPackage::PurposeId GetPurpose(cm::TargetType type) |
42 | 0 | { |
43 | 0 | switch (type) { |
44 | 0 | case cm::TargetType::EXECUTABLE: |
45 | 0 | return cmSpdxPackage::PurposeId::APPLICATION; |
46 | 0 | case cm::TargetType::STATIC_LIBRARY: |
47 | 0 | case cm::TargetType::SHARED_LIBRARY: |
48 | 0 | case cm::TargetType::MODULE_LIBRARY: |
49 | 0 | case cm::TargetType::OBJECT_LIBRARY: |
50 | 0 | case cm::TargetType::INTERFACE_LIBRARY: |
51 | 0 | return cmSpdxPackage::PurposeId::LIBRARY; |
52 | 0 | case cm::TargetType::UTILITY: |
53 | 0 | return cmSpdxPackage::PurposeId::SOURCE; |
54 | 0 | case cm::TargetType::GLOBAL_TARGET: |
55 | 0 | case cm::TargetType::UNKNOWN_LIBRARY: |
56 | 0 | default: |
57 | 0 | return cmSpdxPackage::PurposeId::ARCHIVE; |
58 | 0 | } |
59 | 0 | } |
60 | | |
61 | | cmSbomBuilder::cmSbomBuilder(cmSbomArguments args, |
62 | | std::vector<cmExportSet*> exportSets, |
63 | | cmLocalGenerator* lg) |
64 | 0 | : LocalGenerator(lg) |
65 | 0 | , ExportSets(std::move(exportSets)) |
66 | 0 | , PackageName(std::move(args.PackageName)) |
67 | 0 | , Namespace(cmStrCat(this->PackageName, "::"_s)) |
68 | 0 | , PackageVersion(std::move(args.Version)) |
69 | 0 | , PackageDescription(std::move(args.Description)) |
70 | 0 | , PackageWebsite(std::move(args.Website)) |
71 | 0 | , PackageUrl(std::move(args.PackageUrl)) |
72 | 0 | , DataLicense(std::move(args.DataLicense)) |
73 | 0 | , DefaultLicense(std::move(args.DefaultLicense)) |
74 | 0 | , PackageFormat(args.GetFormat()) |
75 | 0 | { |
76 | 0 | } |
77 | | |
78 | | std::set<cmGeneratorTarget const*> cmSbomBuilder::CollectTargets() const |
79 | 0 | { |
80 | 0 | std::set<cmGeneratorTarget const*> targets; |
81 | 0 | for (cmExportSet* exportSet : this->ExportSets) { |
82 | 0 | for (auto const& te : exportSet->GetTargetExports()) { |
83 | 0 | if (cmGeneratorTarget const* gt = |
84 | 0 | this->LocalGenerator->FindGeneratorTargetToUse(te->TargetName)) { |
85 | 0 | targets.emplace(gt); |
86 | 0 | } |
87 | 0 | } |
88 | 0 | } |
89 | 0 | return targets; |
90 | 0 | } |
91 | | |
92 | | void cmSbomBuilder::Compute(cmLocalGenerator* lg) |
93 | 0 | { |
94 | 0 | this->LocalGenerator = lg; |
95 | 0 | if (!lg) { |
96 | 0 | return; |
97 | 0 | } |
98 | 0 | for (cmExportSet* es : this->ExportSets) { |
99 | 0 | es->Compute(lg); |
100 | 0 | } |
101 | | // Populate the cache now (rather than at Generate time) so peer SBOMs can |
102 | | // query CoversTarget() during their own NoteLinkedTarget walks. |
103 | 0 | this->SbomTargets = this->CollectTargets(); |
104 | 0 | } |
105 | | |
106 | | bool cmSbomBuilder::CoversTarget(cmGeneratorTarget const* target) const |
107 | 0 | { |
108 | 0 | return cm::contains(this->SbomTargets, target); |
109 | 0 | } |
110 | | |
111 | | bool cmSbomBuilder::CoversExportSet(cmExportSet const* set) const |
112 | 0 | { |
113 | 0 | return std::find(this->ExportSets.cbegin(), this->ExportSets.cend(), set) != |
114 | 0 | this->ExportSets.cend(); |
115 | 0 | } |
116 | | |
117 | | bool cmSbomBuilder::GenerateForTargets( |
118 | | std::ostream& os, std::string const& config, |
119 | | cmGeneratorExpression::PreprocessContext preprocessContext) |
120 | 0 | { |
121 | 0 | cmSbomDocument doc; |
122 | 0 | doc.Graph.reserve(512); |
123 | |
|
124 | 0 | cmSpdxCreationInfo const* ci = |
