spdx 3 support - #49
Draft
Avus-c wants to merge 25 commits into
Draft
Conversation
... to avoid potential conflicts
... to differentiate between our messages and the rest. Implemnted using a macro around cmakes message command.
Still partially broken (not valid json) and some information is not yet serialized. For the most part the serialization is migrated though there a few that might not be trivially possible. Makeing the output valid json shouldn't be to difficult. I've deliberatly ignored it to focus on converting stuff to spdx3.
SPDX3 requires all sbom elemets to be listed in a seperate json array. Every element added to the sbom, adds it's spdxid to a variable available during cmake-install through it's install script. These lists are then finalized at the end and inserted into the generated sbom.
because we generate cmake code during configure stage that need to run at install stage, we sometimes have to write strings with multiple levels of escaping. With this helper function this can be done whenever necessary and not at the point where we are generating strings
this is not fully fleshed out yet, but the idea is to generate spdxids based on the path of the object in the sbom tree instead of using uuids. This should make it easier to read and understand the generated spdxids and also make it easier to correlate them with the structure of the sbom.
a single license defintion for each License. packages and files refernce the license using relations(not yet implemented)
Avus-c
force-pushed
the
dev/spdx-3-support
branch
from
February 22, 2026 23:31
387ecdd to
82d020c
Compare
also remvoe ability to set SPDXID manually. I don't think this fits in the scope of this project, and is not worth the complexity.
used for testing not allowed in sbom
using fixtures for a better testing approach and workflow The filepath of the generated sbom is giving me a bunch of headeachs. It's not possible to get the filepath where i need it, and wildcard don't work for some reason. Probably cmakes "fault". The only documented "Wildcards are not supported" in for cmake -E copy, which is not at all what i am doing in add_test ...
Avus-c
force-pushed
the
dev/spdx-3-support
branch
from
March 3, 2026 23:04
c86e6f3 to
52cd66a
Compare
use the new verifier in ci, if java is not available skip verification step
this also adds a check that spdx ids are unique by default. In some instances, such as with licenses, the same spdx id may be generated multiple times. To allow this, the ALLOW_DUPLICATES option can be used to bypass the uniqueness check. spdx3 also has a directory filetype property which we do not currently support.
Collaborator
Author
|
Regarding this pull-request (and maybe this project in general): CMake introduced (experimental) SBOM generation capabilities with CMake 4.3. I would like to avoid having an additional implemention that will largely do the same thing, especially when the potential support on kitwares end is much greater. And sorry for the slow progress the last months, alot has been going on... |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
(will eventually) closes #48
First iteration will implement the spdx lite profile. All unused argument we'll ignore for now and add them later on one by one when needed. Hopefully we can keep the api free of breaking changes, although the resulting file will be completely different.
Few things to note on the current progress:
Update: