Commit graph

26 commits

Author SHA1 Message Date
Ibrahim Kanouche
91f2f9d851 Revert "Revert "Updated SBOM generator module to generate JSON spdx utility bill of""
This reverts commit 928ee9d9f7.

Reason for revert: Fixed the initial cause of the revert. Added spdx-tools to the missing branches. See b/276427351

Change-Id: I7bd0b3f194b27dc9a255ccadeb2a9a12a3d59f66
2023-04-01 21:24:30 +00:00
Bob Badour
928ee9d9f7 Revert "Updated SBOM generator module to generate JSON spdx utility bill of"
This reverts commit e97adc5db9.

Reason for revert: Roll back until the kernel manifests are updated with the spdx-tools library.

Change-Id: Ib2327862acd928ebcea0f328daecc162b46d2c78
2023-03-31 14:51:36 +00:00
Ibrahim Kanouche
e97adc5db9 Updated SBOM generator module to generate JSON spdx utility bill of
material

Test: m compliance_sbom

Bug: 265472710
Change-Id: Iad9ddbd2abf17ff0b034f1410c55dd99051f7127
2023-03-30 23:34:32 +00:00
Ibrahim Kanouche
bedf1a8a86 Added SBOM generator module to implement the spdx
utility bill of material

Added methods to graph.go to extract the annotation types

Test: m compliance_sbom

Test: tested against real targets, see go/paste/4932131502424064

Bug: 241591242
Change-Id: I344c15d64cd034d72076f9d9a677e593e288e3a6
2022-11-01 20:42:01 +00:00
Bob Badour
dc62de4760 Refactor projectmetadata into separate package.
Replace regular expressions to extract fields from a text proto with
and actual parsed protobuf.

Refactor TestFS into its own package, and implement StatFS.

Test: m droid dist cts alllicensemetadata

Test: repo forall -c 'echo -n "$REPO_PATH  " && $ANDROID_BUILD_TOP/out/host/linux-x86/bin/compliance_checkmetadata . 2>&1' | fgrep -v PASS

Change-Id: Icd17a6a2b6a4e2b6ffded48e964b9c9d6e4d64d6
2022-10-18 16:55:47 -07:00
Bob Badour
986a839161 Improve flags for compliance tools.
Test: m droid dist reportmissinglicenses

Change-Id: I4090dae3d5d33d1908d67dff31aeee92d2b261da
2022-06-03 12:44:22 -07:00
Bob Badour
213095a919 Rename listshare and checkshare.
Bug: 151177513
Bug: 213388645
Bug: 210912771

Test: m droid dist reportmissinglicenses
Change-Id: I223c4496d776a1bbd4fdce31ed79a638ed3491d8
2022-04-13 11:04:43 -07:00
Bob Badour
77570059cd Phony target to report all library names.
Bug: 68860345
Bug: 151177513
Bug: 151953481

Test: m nothing reportallnoticelibrarynames

Change-Id: I0f791e2d92b8135d6af3a6c93f0db348fc69f5a1
2022-03-02 22:32:37 -08:00
Bob Badour
f87922450e license metadata xml notice files
Introduce the below command-line tool:

xmlnotice outputs a NOTICE.xml file constructed from the license
texts of the transitive closure of dependencies.

Bug: 68860345
Bug: 151177513
Bug: 151953481
Bug: 213388645
Bug: 210912771

Test: m all
Test: m systemlicense
Test: m xmlnotice; out/soong/host/linux-x85/xmlnotice ...

where ... is the path to the .meta_lic file for the system image. In my
case if

$ export PRODUCT=$(realpath $ANDROID_PRODUCT_OUT --relative-to=$PWD)

... can be expressed as:

${PRODUCT}/gen/META/lic_intermediates/${PRODUCT}/system.img.meta_lic

Change-Id: I267effd3a1c1b981bcdc5e058dce561a2d4a7948
2022-02-02 15:32:50 -08:00
Treehugger Robot
6ebf02914c Merge changes I40a05866,Id3d6e701
* changes:
  license metadata reverse trace
  Fix copy+paste error.
2022-02-01 01:25:59 +00:00
Bob Badour
c817845ea5 license metadata reverse trace
Introduce the below command-line tool:

rtrace outputs a list of targets and conditions causing one or more
projects or target nodes to require sharing to resolve a restricted
condition.