125 | 0 | insert_back(doc.Graph, this->GenerateCreationInfo()); |
126 | 0 | cmSpdxDocument* project = insert_back(doc.Graph, this->GenerateSbom(ci)); |
127 | 0 | std::vector<TargetProperties> targetProps; |
128 | 0 | targetProps.reserve(this->SbomTargets.size()); |
129 | |
|
130 | 0 | for (cmGeneratorTarget const* target : this->SbomTargets) { |
131 | 0 | ImportPropertyMap properties; |
132 | 0 | this->PopulateLinkLibrariesProperty(target, preprocessContext, properties); |
133 | 0 | this->PopulateInterfaceLinkLibrariesProperty(target, preprocessContext, |
134 | 0 | properties); |
135 | 0 | targetProps.push_back(TargetProperties{ |
136 | 0 | insert_back(project->RootElements, |
137 | 0 | this->GenerateImportTarget(ci, target)), |
138 | 0 | target, |
139 | 0 | std::move(properties), |
140 | 0 | }); |
141 | 0 | } |
142 | |
|
143 | 0 | bool status = true; |
144 | 0 | for (TargetProperties const& target : targetProps) { |
145 | 0 | status &= |
146 | 0 | this->GenerateProperties(doc, project, ci, target, targetProps, config); |
147 | 0 | } |
148 | 0 | if (status) { |
149 | 0 | this->WriteSbom(doc, os); |
150 | 0 | } |
151 | 0 | return status; |
152 | 0 | } |
153 | | |
154 | | void cmSbomBuilder::WriteSbom(cmSbomDocument& doc, std::ostream& os) const |
155 | 0 | { |
156 | 0 | switch (this->PackageFormat) { |
157 | 0 | case cmSbomArguments::SbomFormat::SPDX_3_0_JSON: |
158 | 0 | cmSpdxSerializer{}.WriteSbom(os, cmSbomObject(doc)); |
159 | 0 | break; |
160 | 0 | case cmSbomArguments::SbomFormat::NONE: |
161 | 0 | break; |
162 | 0 | } |
163 | 0 | } |
164 | | |
165 | | bool cmSbomBuilder::AddPackageInformation( |
166 | | cmSpdxPackage& artifact, std::string const& name, |
167 | | cmPackageInformation const& package) const |
168 | 0 | { |
169 | 0 | if (name.empty()) { |
170 | 0 | return false; |
171 | 0 | } |
172 | | |
173 | 0 | cmSpdxOrganization org; |
174 | 0 | org.SpdxId = cmStrCat("urn:", name, "#Organization"); |
175 | 0 | org.Name = name; |
176 | 0 | org.CreationInfo = artifact.CreationInfo; |
177 | 0 | artifact.OriginatedBy.emplace_back(std::move(org)); |
178 | |
|
179 | 0 | if (package.Description) { |
180 | 0 | artifact.Description = *package.Description; |
181 | 0 | } |
182 | |
|
183 | 0 | if (package.Version) { |
184 | 0 | artifact.PackageVersion = *package.Version; |
185 | 0 | } |
186 | |
|
187 | 0 | if (package.PackageUrl) { |
188 | 0 | artifact.PackageUrl = *package.PackageUrl; |
189 | 0 | } |
190 | |
|
191 | 0 | if (package.License) { |
192 | 0 | artifact.CopyrightText = *package.License; |
193 | 0 | } |
194 | |
|
195 | 0 | artifact.BuiltTime = cmSystemTools::GetCurrentDateTime("%FT%TZ"); |
196 | 0 | cmSpdxExternalRef externalRef; |
197 | 0 | externalRef.Locator = cmStrCat("cmake:find_package(", name, ')'); |
198 | 0 | externalRef.ExternalRefType = "buildSystem"; |
199 | 0 | return true; |
200 | 0 | } |
201 | | |
202 | | cmSpdxCreationInfo cmSbomBuilder::GenerateCreationInfo() const |
203 | 0 | { |
204 | 0 | cmSpdxCreationInfo ci; |
205 | 0 | ci.SpdxId = "_:Build#CreationInfo"; |
206 | 0 | ci.Created = cmSystemTools::GetCurrentDateTime("%FT%TZ"); |
207 | 0 | ci.CreatedBy = { "https://gitlab.kitware.com/cmake/cmake" }; |
208 | 0 | ci.Comment = "This SBOM was generated from the CMakeLists.txt File"; |
209 | 0 | ci.SpecVersion = "3.0.1"; |
210 | 0 | return ci; |
211 | 0 | } |
212 | | |
