# Copyright (C) 2024 The Qt Company Ltd. # Copyright (C) 2023-2024 Jochem Rutgers # SPDX-License-Identifier: MIT AND BSD-3-Clause __qt_internal_cmake_include_guard(GLOBAL GUARD_KEY "QtPublicSbomOpsHelpers") # Handles the look up of Python, Python spdx dependencies and other various post-installation steps # like NTIA validation, auditing, json generation, etc. function(_qt_internal_sbom_setup_project_ops_generation) set(opt_args # spdx options GENERATE_JSON GENERATE_JSON_REQUIRED # cydx options GENERATE_CYCLONE_DX_V1_6 GENERATE_CYCLONE_DX_V1_6_REQUIRED VERIFY_CYCLONE_DX_V1_6 VERIFY_CYCLONE_DX_V1_6_REQUIRED VERBOSE_CYCLONE_DX_V1_6 # source spdx options GENERATE_SOURCE_SBOM LINT_SOURCE_SBOM LINT_SOURCE_SBOM_NO_ERROR # Extra spdx verification VERIFY_SBOM VERIFY_SBOM_REQUIRED VERIFY_NTIA_COMPLIANT # Extra spdx info SHOW_TABLE AUDIT AUDIT_NO_ERROR ) set(single_args "") set(multi_args "") cmake_parse_arguments(PARSE_ARGV 0 arg "${opt_args}" "${single_args}" "${multi_args}") _qt_internal_validate_all_args_are_parsed(arg) if(arg_GENERATE_JSON AND NOT QT_INTERNAL_NO_SBOM_PYTHON_OPS) set(op_args OP_KEY "GENERATE_JSON" OUT_VAR_DEPS_FOUND deps_found ) if(arg_GENERATE_JSON_REQUIRED) list(APPEND op_args REQUIRED) endif() _qt_internal_sbom_find_and_handle_sbom_op_dependencies(${op_args}) if(deps_found) _qt_internal_sbom_generate_json() endif() endif() if(arg_GENERATE_CYCLONE_DX_V1_6 AND NOT QT_INTERNAL_NO_SBOM_PYTHON_OPS) set(op_args OUT_VAR_DEPS_FOUND deps_found ) if(arg_GENERATE_CYCLONE_DX_V1_6_REQUIRED) list(APPEND op_args REQUIRED) endif() set(gen_args "") if(arg_VERIFY_CYCLONE_DX_V1_6) list(APPEND gen_args VERIFY) endif() if(arg_VERIFY_CYCLONE_DX_V1_6_REQUIRED) list(APPEND gen_args VERIFY_REQUIRED) endif() if(arg_VERBOSE_CYCLONE_DX_V1_6) list(APPEND gen_args VERBOSE) endif() _qt_internal_sbom_find_cydx_dependencies(${op_args}) if(deps_found) _qt_internal_sbom_generate_cydx_json(${gen_args}) endif() endif() if(arg_VERIFY_SBOM AND NOT QT_INTERNAL_NO_SBOM_PYTHON_OPS) set(op_args OP_KEY "VERIFY_SBOM" OUT_VAR_DEPS_FOUND deps_found ) if(arg_VERIFY_SBOM_REQUIRED) list(APPEND op_args REQUIRED) endif() _qt_internal_sbom_find_and_handle_sbom_op_dependencies(${op_args}) if(deps_found) _qt_internal_sbom_verify_valid() endif() endif() if(arg_VERIFY_NTIA_COMPLIANT AND NOT QT_INTERNAL_NO_SBOM_PYTHON_OPS) _qt_internal_sbom_find_and_handle_sbom_op_dependencies(REQUIRED OP_KEY "RUN_NTIA") _qt_internal_sbom_verify_ntia_compliant() endif() if(arg_SHOW_TABLE AND NOT QT_INTERNAL_NO_SBOM_PYTHON_OPS) _qt_internal_sbom_find_python_dependency_program(NAME sbom2doc REQUIRED) _qt_internal_sbom_show_table() endif() if(arg_AUDIT AND NOT QT_INTERNAL_NO_SBOM_PYTHON_OPS) set(audit_no_error_option "") if(arg_AUDIT_NO_ERROR) set(audit_no_error_option NO_ERROR) endif() _qt_internal_sbom_find_python_dependency_program(NAME sbomaudit REQUIRED) _qt_internal_sbom_audit(${audit_no_error_option}) endif() if(arg_GENERATE_SOURCE_SBOM AND NOT QT_INTERNAL_NO_SBOM_PYTHON_OPS) _qt_internal_sbom_find_python_dependency_program(NAME reuse REQUIRED) _qt_internal_sbom_generate_reuse_source_sbom() endif() if(arg_LINT_SOURCE_SBOM AND NOT QT_INTERNAL_NO_SBOM_PYTHON_OPS) set(lint_no_error_option "") if(arg_LINT_SOURCE_SBOM_NO_ERROR) set(lint_no_error_option NO_ERROR) endif() _qt_internal_sbom_find_python_dependency_program(NAME reuse REQUIRED) _qt_internal_sbom_run_reuse_lint(${lint_no_error_option}) endif() endfunction() # Tries to find the dependencies for generating CycloneDX v1.6 SBOMs. # Sets OUT_VAR_DEPS_FOUND to TRUE if found, FALSE otherwise. function(_qt_internal_sbom_find_cydx_dependencies) set(opt_args REQUIRED ) set(single_args OUT_VAR_DEPS_FOUND ) set(multi_args "") cmake_parse_arguments(PARSE_ARGV 0 arg "${opt_args}" "${single_args}" "${multi_args}") if(NOT arg_OUT_VAR_DEPS_FOUND) message(FATAL_ERROR "OUT_VAR_DEPS_FOUND is required") endif() set(op_args OP_KEY "GENERATE_CYCLONE_DX_V1_6" OUT_VAR_DEPS_FOUND deps_found ) if(arg_REQUIRED) list(APPEND op_args REQUIRED) endif() _qt_internal_sbom_find_and_handle_sbom_op_dependencies(${op_args}) set(${arg_OUT_VAR_DEPS_FOUND} "${deps_found}" PARENT_SCOPE) endfunction() # Helper to output a debug or error message when python or one of its dependencies are not found. # When found, it also caches the found python interpreter path and version, as well as the # DEPS_FOUND_FOR_$OP_KEY var. function(_qt_internal_sbom_verify_if_sbom_op_dependencies_are_found) set(opt_args FINAL_ATTEMPT PYTHON_FOUND DEP_FOUND EVERYTHING_FOUND ) set(single_args REQUIRED_VERSION PYTHON_PATH PYTHON_VERSION DEP_PACKAGE_NAME PYTHON_FIND_OUTPUT DEP_FIND_OUTPUT ATTEMPT_MESSAGE ATTEMPT_RESULT_MESSAGE OP_KEY ATTEMPT_LOG_OUT_VAR ATTEMPT_COUNT_OUT_VAR ) set(multi_args "") cmake_parse_arguments(PARSE_ARGV 0 arg "${opt_args}" "${single_args}" "${multi_args}") if(arg_EVERYTHING_FOUND) message(DEBUG "Python and dependencies found for SBOM operation '${arg_OP_KEY}'. " "Using Python '${arg_PYTHON_PATH}'") if(NOT QT_INTERNAL_SBOM_PYTHON_EXECUTABLE) message(DEBUG "Setting QT_INTERNAL_SBOM_PYTHON_EXECUTABLE to ${arg_PYTHON_PATH}") message(DEBUG "Setting QT_INTERNAL_SBOM_PYTHON_VERSION to ${arg_PYTHON_VERSION}") set(QT_INTERNAL_SBOM_PYTHON_EXECUTABLE "${arg_PYTHON_PATH}" CACHE INTERNAL "Python interpeter used for SBOM generation.") set(QT_INTERNAL_SBOM_PYTHON_VERSION "${arg_PYTHON_VERSION}" CACHE INTERNAL "Python interpeter version used for SBOM generation.") endif() set(QT_INTERNAL_SBOM_DEPS_FOUND_FOR_${arg_OP_KEY} "TRUE" CACHE INTERNAL "All dependencies found to run SBOM op '${arg_OP_KEY}'") return() endif() if(NOT arg_PYTHON_FOUND) string(CONCAT not_found_message "Python ${arg_REQUIRED_VERSION} for running SBOM operation '${arg_OP_KEY}' NOT found.\n" "Suggestion: In case if Python is installed, but not in a standard location, specify " "it using -DQT_SBOM_PYTHON_INTERP=\n" ) elseif(NOT arg_DEP_FOUND) string(CONCAT not_found_message "Python dependency for running SBOM operation '${arg_OP_KEY}' NOT found.\n" "Suggestion: Install it using pip install '${arg_DEP_PACKAGE_NAME}'\n" ) endif() set(dep_find_contents "") if(arg_DEP_FIND_OUTPUT) string(CONCAT dep_find_contents "Dependency find log begins.\n${arg_DEP_FIND_OUTPUT}\n" "Dependency find log ends.\n" ) endif() string(CONCAT current_attempt_message "${arg_ATTEMPT_MESSAGE}\n" "Result: ${not_found_message}\n" "Python find log begins.