Bug: 68860345
Bug: 151177513
Bug: 151953481
Bug: 213388645
Bug: 210912771

Test: m all
Test: m systemlicense
Test: m rtrace; out/soong/host/linux-x85/rtrace -rtrace=...

where ... is a project or license metadata file followed by the path to
the .meta_lic file for the system image. In my case if

$ export PRODUCT=$(realpath $ANDROID_PRODUCT_OUT --relative-to=$PWD)

... can be expressed as:

system/core ${PRODUCT}/gen/META/lic_intermediates/${PRODUCT}/system.img.meta_lic
or
${PRODUCT}/gen/META/lic_intermediates/${PRODUCT}/system.img.meta_lic ${PRODUCT}/gen/META/lic_intermediates/${PRODUCT}/system.img.meta_lic

Change-Id: I40a0586699d9b8a8dd2bd4ba26756c9649ebf964
2022-01-31 14:16:23 -08:00
Colin Cross
bb45f8c74d Track dependencies when reading notice files
Track which files are read by the notice file indexer and add a flag
to textnotice and htmlnotice to support writing them out.

Bug: 207445310
Test: textnotice_test
Test: htmlnotice_test
Change-Id: Ib74706b8a87a5ed9268a0fe37982ecf89f4e227d
2022-01-31 10:15:10 -08:00
Colin Cross
d0f05c9eda Move compliance commands into subdirectories
Move each compliance command into its own directory to avoid Go tooling
considering all the files to be a single package and complaining about
conflicting global names.

Test: go test ./...
Change-Id: I3db6310e7368bcc7fe6a3704b40a84078ed44209
2022-01-27 17:14:03 -08:00
Colin Cross
38a6193180 Give compliance a pkgPath
Change the pkgPath of compliance to android/soong/tools/compliance
to distinguish it from the standard library.

Also add a go.mod file so that the Go tools can find the package.

Test: go test ./...
Change-Id: I061be2b91378db6508e9c88be2548648af8be4e7
2022-01-27 17:14:03 -08:00
Colin Cross
2c51bd1d49 Move policy subdirectory into package directory
Go's tooling expects that all files in the same package are in the
same directory.  Move the policy/*.go files to policy_*.go.

Test: go test ./...
Change-Id: I7e81936ddd20a5ffb4770ae23bdb6e411d6924cc
2022-01-27 17:14:03 -08:00
Bob Badour
2546febca7 license metadata bill of materials list
Introduce the below command-line tool:

bom outputs a text file listing 1 installed path per line.

Bug: 68860345
Bug: 151177513
Bug: 151953481
Bug: 213388645
Bug: 210912771

Test: m all
Test: m systemlicense
Test: m bom; out/soong/host/linux-x85/bom ...

where ... is the path to the .meta_lic file for the system image. In my
case if

$ export PRODUCT=$(realpath $ANDROID_PRODUCT_OUT --relative-to=$PWD)

... can be expressed as:

${PRODUCT}/gen/META/lic_intermediates/${PRODUCT}/system.img.meta_lic

Change-Id: I73975ca7b161945a62ff83888527ce01fb47d75a
2022-01-26 20:58:24 -08:00
Bob Badour
00c8a38714 license metadata shipped libraries list
Introduce the below command-line tool:

shippedlibs outputs a text file listing 1 library per line containing
the libraries the shipped image is derived from.

Bug: 68860345
Bug: 151177513
Bug: 151953481
Bug: 213388645
Bug: 210912771

Test: m all
Test: m systemlicense
Test: m shippedlibs; out/soong/host/linux-x85/shippedlibs ...

where ... is the path to the .meta_lic file for the system image. In my
case if

$ export PRODUCT=$(realpath $ANDROID_PRODUCT_OUT --relative-to=$PWD)

... can be expressed as:

${PRODUCT}/gen/META/lic_intermediates/${PRODUCT}/system.img.meta_lic

Change-Id: I98e2c1eec94ad7878e911eee2458a26e12ee2b19
2022-01-26 17:21:39 -08:00
Bob Badour
6ea1457c9b license metadata html notice files
Introduce the below command-line tool:

htmlnotice outputs a NOTICE.html file constructed from the license
texts of the transitive closure of dependencies.