213 | | cmSpdxDocument cmSbomBuilder::GenerateSbom(cmSpdxCreationInfo const* ci) const |
214 | 0 | { |
215 | 0 | cmSpdxDocument proj; |
216 | 0 | proj.Name = PackageName; |
217 | 0 | proj.SpdxId = cmStrCat("urn:", PackageName, "#SPDXDocument"); |
218 | 0 | proj.ProfileConformance = { "core", "software" }; |
219 | 0 | proj.CreationInfo = ci; |
220 | |
|
221 | 0 | if (!this->PackageDescription.empty()) { |
222 | 0 | proj.Description = this->PackageDescription; |
223 | 0 | } |
224 | |
|
225 | 0 | if (!this->DataLicense.empty()) { |
226 | 0 | cmSpdxLicenseExpression license; |
227 | 0 | license.SpdxId = cmStrCat("urn:", PackageName, "#LicenseExpression"); |
228 | 0 | license.CreationInfo = ci; |
229 | 0 | license.LicenseExpression = this->DataLicense; |
230 | 0 | proj.DataLicense = license; |
231 | 0 | } |
232 | |
|
233 | 0 | return proj; |
234 | 0 | } |
235 | | |
236 | | cmSpdxPackage cmSbomBuilder::GenerateImportTarget( |
237 | | cmSpdxCreationInfo const* ci, cmGeneratorTarget const* target) const |
238 | 0 | { |
239 | 0 | cmSpdxPackage package; |
240 | 0 | package.SpdxId = cmStrCat("urn:", target->GetName(), "#Package"); |
241 | 0 | package.Name = target->GetName(); |
242 | 0 | package.PrimaryPurpose = GetPurpose(target->GetType()); |
243 | 0 | package.CreationInfo = ci; |
244 | |
|
245 | 0 | if (!this->PackageVersion.empty()) { |
246 | 0 | package.PackageVersion = this->PackageVersion; |
247 | 0 | } |
248 | |
|
249 | 0 | if (!this->PackageWebsite.empty()) { |
250 | 0 | package.Homepage = this->PackageWebsite; |
251 | 0 | } |
252 | |
|
253 | 0 | if (!this->PackageUrl.empty()) { |
254 | 0 | package.DownloadLocation = this->PackageUrl; |
255 | 0 | } |
256 | |
|
257 | 0 | return package; |
258 | 0 | } |
259 | | |
260 | | bool cmSbomBuilder::GenerateLinkProperties( |
261 | | cmSbomDocument& doc, cmSpdxDocument* project, cmSpdxCreationInfo const* ci, |
262 | | std::string const& libraries, TargetProperties const& current, |
263 | | std::vector<TargetProperties> const& allTargets, |
264 | | std::string const& config) const |
265 | 0 | { |
266 | 0 | auto itProp = current.Properties.find(libraries); |
267 | 0 | if (itProp == current.Properties.end()) { |
268 | 0 | return true; |
269 | 0 | } |
270 | | |
271 | 0 | cmGeneratorExpression ge(*current.Target->Makefile->GetCMakeInstance()); |
272 | 0 | std::unique_ptr<cmCompiledGeneratorExpression> cge = |
273 | 0 | ge.Parse(itProp->second); |
274 | 0 | std::string evaluatedLibraries = |
275 | 0 | cge->Evaluate(current.Target->GetLocalGenerator(), config, current.Target); |
276 | |
|
277 | 0 | if (cge->GetHadHeadSensitiveCondition()) { |
278 | 0 | current.Target->Makefile->IssueMessage( |
279 | 0 | MessageType::FATAL_ERROR, |
280 | 0 | cmStrCat("Property \"", libraries, "\" of target \"", |
281 | 0 | current.Target->GetName(), |
282 | 0 | "\" contains a generator expression that is not allowed for " |
283 | 0 | "SBOM generation.")); |
284 | 0 | return false; |
285 | 0 | } |
286 | | |
287 | 0 | auto makeRel = [&](char const* id, char const* desc) { |
288 | 0 | cmSpdxRelationship r; |
289 | 0 | r.SpdxId = cmStrCat("urn:", id, "#Relationship"); |
290 | 0 | r.RelationshipType = cmSpdxRelationship::RelationshipTypeId::DEPENDS_ON; |
291 | 0 | r.Description = desc; |
292 | 0 | r.From = current.Package; |
