Skip to content

Commit 395db6f

Browse files
vaintroubvaintroub
committed
MDEV-36398 Extend SBOM with 'license' and 'copyright'
Store auxillary information for 3rd party projects, such as license identifier, CPE vendor and product, copyright statement in a cmake file.
1 parent 805e7ca commit 395db6f

File tree

3 files changed

+82
-26
lines changed

3 files changed

+82
-26
lines changed

‎cmake/3rdparty_info.cmake

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# This file is used for SBOM generation.
2+
3+
# It consists of the list of 3rd party products
4+
# which can be compiled together with MariaDB server
5+
# and their licenses, copyright notices, and CPE prefixes
6+
# this is the vendor:product part of CPE identifier from
7+
# https://nvd.nist.gov/products/cpe
8+
9+
# We use both git submodules, and CMake external projects
10+
# dependencies (as well we zlib, which is part of the code)
11+
# so the information is here for all these types
12+
13+
SET("zlib.license" "Zlib")
14+
SET("zlib.copyright" "Copyright (C) 1995-2024 Jean-loup Gailly and Mark Adler")
15+
SET("zlib.cpe-prefix" "zlib:zlib")
16+
SET("minizip.license" "Zlib")
17+
SET("minizip.copyright" "Copyright (C) 1995-2024 Jean-loup Gailly and Mark Adler")
18+
SET("minizip.cpe-prefix" "zlib:zlib")
19+
SET("fmt.license" "MIT")
20+
SET("fmt.copyright" "Copyright (C) 2012 - present, Victor Zverovich")
21+
SET("fmt.cpe-prefix" "fmt:fmt")
22+
SET("pcre2.license" "BSD-3-Clause")
23+
SET("pcre2.cpe-prefix" "pcre:pcre2")
24+
SET("wolfssl.license" "GPL-2.0")
25+
SET("wolfssl.copyright" "Copyright (C) 2006-2024 wolfSSL Inc.")
26+
SET("wolfssl.cpe-prefix" "wolfssl:wolfssl")
27+
SET("boost.license" "BSL-1.0")
28+
SET("boost.cpe-prefix" "boost:boost")
29+
SET("mariadb-connector-c.license" "LGPL-2.1")
30+
SET("mariadb-connector-c.cpe-prefix" "mariadb:connector\\\\/c")
31+
SET("rocksdb.license" "GPL-2.0")
32+
SET("wsrep-lib.license" "GPL-2.0")
33+
SET("wsrep-api.license" "GPL-2.0")
34+
SET("mariadb-columnstore-engine.license" "GPL-2.0")
35+
SET("libmarias3.license" "LGPL-2.1")
36+
SET("thrift.license" "Apache-2.0")
37+
SET("thrift.cpe-prefix" "apache:thrift")

‎cmake/generate_sbom.cmake

Lines changed: 36 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -36,30 +36,23 @@ ENDMACRO()
3636

3737
# Get CPE ID ( https://en.wikipedia.org/wiki/Common_Platform_Enumeration )
3838
# for given project name and version
39-
# Only "known" CPEs are handled here, e.g currently no CPE for rocksdb
39+
# CPE prefix are stored with other auxilliary info in the 3rdparty_info.cmake
40+
# file
4041
FUNCTION(SBOM_GET_CPE name version var)
41-
SET(cpe_prefix_map
42-
"zlib" "zlib:zlib"
43-
"mariadb-connector-c" "mariadb:connector\\\\/c"
44-
"wolfssl" "wolfssl:wolfssl"
45-
"minizip" "zlib:zlib"
46-
"pcre2" "pcre:pcre2"
47-
"fmt" "fmt:fmt"
48-
"boost" "boost:boost"
49-
"thrift" "apache:thrift"
50-
)
51-
LIST(FIND cpe_prefix_map "${name}" idx_cpe_mapping)
52-
# Version needs to have at least one dot character in it.
53-
# Otherwise, we assume it is a git hash, and do not generate CPE
54-
STRING(FIND "${version}" "." idx_version_dot)
55-
IF((idx_cpe_mapping GREATER -1) AND (idx_version_dot GREATER -1))
56-
MATH(EXPR next_idx "${idx_cpe_mapping}+1")
57-
LIST(GET cpe_prefix_map ${next_idx} cpe_name_and_vendor)
58-
STRING(REGEX REPLACE "[^0-9\\.]" "" cleaned_version "${version}")
59-
SET(${var} "cpe:2.3:a:${cpe_name_and_vendor}:${cleaned_version}:*:*:*:*:*:*:*" PARENT_SCOPE)
60-
ELSE()
61-
SET(${var} "" PARENT_SCOPE)
42+
SET(${var} "" PARENT_SCOPE)
43+
STRING(FIND "${version}" "." dot_idx)
44+
IF(${dot_idx} EQUAL -1)
45+
# Version does not have dot inside.
46+
# mostly likely it is just a git hash
47+
RETURN()
48+
ENDIF()
49+
SET(cpe_name_and_vendor "${${repo_name_lower}.cpe-prefix}")
50+
IF(NOT cpe_name_and_vendor)
51+
RETURN()
6252
ENDIF()
53+
54+
STRING(REGEX REPLACE "[^0-9\\.]" "" cleaned_version "${version}")
55+
SET(${var} "cpe:2.3:a:${cpe_name_and_vendor}:${cleaned_version}:*:*:*:*:*:*:*" PARENT_SCOPE)
6356
ENDFUNCTION()
6457