\n${arg_PYTHON_FIND_OUTPUT}\n" "Python find log ends.\n" "${dep_find_contents}" "${arg_ATTEMPT_RESULT_MESSAGE}\n\n" ) message(DEBUG "${current_attempt_message}") if(arg_FINAL_ATTEMPT) set(previous_attempts_contents "") if(${arg_ATTEMPT_LOG_OUT_VAR}) string(CONCAT previous_attempts_contents "Previous attempts log below.\n" "${${arg_ATTEMPT_LOG_OUT_VAR}}" ) endif() string(CONCAT final_attempt_message "${current_attempt_message}\n" "${previous_attempts_contents}" ) message(FATAL_ERROR "${final_attempt_message}") endif() # Collect all previous attempt messages, to show them at the very end if not found. if(arg_ATTEMPT_LOG_OUT_VAR) set(attempt_count "${${arg_ATTEMPT_COUNT_OUT_VAR}}") math(EXPR attempt_count "${attempt_count} + 1") set(${arg_ATTEMPT_COUNT_OUT_VAR} "${attempt_count}" PARENT_SCOPE) string(CONCAT attempt_log_content "${${arg_ATTEMPT_LOG_OUT_VAR}}\n" "Attempt ${attempt_count}:\n" "${current_attempt_message}") set(${arg_ATTEMPT_LOG_OUT_VAR} "${attempt_log_content}" PARENT_SCOPE) endif() endfunction() # Helper macro to output a debug or error message when python or one of its dependencies are not # found. Expects the caller to set all of the vars. # Meant to reduce the line noise due to the repeated calls. macro(_qt_internal_sbom_verify_if_sbom_op_dependencies_are_found_lambda) # Assemble args to show what wasn't found. if(python_found) list(APPEND verify_args PYTHON_FOUND) endif() if(dep_found) list(APPEND verify_args DEP_FOUND) endif() if(everything_found) list(APPEND verify_args EVERYTHING_FOUND) endif() if(python_path) list(APPEND verify_args PYTHON_PATH "${python_path}") endif() if(python_version) list(APPEND verify_args PYTHON_VERSION "${python_version}") endif() if(python_find_output) list(APPEND verify_args PYTHON_FIND_OUTPUT "${python_find_output}") endif() if(dep_find_output) list(APPEND verify_args DEP_FIND_OUTPUT "${dep_find_output}") endif() if(attempt_message) list(APPEND verify_args ATTEMPT_MESSAGE "${attempt_message}") endif() if(attempt_result_message) list(APPEND verify_args ATTEMPT_RESULT_MESSAGE "${attempt_result_message}") endif() _qt_internal_sbom_verify_if_sbom_op_dependencies_are_found( ${verify_args} REQUIRED_VERSION "${required_version}" OP_KEY "${arg_OP_KEY}" DEP_PACKAGE_NAME "${dep_package_name}" ATTEMPT_LOG_OUT_VAR attempt_log ATTEMPT_COUNT_OUT_VAR attempt_count ) endmacro() # Helper to find a python interpreter and a specific python dependency, e.g. to be able to generate # a SPDX JSON SBOM, or run post-installation steps like NTIA verification. # The exact dependency should be specified as the OP_KEY. # # Caches the found python executable in a separate cache var QT_INTERNAL_SBOM_PYTHON_EXECUTABLE, to # avoid conflicts with any other found python interpreter. # Also caches the python version found in QT_INTERNAL_SBOM_PYTHON_VERSION, so we can show it # in the configure summary. # Attempts to find a suitable Python interpreter with multiple searching approaches, due to platform # specifics and quirks in how the FindPython module behaves. function(_qt_internal_sbom_find_and_handle_sbom_op_dependencies) set(opt_args REQUIRED ) set(single_args OP_KEY OUT_VAR_DEPS_FOUND ) set(multi_args "") cmake_parse_arguments(PARSE_ARGV 