293 | 0 | r.CreationInfo = ci; |
294 | 0 | return r; |
295 | 0 | }; |
296 | |
|
297 | 0 | auto linkLibraries = makeRel("Static", "Linked Libraries"); |
298 | 0 | auto linkRequires = makeRel("Dynamic", "Required Runtime Libraries"); |
299 | 0 | auto buildRequires = makeRel("Shared", "Required Build-Time Libraries"); |
300 | |
|
301 | 0 | auto addArtifact = |
302 | 0 | [&](std::string const& name) -> std::pair<bool, cmSpdxPackage const*> { |
303 | 0 | auto it = this->LinkTargets.find(name); |
304 | 0 | if (it != this->LinkTargets.end()) { |
305 | 0 | LinkInfo const& linkInfo = it->second; |
306 | 0 | if (linkInfo.Package.empty()) { |
307 | 0 | for (auto const& t : allTargets) { |
308 | 0 | if (t.Target->GetName() == linkInfo.Component) { |
309 | 0 | return { true, t.Package }; |
310 | 0 | } |
311 | 0 | } |
312 | 0 | } |
313 | 0 | std::string pkgName = |
314 | 0 | cmStrCat(linkInfo.Package, ':', linkInfo.Component); |
315 | 0 | cmSpdxPackage pkg; |
316 | 0 | pkg.Name = pkgName; |
317 | 0 | pkg.SpdxId = cmStrCat("urn:", pkgName, "#Package"); |
318 | 0 | pkg.CreationInfo = ci; |
319 | 0 | if (!linkInfo.Package.empty()) { |
320 | 0 | auto const& pkgIt = this->Requirements.find(linkInfo.Package); |
321 | 0 | if (pkgIt != this->Requirements.end() && |
322 | 0 | pkgIt->second.Components.count(linkInfo.Component) > 0) { |
323 | 0 | this->AddPackageInformation(pkg, pkgIt->first, pkgIt->second); |
324 | 0 | } |
325 | 0 | } |
326 | |
|
327 | 0 | cmSpdxPackage const* pkgPtr = |
328 | 0 | insert_back(project->Elements, std::move(pkg)); |
329 | 0 | if (!linkInfo.License.empty() && |
330 | 0 | !cm::contains(this->GeneratedLinkLicenses, name)) { |
331 | 0 | this->GeneratedLinkLicenses.emplace(name); |
332 | |
|
333 | 0 | cmSpdxLicenseExpression license; |
334 | 0 | license.SpdxId = cmStrCat("urn:", name, "#LicenseExpression"); |
335 | 0 | license.CreationInfo = ci; |
336 | 0 | license.LicenseExpression = linkInfo.License; |
337 | |
|
338 | 0 | cmSpdxRelationship relHasLicense; |
339 | 0 | relHasLicense.SpdxId = |
340 | 0 | cmStrCat("urn:", name, "#DeclaredLicenseRelationship"); |
341 | 0 | relHasLicense.CreationInfo = ci; |
342 | 0 | relHasLicense.RelationshipType = |
343 | 0 | cmSpdxRelationship::HAS_DECLARED_LICENSE; |
344 | 0 | relHasLicense.From = pkgPtr; |
345 | 0 | relHasLicense.To.emplace_back(std::move(license)); |
346 | |
|
347 | 0 | insert_back(doc.Graph, std::move(relHasLicense)); |
348 | 0 | } |
349 | |
|
350 | 0 | return { true, pkgPtr }; |
351 | 0 | } |
352 | | |
353 | 0 | cmSpdxPackage pkg; |
354 | 0 | pkg.SpdxId = cmStrCat("urn:", name, "#Package"); |
355 | 0 | pkg.Name = name; |
356 | 0 | pkg.CreationInfo = ci; |
357 | 0 | return { false, insert_back(project->Elements, std::move(pkg)) }; |
358 | 0 | }; |
359 | |
|
360 | 0 | cmList names{ evaluatedLibraries }; |
361 | 0 | names.sort(); |
362 | 0 | names.remove_duplicates(); |
363 | 0 | for (std::string const& n : names) { |
364 | 0 | auto res = addArtifact(n); |
365 | 0 | if (!res.second) { |
366 | 0 | continue; |
367 | 0 | } |
368 | | |
369 | 0 | if (res.first) { |
370 | 0 | linkLibraries.To.push_back(res.second); |
371 | 0 | } else { |
372 | 0 | buildRequires.To.push_back(res.second); |
373 | 0 | } |
374 | 0 | } |
375 | |
|
376 | 0 | if (!linkLibraries.To.empty()) { |
377 | 0 | insert_back(doc.Graph, std::move(linkLibraries)); |
378 | 0 | } |
379 | 0 | if (!linkRequires.To.empty()) { |
380 | 0 | insert_back(doc.Graph, std::move(linkRequires)); |
381 | 0 | } |
382 | 0 | if (!buildRequires.To.empty()) { |
383 | 0 | insert_back(doc.Graph, std::move(buildRequires)); |
384 | 0 | } |
385 | 0 | return true; |
386 | 0 | } |
387 | | |
388 | | bool cmSbomBuilder::GenerateProperties( |
389 | | cmSbomDocument& doc, cmSpdxDocument* proj, cmSpdxCreationInfo const* ci, |
390 | | TargetProperties const& current, |
391 | | std::vector<TargetProperties> const& allTargets, |
392 | | std::string const& config) const |
393 | 0 | { |
394 | 0 | bool status = true; |
395 | 0 | status &= this->GenerateLinkProperties(doc, proj, ci, "LINK_LIBRARIES", |
396 | 0 | current, allTargets, config); |
397 | 0 | status &= this->GenerateLinkProperties( |
398 | 0 | doc, proj, ci, "INTERFACE_LINK_LIBRARIES", current, allTargets, config); |
399 | 0 | status &= this->GenerateMetaProperties(doc, proj, ci, current); |
400 | 0 | return status; |
401 | 0 | } |
402 | | |
403 | | bool cmSbomBuilder::GenerateMetaProperties( |
404 | | cmSbomDocument& doc, cmSpdxDocument* /*project*/, |
405 | | cmSpdxCreationInfo const* ci, TargetProperties const& current) const |
406 | 0 | { |
407 | 0 | std::string licenseExpr = this->DefaultLicense; |
408 | 0 | cmValue licenseExprProp = current.Target->GetProperty("SPDX_LICENSE"); |
409 | 0 | if (licenseExprProp) { |
410 | 0 | licenseExpr = licenseExprProp; |
411 | 0 | } |
412 | 0 | if (!licenseExpr.empty()) { |
413 | 0 | auto const& tgtName = current.Target->GetName(); |
414 | |
|
415 | 0 | cmSpdxLicenseExpression license; |
416 | 0 | license.SpdxId = cmStrCat("urn:", tgtName, "#LicenseExpression"); |
417 | 0 | license.CreationInfo = ci; |
418 | 0 | license.LicenseExpression = std::move(licenseExpr); |
419 | |
|
420 | 0 | cmSpdxRelationship relHasLicense; |
421 | 0 | relHasLicense.SpdxId = |
422 | 0 | cmStrCat("urn:", tgtName, "#DeclaredLicenseRelationship"); |
423 | 0 | relHasLicense.CreationInfo = ci; |
424 | 0 | relHasLicense.RelationshipType = cmSpdxRelationship::HAS_DECLARED_LICENSE; |
425 | 0 | relHasLicense.From = current.Package; |
426 | 0 | relHasLicense.To.emplace_back(std::move(license)); |
427 | |
|
428 | 0 | insert_back(doc.Graph, std::move(relHasLicense)); |
429 | 0 | } |
430 | 0 | return true; |
431 | 0 | } |
432 | | |
433 | | bool cmSbomBuilder::PopulateLinkLibrariesProperty( |
434 | | cmGeneratorTarget const* target, |
435 | | cmGeneratorExpression::PreprocessContext preprocessRule, |
436 | | ImportPropertyMap& properties) |
437 | 0 | { |
438 | 0 | static std::array<std::string, 3> const linkIfaceProps = { { |
439 | 0 | "LINK_LIBRARIES", |
440 | 0 | "LINK_LIBRARIES_DIRECT", |
441 | 0 | "LINK_LIBRARIES_DIRECT_EXCLUDE", |
442 | 0 | } }; |
443 | 0 | bool hadLINK_LIBRARIES = false; |
444 | 0 | for (std::string const& linkIfaceProp : linkIfaceProps) { |
445 | 0 | if (cmValue input = target->GetProperty(linkIfaceProp)) { |
446 | 0 | std::string prepro = |
447 | 0 | cmGeneratorExpression::Preprocess(*input, preprocessRule); |
448 | 0 | if (!prepro.empty()) { |
449 | 0 | this->ResolveTargetsInGeneratorExpressions(prepro, target); |
450 | 0 | properties[linkIfaceProp] = prepro; |
451 | 0 | hadLINK_LIBRARIES = true; |
452 | 0 | } |
453 | 0 | } |
454 | 0 | } |