6558
# Add dependency on CMake ExternalProject.
@@ -97,8 +90,8 @@ ENDMACRO()
9790
# Perhaps it can always be "MariaDB", but security team recommendation is different
9891
# more towards "author"
9992
FUNCTION (sbom_get_supplier repo_name repo_user varname)
100-
IF("${repo_name_SUPPLIER}")
101-
SET(${varname} "${repo_name_SUPPLIER}" PARENT_SCOPE)
93+
IF("${${repo_name}_SUPPLIER}")
94+
SET(${varname} "${${repo_name}_SUPPLIER}" PARENT_SCOPE)
10295
ELSEIF (repo_name MATCHES "zlib|minizip")
10396
# stuff that is checked into out repos
10497
SET(${varname} "MariaDB" PARENT_SCOPE)
@@ -230,6 +223,7 @@ FUNCTION(GENERATE_SBOM)
230223
\"ref\": \"${CPACK_PACKAGE_NAME}\",
231224
\"dependsOn\": [" )
232225

226+
INCLUDE(3rdparty_info)
233227
SET(first ON)
234228
FOREACH(dep ${ALL_THIRD_PARTY})
235229
# Extract the part after the last "/" from URL
@@ -277,6 +271,14 @@ FUNCTION(GENERATE_SBOM)
277271
IF(cpe)
278272
SET(cpe "\n \"cpe\": \"${cpe}\",")
279273
ENDIF()
274+
SET(license "${${repo_name_lower}.license}")
275+
IF(NOT license)
276+
MESSAGE(FATAL_ERROR "no license for 3rd party dependency ${repo_name_lower}.")
277+
ENDIF()
278+
SET(copyright "${${repo_name_lower}.copyright}")
279+
IF(NOT copyright)
280+
SET(copyright NOASSERTION)
281+
ENDIF()
280282
STRING(APPEND sbom_components "
281283
{
282284
\"bom-ref\": \"${bom_ref}\",
@@ -286,7 +288,15 @@ FUNCTION(GENERATE_SBOM)
286288
\"purl\": \"${purl}\",${cpe}
287289
\"supplier\": {
288290
\"name\": \"${supplier}\"
289-
}
291+
},
292+
\"licenses\": [
293+
{
294+
\"license\": {
295+
\"id\": \"${license}\"
296+
}
297+
}
298+
],
299+
\"copyright\": \"${copyright}\"
290300
}")
291301
STRING(APPEND sbom_dependencies "
292302
\"${bom_ref}\"")
@@ -302,5 +312,6 @@ FUNCTION(GENERATE_SBOM)
302312
IF(NOT DEFINED CPACK_PACKAGE_VERSION)
303313
SET(CPACK_PACKAGE_VERSION "${CPACK_PACKAGE_VERSION_MAJOR}.${CPACK_PACKAGE_VERSION_MINOR}.${CPACK_PACKAGE_VERSION_PATCH}")
304314
ENDIF()
315+
STRING(TIMESTAMP CURRENT_YEAR "%Y")
305316
configure_file(${CMAKE_CURRENT_LIST_DIR}/cmake/sbom.json.in ${CMAKE_BINARY_DIR}/sbom.json)
306317
ENDFUNCTION()

‎cmake/sbom.json.in

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,15 @@
2020
]
2121
},
2222
"purl": "pkg:github/@GITHUB_REPO_USER@/@GITHUB_REPO_NAME@@@GIT_REV_SHORT@",
23-
"cpe": "cpe:2.3:a:mariadb:mariadb:@CPACK_PACKAGE_VERSION@:*:*:*:*:*:*"
23+
"cpe": "cpe:2.3:a:mariadb:mariadb:@CPACK_PACKAGE_VERSION@:*:*:*:*:*:*",
24+
"licenses": [
25+
{
26+
"license": {
27+
"id": "GPL-2.0"
28+
}
29+
}
30+
],
31+
"copyright": "Copyright (C) @CURRENT_YEAR@ MariaDB plc, MariaDB Foundation and others"
2432
},
2533
"authors": [
2634
{

0 commit comments

Comments
 (0)