0 arg "${opt_args}" "${single_args}" "${multi_args}") _qt_internal_validate_all_args_are_parsed(arg) if(NOT arg_OP_KEY) message(FATAL_ERROR "OP_KEY is required") endif() set(supported_ops "GENERATE_JSON" "GENERATE_CYCLONE_DX_V1_6" "VERIFY_SBOM" "RUN_NTIA" ) if(arg_OP_KEY STREQUAL "GENERATE_JSON" OR arg_OP_KEY STREQUAL "VERIFY_SBOM") set(import_statement "import spdx_tools.spdx.clitools.pyspdxtools") set(dep_package_name "spdx-tools") elseif(arg_OP_KEY STREQUAL "GENERATE_CYCLONE_DX_V1_6") set(import_statement "from cyclonedx.output.json import JsonV1Dot6") set(dep_package_name "cyclonedx-python-lib[json-validation]") elseif(arg_OP_KEY STREQUAL "RUN_NTIA") set(import_statement "import ntia_conformance_checker.main") set(dep_package_name "ntia-conformance-checker") else() message(FATAL_ERROR "OP_KEY must be one of ${supported_ops}") endif() # Return early if we found the dependencies. if(QT_INTERNAL_SBOM_DEPS_FOUND_FOR_${arg_OP_KEY}) if(arg_OUT_VAR_DEPS_FOUND) set(${arg_OUT_VAR_DEPS_FOUND} TRUE PARENT_SCOPE) endif() return() endif() # NTIA-compliance checker requires Python 3.9 or later, so we use it as the minimum for all # SBOM OPs. set(required_version "3.9") set(python_common_args VERSION "${required_version}" ) set(everything_found FALSE) # Used by the macro calls below below to collect debug find output across attempts. set(attempt_log "") set(attempt_count 0) # Look in QT_SBOM_PYTHON_INTERP if it's set. # If QT_SBOM_FORCE_USE_PYTHON_INTERP is set, attempt to use it without preforming a search. _qt_internal_sbom_get_sbom_python_interp_path( OUT_VAR_FOUND sbom_python_interp_found OUT_VAR_PYTHON_PATH sbom_python_interp_path OUT_VAR_PYTHON_DIR_PATH sbom_python_interp_dir ) if(sbom_python_interp_found) set(extra_python_args QUIET ) # It's possible that sbom_python_interp_path can't be computed, so we need to check that # it's not empty. if(QT_SBOM_FORCE_USE_PYTHON_INTERP AND sbom_python_interp_path) set(using_message "${sbom_python_interp_path}") list(APPEND extra_python_args FORCE_SET_INTERPRETER_PATH INTERPRETER_PATH "${sbom_python_interp_path}" ) else() set(using_message "${sbom_python_interp_dir}") list(APPEND extra_python_args SEARCH_IN_INTERPRETER_DIR_PATH INTERPRETER_DIR_PATH "${sbom_python_interp_dir}" ) endif() string(CONCAT attempt_message "Looking for Python and dependencies for operation '${arg_OP_KEY}'. " "Searching using QT_SBOM_PYTHON_INTERP: '${using_message}'.") _qt_internal_sbom_find_python_and_dependency_helper_lambda() set(attempt_result_message "") if(NOT everything_found) string(CONCAT attempt_result_message "SBOM Python search using QT_SBOM_PYTHON_INTERP did " "not find all dependencies for operation '${arg_OP_KEY}'. Search continues." ) endif() set(verify_args "") _qt_internal_sbom_verify_if_sbom_op_dependencies_are_found_lambda() endif() # Look into any custom provided root dir, that was not set via QT_SBOM_PYTHON_INTERP. _qt_internal_sbom_get_python_root_dir(OUT_VAR_PYTHON_ROOT_DIR_PATH python_root_dir) if(NOT everything_found AND python_root_dir) set(extra_python_args QUIET SEARCH_IN_ROOT_DIR ) string(CONCAT attempt_message "Looking for Python and dependencies for operation '${arg_OP_KEY}'. " "Searching using Python3_ROOT_DIR: '${python_root_dir}'.") _qt_internal_sbom_find_python_and_dependency_helper_lambda() set(attempt_result_message "") if(NOT everything_found) string(CONCAT attempt_result_message "SBOM Python search using Python3_ROOT_DIR did not find all dependencies " "for operation '${arg_OP_KEY}'. Search continues." ) endif() set(verify_args "") _qt_internal_sbom_verify_if_sbom_op_dependencies_are_found_lambda() endif() # On macOS, FindPython prefers looking in the system framework location, but that usually would # not have the required dependencies. So we first look in it, and then fallback to any other # non-framework python found. if(NOT everything_found AND CMAKE_HOST_APPLE) set(extra_python_args QUIET SEARCH_IN_FRAMEWORKS ) string(CONCAT attempt_message "Looking for Python and dependencies for operation '${arg_OP_KEY}'. " "Searching in the macOS framework locations.") _qt_internal_sbom_find_python_and_dependency_helper_lambda() set(attempt_result_message "") if(NOT everything_found) string(CONCAT attempt_result_message "macOS-specific SBOM Python search did not find all dependencies " "for operation '${arg_OP_KEY}'. Search continues." ) endif() set(verify_args "") _qt_internal_sbom_verify_if_sbom_op_dependencies_are_found_lambda() endif() # On Windows, also look in the registry first. if(NOT everything_found AND CMAKE_HOST_WIN32) set(extra_python_args QUIET SEARCH_IN_REGISTRY ) string(CONCAT attempt_message "Looking for Python and dependencies for operation '${arg_OP_KEY}'. Searching in the " " Windows registry.") _qt_internal_sbom_find_python_and_dependency_helper_lambda() set(attempt_result_message "") if(NOT everything_found) string(CONCAT attempt_result_message "Windows-specific SBOM Python search did not find all dependencies " "for operation '${arg_OP_KEY}'. Search continues." ) endif() set(verify_args "") _qt_internal_sbom_verify_if_sbom_op_dependencies_are_found_lambda() endif() # Do a final lookup without all the approaches above. if(NOT everything_found) set(extra_python_args QUIET ) string(CONCAT attempt_message "Looking for Python and dependencies for operation " "'${arg_OP_KEY}'. Searching default locations as per FindPython3 docs.") _qt_internal_sbom_find_python_and_dependency_helper_lambda() set(attempt_result_message "") if(NOT everything_found) string(CONCAT attempt_result_message "SBOM Python search in default locations did not find all dependencies " "for operation '${arg_OP_KEY}'. Search concluded." ) endif() set(verify_args "") # If REQUIRED was passed, and we are at the final attempt, in case we didn't find the # deps, we will error out. if(arg_REQUIRED) list(APPEND verify_args FINAL_ATTEMPT) endif() _qt_internal_sbom_verify_if_sbom_op_dependencies_are_found_lambda() endif() if(arg_OUT_VAR_DEPS_FOUND) set(${arg_OUT_VAR_DEPS_FOUND} "${QT_INTERNAL_SBOM_DEPS_FOUND_FOR_${arg_OP_KEY}}" PARENT_SCOPE) endif() endfunction() # Helper that checks a variable for truthiness, and sets the OUT_VAR_DEPS_FOUND and # OUT_VAR_REASON_FAILURE_MESSAGE variables based on what was passed in. function(_qt_internal_sbom_handle_sbom_op_missing_dependency) set(opt_args "") set(single_args