455 | 0 | return hadLINK_LIBRARIES; |
456 | 0 | } |
457 | | |
458 | | bool cmSbomBuilder::AddTargetNamespace(std::string& input, |
459 | | cmGeneratorTarget const* target, |
460 | | cmLocalGenerator const* lg) |
461 | 0 | { |
462 | 0 | cmGeneratorTarget::TargetOrString resolved = |
463 | 0 | target->ResolveTargetReference(input, lg); |
464 | |
|
465 | 0 | cmGeneratorTarget* tgt = resolved.Target; |
466 | 0 | if (!tgt) { |
467 | 0 | input = resolved.String; |
468 | 0 | return false; |
469 | 0 | } |
470 | | |
471 | 0 | if (tgt->IsImported()) { |
472 | 0 | input = tgt->GetName(); |
473 | 0 | return this->NoteLinkedTarget(target, input, tgt); |
474 | 0 | } |
475 | | |
476 | 0 | if (this->SbomTargets.find(tgt) != this->SbomTargets.end()) { |
477 | 0 | input = this->Namespace + tgt->GetExportName(); |
478 | 0 | } else { |
479 | 0 | input = tgt->GetName(); |
480 | 0 | } |
481 | |
|
482 | 0 | return this->NoteLinkedTarget(target, input, tgt); |
483 | 0 | } |
484 | | |
485 | | bool cmSbomBuilder::NoteLinkedTarget(cmGeneratorTarget const* target, |
486 | | std::string const& linkedName, |
487 | | cmGeneratorTarget const* linkedTarget) |
488 | 0 | { |
489 | 0 | auto linkedLicense = linkedTarget->GetSafeProperty("SPDX_LICENSE"); |
490 | |
|
491 | 0 | if (cm::contains(this->SbomTargets, linkedTarget)) { |
492 | 0 | this->LinkTargets.emplace( |
493 | 0 | linkedName, |
494 | 0 | LinkInfo{ "", linkedTarget->GetExportName(), linkedLicense }); |
495 | 0 | return true; |
496 | 0 | } |
497 | | |
498 | 0 | if (linkedTarget->IsImported()) { |
499 | 0 | using Package = cm::optional<std::pair<std::string, cmPackageInformation>>; |
500 | 0 | auto pkgInfo = [](cmTarget* t) -> Package { |
501 | 0 | cmFindPackageStack pkgStack = t->GetFindPackageStack(); |
502 | 0 | if (!pkgStack.Empty()) { |
503 | 0 | return std::make_pair(pkgStack.Top().Name, |
504 | 0 | *pkgStack.Top().PackageInfo); |
505 | 0 | } |
506 | 0 | std::string const pkgName = |
507 | 0 | t->GetSafeProperty("EXPORT_FIND_PACKAGE_NAME"); |
508 | 0 | if (pkgName.empty()) { |
509 | 0 | return cm::nullopt; |
510 | 0 | } |
511 | 0 | cmPackageInformation package; |
512 | 0 | return std::make_pair(pkgName, package); |
513 | 0 | }(linkedTarget->Target); |
514 | |
|
515 | 0 | if (!pkgInfo) { |
516 | 0 | target->Makefile->IssueDiagnostic( |
517 | 0 | cmDiagnostics::CMD_AUTHOR, |
518 | 0 | cmStrCat("Target \"", target->GetName(), |
519 | 0 | "\" references imported target \"", linkedName, |
520 | 0 | "\" which does not come from any known package.")); |
521 | 0 | return false; |
522 | 0 | } |
523 | | |
524 | 0 | std::string const& pkgName = pkgInfo->first; |
525 | 0 | auto const& prefix = cmStrCat(pkgName, "::"); |
526 | 0 | std::string component; |
527 | 0 | if (!cmHasPrefix(linkedName, prefix)) { |
528 | 0 | component = linkedName; |
529 | 0 | } else { |
530 | 0 | component = linkedName.substr(prefix.length()); |
531 | 0 | } |
532 | 0 | this->LinkTargets.emplace(linkedName, |
533 | 0 | LinkInfo{ pkgName, component, linkedLicense }); |
534 | 0 | cmPackageInformation& req = |
535 | 0 | this->Requirements.insert(std::move(*pkgInfo)).first->second; |
536 | 0 | req.Components.emplace(std::move(component)); |
537 | 0 | return true; |
538 | 0 | } |
539 | | |
540 | | // Target belongs to another export from this build or install. |