Bug: 68860345
Bug: 151177513
Bug: 151953481
Bug: 213388645
Bug: 210912771

Test: m all
Test: m systemlicense
Test: m htmlnotice; out/soong/host/linux-x85/htmlnotice ...

where ... is the path to the .meta_lic file for the system image. In my
case if

$ export PRODUCT=$(realpath $ANDROID_PRODUCT_OUT --relative-to=$PWD)

... can be expressed as:

${PRODUCT}/gen/META/lic_intermediates/${PRODUCT}/system.img.meta_lic

Change-Id: Idbbeb2939d8cbf497237516fe468004fcd2d72a1
2022-01-26 16:02:17 -08:00
Bob Badour
e6fdd1403b license metadata text notice files
Introduce the below command-line tool:

textnotice outputs a NOTICE text file constructed from the license
texts of the transitive closure of dependencies.

Bug: 68860345
Bug: 151177513
Bug: 151953481
Bug: 213388645
Bug: 210912771

Test: m all
Test: m systemlicense
Test: m textnotice; out/soong/host/linux-x85/textnotice ...

where ... is the path to the .meta_lic file for the system image. In my
case if

$ export PRODUCT=$(realpath $ANDROID_PRODUCT_OUT --relative-to=$PWD)

... can be expressed as:

${PRODUCT}/gen/META/lic_intermediates/${PRODUCT}/system.img.meta_lic

Change-Id: Ia691869fd8e58ef008024f48c23b1a4b4435677a
2022-01-26 16:02:11 -08:00
Bob Badour
103eb0f9bc Performance and scale.
Defer edge creation.

Don't create edges until the count is known to avoid repeated allocate+
copy operatios.

Limit resolutions.

Allow only a single resolution condition set per target, and overwrite
intermediate results. Reduces memory and obviates allocations.

Propagate fewer conditions.

Instead of propagating notice conditions to parents in graph during
initial resolve, leave them on leaf node, and attach to ancestors in
the final walk. Reduces copies.

Parallelize resolutions.

Use goroutines, mutexes, and waitgroups to resolve branches of the
graph in parallel. Makes better use of available cores.

Don't accumulate resolutions inside non-containers.

During the final resolution walk, only attach actions to ancestors from
the root down until the 1st non-aggregate. Prevents an explosion of
copies in the lower levels of the graph.

Drop origin for scale.

Tracking the origin of every potential origin for every restricted
condition does not scale. By dropping origin, propagating from top
to bottom can prune many redundant paths avoiding an exponential
explosion.

Conditions as bitmask.

Use bit masks for license conditions and condition sets. Reduces maps
and allocations.

Bug: 68860345
Bug: 151177513
Bug: 151953481

Test: m all
Test: m systemlicense
Test: m listshare; out/soong/host/linux-x86/bin/listshare ...
Test: m checkshare; out/soong/host/linux-x86/bin/checkshare ...
Test: m dumpgraph; out/soong/host/linux-x86/dumpgraph ...
Test: m dumpresolutions; out/soong/host/linux-x86/dumpresolutions ...

where ... is the path to the .meta_lic file for the system image. In my
case if

$ export PRODUCT=$(realpath $ANDROID_PRODUCT_OUT --relative-to=$PWD)

... can be expressed as:

${PRODUCT}/gen/META/lic_intermediates/${PRODUCT}/system.img.meta_lic

Change-Id: Ia2ec1b818de6122c239fbd0824754f1d65daffd3
2022-01-11 10:40:50 -08:00
Bob Badour
afaeb6ae5f compliance package documentation
Bug: 68860345
Bug: 151177513
Bug: 151953481

Test: m all
Test: m systemlicense
Test: m listshare; out/soong/host/linux-x86/bin/listshare ...
Test: m checkshare; out/soong/host/linux-x86/bin/checkshare ...
Test: m dumpgraph; out/soong/host/linux-x86/dumpgraph ...
Test: m dumpresolutions; out/soong/host/linux-x86/dumpresolutions ...

where ... is the path to the .meta_lic file for the system image. In my
case if

$ export PRODUCT=$(realpath $ANDROID_PRODUCT_OUT --relative-to=$PWD)

... can be expressed as:

${PRODUCT}/gen/META/lic_intermediates/${PRODUCT}/system.img.meta_lic

Change-Id: I5d48eababce7bba39795d3668eee86b332cbe43d
2021-12-06 16:39:35 -08:00
Bob Badour
6dd0035e04 compliance package: listshare and checkshare
package to read, consume, and analyze license metadata and dependency
graph.

Includes the below command-line tools:

listshare outputs csv of projects to share to meet restricted and
reciprocal license requirements with one project per line. The first
field is the path to the project, and subsequent fields identify the
license resolutions as colon-separated target:annotations tuples.

checkshare outputs error messages to stderr for any targets where
policy dictates both sharing and not sharing the source-code, and PASS
or FAIL to stdout. exit status indicates success 0 or conflict found 1

Bug: 68860345
Bug: 151177513
Bug: 151953481

Test: m all
Test: m systemlicense
Test: m listshare; out/soong/host/linux-x86/bin/listshare ...
Test: m checkshare; out/soong/host/linux-x86/bin/checkshare ...
Test: m dumpgraph; out/soong/host/linux-x86/dumpgraph ...
Test: m dumpresolutions; out/soong/host/linux-x86/dumpresolutions ...

where ... is the path to the .meta_lic file for the system image. In my
case if

$ export PRODUCT=$(realpath $ANDROID_PRODUCT_OUT --relative-to=$PWD)

... can be expressed as:

${PRODUCT}/gen/META/lic_intermediates/${PRODUCT}/system.img.meta_lic

Change-Id: I4ff3f98848f7e6d03a35734300d763ef5f245d53
2021-12-06 16:39:35 -08:00
Bob Badour
1ded0a1b18 compliance package: dumpresolutions
package to read, consume, and analyze license metadata and dependency
graph.

Includes the below command-line tool:

dumpresolutions outputs the resulting set of resolutions after the
bottom-up and top-down resolves, or after joining 1 or more condition
walks.

Bug: 68860345
Bug: 151177513
Bug: 151953481

Test: m all
Test: m systemlicense
Test: m dumpgraph; out/soong/host/linux-x86/dumpgraph ...
Test: m dumpresolutions; out/soong/host/linux-x86/dumpresolutions ...

where ... is the path to the .meta_lic file for the system image. In my
case if

$ export PRODUCT=$(realpath $ANDROID_PRODUCT_OUT --relative-to=$PWD)

... can be expressed as:

${PRODUCT}/gen/META/lic_intermediates/${PRODUCT}/system.img.meta_lic

Change-Id: I9869400126cd7ad4b7376b0bab31b46aad732f5d
2021-12-06 16:38:08 -08:00
Bob Badour
fa739da020 compliance package for license metadata: dumpgraph
package to read, consume, and analyze license metadata and dependency
graph.

Includes testdata/ and the the below command-line tool:

dumpgraph outputs edges of the graph as "target dependency annotations"

Bug: 68860345
Bug: 151177513
Bug: 151953481

Test: m all
Test: m systemlicense
Test: m dumpgraph; out/soong/host/linux-x86/dumpgraph ...

where ... is the path to the .meta_lic file for the system image. In my
case if

$ export PRODUCT=$(realpath $ANDROID_PRODUCT_OUT --relative-to=$PWD)

... can be expressed as:

${PRODUCT}/gen/META/lic_intermediates/${PRODUCT}/system.img.meta_lic

Change-Id: I5fe57d361da5155dbcb2c0d369626e9200c9d664
2021-12-06 16:37:17 -08:00
Bob Badour
9ee7d03e1c compliance package policy and resolves
package to read, consume, and analyze license metadata and dependency
graph.

Bug: 68860345
Bug: 151177513
Bug: 151953481

Change-Id: Ic08406fa2250a08ad26f2167d934f841c95d9148
2021-12-03 15:52:48 -08:00
Bob Badour
a99ac620dd compliance package structures for license metadata
package to read, consume, and analyze license metadata and dependency
graph.

Bug: 68860345
Bug: 151177513
Bug: 151953481
Change-Id: I3ebf44e4d5195b9851fd076161049bf82ed76dd2
2021-12-03 15:52:48 -08:00