541 | | // The leaf class chooses which export map to consult. |
542 | 0 | auto const& exportInfo = this->FindExportInfoFor(linkedTarget); |
543 | 0 | if (exportInfo.Namespaces.size() == 1 && exportInfo.Sets.size() == 1) { |
544 | 0 | auto const& linkNamespace = *exportInfo.Namespaces.begin(); |
545 | 0 | if (!cmHasSuffix(linkNamespace, "::")) { |
546 | 0 | target->Makefile->IssueDiagnostic( |
547 | 0 | cmDiagnostics::CMD_AUTHOR, |
548 | 0 | cmStrCat("Target \"", target->GetName(), "\" references target \"", |
549 | 0 | linkedName, |
550 | 0 | "\", whose export does not use the standard namespace " |
551 | 0 | "separator. The dependency will be recorded by its bare " |
552 | 0 | "target name without provenance.")); |
553 | 0 | return false; |
554 | 0 | } |
555 | | |
556 | 0 | std::string pkgName{ linkNamespace.data(), linkNamespace.size() - 2 }; |
557 | 0 | std::string component = linkedTarget->GetExportName(); |
558 | 0 | if (pkgName == this->GetPackageName()) { |
559 | 0 | this->LinkTargets.emplace(linkedName, |
560 | 0 | LinkInfo{ "", component, linkedLicense }); |
561 | 0 | } else { |
562 | 0 | this->LinkTargets.emplace(linkedName, |
563 | 0 | LinkInfo{ pkgName, component, linkedLicense }); |
564 | 0 | this->Requirements[pkgName].Components.emplace(std::move(component)); |
565 | 0 | } |
566 | 0 | return true; |
567 | 0 | } |
568 | | |
569 | 0 | if (exportInfo.Sets.empty()) { |
570 | | // install(export) provenance is unavailable. Fall back to SBOM-level |
571 | | // attribution: any peer SBOM (of the same build/install mode) that |
572 | | // covers this target lends its package name. install(export) wins |
573 | | // when both are available; only reached here when install(export) is |
574 | | // absent. |
575 | 0 | auto const& sbomInfo = this->FindSbomInfoFor(linkedTarget); |
576 | 0 | if (sbomInfo.Packages.empty()) { |
577 | 0 | target->Makefile->IssueMessage( |
578 | 0 | MessageType::FATAL_ERROR, |
579 | 0 | cmStrCat("Target \"", target->GetName(), "\" references target \"", |
580 | 0 | linkedName, |
581 | 0 | "\" which has no install(EXPORT)/export(EXPORT) namespace " |
582 | 0 | "and is not covered by any SBOM. An SBOM cannot attribute " |
583 | 0 | "this dependency. Give \"", |
584 | 0 | linkedTarget->GetName(), |
585 | 0 | "\" an install(EXPORT)/export(EXPORT) with a NAMESPACE, or " |
586 | 0 | "include it in an install(SBOM)/export(SBOM).")); |
587 | 0 | return false; |
588 | 0 | } |
589 | 0 | std::string const& pkgName = sbomInfo.Packages.front(); |
590 | 0 | if (sbomInfo.Packages.size() > 1) { |
591 | 0 | target->Makefile->IssueDiagnostic( |
592 | 0 | cmDiagnostics::CMD_AUTHOR, |
593 | 0 | cmStrCat( |
594 | 0 | "Target \"", target->GetName(), "\" references target \"", |
595 | 0 | linkedName, |
596 | 0 | "\" which has no install(EXPORT)/export(EXPORT) namespace and is " |
597 | 0 | "covered by multiple SBOMs: ", |
598 | 0 | cmJoin(sbomInfo.Packages, ", "), ". Attributing to \"", pkgName, |
599 | 0 | "\" (first alphabetically).")); |
600 | 0 | } |
601 | 0 | std::string component = linkedTarget->GetExportName(); |
602 | 0 | this->LinkTargets.emplace(linkedName, |
603 | 0 | LinkInfo{ pkgName, component, linkedLicense }); |
604 | 0 | this->Requirements[pkgName].Components.emplace(std::move(component)); |
605 | 0 | return true; |
606 | 0 | } |
607 | | |
608 | 0 | target->Makefile->IssueMessage( |
609 | 0 | MessageType::FATAL_ERROR, |
610 | 0 | cmStrCat("Target \"", target->GetName(), "\" references target \"", |
611 | 0 | linkedName, "\" ", |
612 | 0 | exportInfo.Sets.size() == 1 |
613 | 0 | ? "that is in an export set which is exported multiple times " |
614 | 0 | "with different namespaces: " |
615 | 0 | : "that is in multiple export sets: ", |
616 | 0 | cmJoin(exportInfo.Files, ", "), |
617 | 0 | ".\n" |
618 | 0 | "An SBOM cannot attribute a dependency exported in more than one " |
619 | 0 | "export set or with more than one namespace. Consider " |
620 | 0 | "consolidating the exports of the \"", |
621 | 0 | linkedTarget->GetName(), "\" target to a single export.")); |
622 | 0 | return false; |
623 | 0 | } |
624 | | |
625 | | void cmSbomBuilder::ResolveTargetsInGeneratorExpression( |
626 | | std::string& input, cmGeneratorTarget const* target, |
627 | | cmLocalGenerator const* lg) |
628 | 0 | { |
629 | 0 | auto err = cmResolveTargetsInGeneratorExpression( |
630 | 0 | input, [this, target, lg](std::string& name) { |
631 | 0 | return this->AddTargetNamespace(name, target, lg); |
632 | 0 | }); |
633 | 0 | if (err) { |
634 | 0 | target->GetLocalGenerator()->IssueMessage(MessageType::FATAL_ERROR, *err); |
635 | 0 | } |
636 | 0 | } |
637 | | |
638 | | void cmSbomBuilder::ResolveTargetsInGeneratorExpressions( |
639 | | std::string& input, cmGeneratorTarget const* target) |
640 | 0 | { |
641 | 0 | cmLocalGenerator const* lg = target->GetLocalGenerator(); |
642 | 0 | std::vector<std::string> parts; |
643 | 0 | cmGeneratorExpression::Split(input, parts); |
644 | |
|
645 | 0 | std::string sep; |
646 | 0 | input.clear(); |
647 | 0 | for (std::string& li : parts) { |
648 | 0 | if (target->IsLinkLookupScope(li, lg)) { |
649 | 0 | continue; |
650 | 0 | } |
651 | 0 | if (cmGeneratorExpression::Find(li) == std::string::npos) { |
652 | 0 | this->AddTargetNamespace(li, target, lg); |
653 | 0 | } else { |
654 | 0 | this->ResolveTargetsInGeneratorExpression(li, target, lg); |
655 | 0 | } |
656 | 0 | input = cmStrCat(std::move(input), sep, li); |
657 | 0 | sep = ";"; |
658 | 0 | } |
659 | 0 | } |
660 | | |
661 | | bool cmSbomBuilder::PopulateInterfaceLinkLibrariesProperty( |
662 | | cmGeneratorTarget const* target, |
663 | | cmGeneratorExpression::PreprocessContext preprocessRule, |
664 | | ImportPropertyMap& properties) |
665 | 0 | { |
666 | 0 | if (!target->IsLinkable()) { |
667 | 0 | return false; |
668 | 0 | } |
669 | 0 | static std::array<std::string, 3> const linkIfaceProps = { |
670 | 0 | { "INTERFACE_LINK_LIBRARIES", "INTERFACE_LINK_LIBRARIES_DIRECT", |
671 | 0 | "INTERFACE_LINK_LIBRARIES_DIRECT_EXCLUDE" } |
672 | 0 | }; |
673 | 0 | bool hadINTERFACE_LINK_LIBRARIES = false; |
674 | 0 | for (std::string const& linkIfaceProp : linkIfaceProps) { |
675 | 0 | if (cmValue input = target->GetProperty(linkIfaceProp)) { |
676 | 0 | std::string prepro = |
677 | 0 | cmGeneratorExpression::Preprocess(*input, preprocessRule); |
678 | 0 | if (!prepro.empty()) { |
679 | 0 | this->ResolveTargetsInGeneratorExpressions(prepro, target); |
680 | 0 | properties[linkIfaceProp] = prepro; |
681 | 0 | hadINTERFACE_LINK_LIBRARIES = true; |
682 | 0 | } |
683 | 0 | } |
684 | 0 | } |
685 | 0 | return hadINTERFACE_LINK_LIBRARIES; |
686 | 0 | } |