VAR_TO_CHECK OUT_VAR_DEPS_FOUND OUT_VAR_REASON_FAILURE_MESSAGE ) set(multi_args FAILURE_MESSAGE ) cmake_parse_arguments(PARSE_ARGV 0 arg "${opt_args}" "${single_args}" "${multi_args}") _qt_internal_validate_all_args_are_parsed(arg) if(NOT arg_VAR_TO_CHECK) message(FATAL_ERROR "VAR_TO_CHECK is required") endif() set(reason "") set(value "${${arg_VAR_TO_CHECK}}") if(NOT value) if(arg_FAILURE_MESSAGE) list(JOIN arg_FAILURE_MESSAGE " " reason) endif() set(deps_found FALSE) else() set(deps_found TRUE) endif() if(arg_OUT_VAR_DEPS_FOUND) set(${arg_OUT_VAR_DEPS_FOUND} "${deps_found}" PARENT_SCOPE) endif() if(arg_OUT_VAR_REASON_FAILURE_MESSAGE) set(${arg_OUT_VAR_REASON_FAILURE_MESSAGE} "${reason}" PARENT_SCOPE) endif() endfunction() # Helper to query whether the sbom python interpreter is available, and also the error message if it # is not available. function(_qt_internal_sbom_check_python_interpreter_available) set(opt_args "") set(single_args OUT_VAR_DEPS_FOUND OUT_VAR_REASON_FAILURE_MESSAGE ) set(multi_args FAILURE_MESSAGE_PREFIX ) cmake_parse_arguments(PARSE_ARGV 0 arg "${opt_args}" "${single_args}" "${multi_args}") _qt_internal_validate_all_args_are_parsed(arg) set(failure_message "QT_INTERNAL_SBOM_PYTHON_EXECUTABLE is missing a valid path to a python interpreter") if(arg_FAILURE_MESSAGE_PREFIX) list(PREPEND failure_message ${arg_FAILURE_MESSAGE_PREFIX}) endif() _qt_internal_sbom_handle_sbom_op_missing_dependency( VAR_TO_CHECK QT_INTERNAL_SBOM_PYTHON_EXECUTABLE FAILURE_MESSAGE ${failure_message} OUT_VAR_DEPS_FOUND deps_found OUT_VAR_REASON_FAILURE_MESSAGE reason ) if(arg_OUT_VAR_DEPS_FOUND) set(${arg_OUT_VAR_DEPS_FOUND} "${deps_found}" PARENT_SCOPE) endif() if(arg_OUT_VAR_REASON_FAILURE_MESSAGE) set(${arg_OUT_VAR_REASON_FAILURE_MESSAGE} "${reason}" PARENT_SCOPE) endif() endfunction() # Helper to assert that the python interpreter is available. function(_qt_internal_sbom_assert_python_interpreter_available error_message_prefix) _qt_internal_sbom_check_python_interpreter_available( FAILURE_MESSAGE_PREFIX ${error_message_prefix} OUT_VAR_DEPS_FOUND deps_found OUT_VAR_REASON_FAILURE_MESSAGE reason ) if(NOT deps_found) message(FATAL_ERROR ${reason}) endif() endfunction() # Helper to query whether an sbom python dependency is available, and also the error message if it # is not available. function(_qt_internal_sbom_check_python_dependency_available) set(opt_args "") set(single_args OUT_VAR_DEPS_FOUND OUT_VAR_REASON_FAILURE_MESSAGE VAR_TO_CHECK ) set(multi_args FAILURE_MESSAGE_PREFIX FAILURE_MESSAGE_SUFFIX ) cmake_parse_arguments(PARSE_ARGV 0 arg "${opt_args}" "${single_args}" "${multi_args}") _qt_internal_validate_all_args_are_parsed(arg) set(failure_message "Required Python dependencies NOT found: ") if(arg_FAILURE_MESSAGE_PREFIX) list(PREPEND failure_message ${arg_FAILURE_MESSAGE_PREFIX}) endif() if(arg_FAILURE_MESSAGE_SUFFIX) list(APPEND failure_message ${arg_FAILURE_MESSAGE_SUFFIX}) endif() _qt_internal_sbom_handle_sbom_op_missing_dependency( VAR_TO_CHECK ${arg_VAR_TO_CHECK} FAILURE_MESSAGE ${failure_message} OUT_VAR_DEPS_FOUND deps_found OUT_VAR_REASON_FAILURE_MESSAGE reason ) if(arg_OUT_VAR_DEPS_FOUND) set(${arg_OUT_VAR_DEPS_FOUND} "${deps_found}" PARENT_SCOPE) endif() if(arg_OUT_VAR_REASON_FAILURE_MESSAGE) set(${arg_OUT_VAR_REASON_FAILURE_MESSAGE} "${reason}" PARENT_SCOPE) endif() endfunction() # Helper to assert that an sbom python dependency is available. function(_qt_internal_sbom_assert_python_dependency_available key dep error_message_prefix) _qt_internal_sbom_check_python_dependency_available( VAR_TO_CHECK QT_INTERNAL_SBOM_DEPS_FOUND_FOR_${key} FAILURE_MESSAGE_PREFIX ${error_message_prefix} FAILURE_MESSAGE_SUFFIX ${dep} OUT_VAR_DEPS_FOUND deps_found OUT_VAR_REASON_FAILURE_MESSAGE reason ) if(NOT deps_found) message(FATAL_ERROR ${reason}) endif() endfunction() # Helper to query whether the json sbom generation dependency is available, and also the error # message if it is not available. function(_qt_internal_sbom_check_generate_json_dependency_available) set(opt_args "") set(single_args OUT_VAR_DEPS_FOUND OUT_VAR_REASON_FAILURE_MESSAGE ) set(multi_args "") cmake_parse_arguments(PARSE_ARGV 0 arg "${opt_args}" "${single_args}" "${multi_args}") _qt_internal_validate_all_args_are_parsed(arg) _qt_internal_sbom_check_python_dependency_available( VAR_TO_CHECK QT_INTERNAL_SBOM_DEPS_FOUND_FOR_GENERATE_JSON FAILURE_MESSAGE_SUFFIX "spdx_tools.spdx.clitools.pyspdxtools" OUT_VAR_DEPS_FOUND deps_found OUT_VAR_REASON_FAILURE_MESSAGE reason ) if(arg_OUT_VAR_DEPS_FOUND) set(${arg_OUT_VAR_DEPS_FOUND} "${deps_found}" PARENT_SCOPE) endif() if(arg_OUT_VAR_REASON_FAILURE_MESSAGE) set(${arg_OUT_VAR_REASON_FAILURE_MESSAGE} "${reason}" PARENT_SCOPE) endif() endfunction() # Helper to generate a SPDX JSON file from a tag/value format file. # This also implies some additional validity checks, useful to ensure a proper sbom file. function(_qt_internal_sbom_generate_json) set(error_message_prefix "Failed to generate an SBOM json file.") _qt_internal_sbom_assert_python_interpreter_available("${error_message_prefix}") _qt_internal_sbom_assert_python_dependency_available(GENERATE_JSON "spdx_tools.spdx.clitools.pyspdxtools" ${error_message_prefix}) set(content " message(STATUS \"Generating JSON: \${QT_SBOM_OUTPUT_PATH}.json\") execute_process( COMMAND \"${QT_INTERNAL_SBOM_PYTHON_EXECUTABLE}\" -m spdx_tools.spdx.clitools.pyspdxtools -i \"\${QT_SBOM_OUTPUT_PATH}\" -o \"\${QT_SBOM_OUTPUT_PATH}.json\" RESULT_VARIABLE res ) if(NOT res EQUAL 0) message(FATAL_ERROR \"Converting SBOM '\${QT_SBOM_OUTPUT_PATH}' to \" \"JSON failed with exit code: \${res}\") endif() ") _qt_internal_get_current_project_sbom_dir(sbom_dir) set(verify_sbom "${sbom_dir}/convert_to_json.cmake") file(GENERATE OUTPUT "${verify_sbom}" CONTENT "${content}") set_property(GLOBAL APPEND PROPERTY _qt_sbom_cmake_verify_include_files "${verify_sbom}") endfunction() # Helper to generate a CycloneDX JSON file from the intermediate .toml file created by the build # system. function(_qt_internal_sbom_generate_cydx_json) set(opt_args VERIFY VERIFY_REQUIRED VERBOSE ) set(single_args "") set(multi_args "") cmake_parse_arguments(PARSE_ARGV 0 arg "${opt_args}" "${single_args}" "${multi_args}") _qt_internal_validate_all_args_are_parsed(arg) set(error_message_prefix "Failed to generate a CycloneDX json file.") _qt_internal_sbom_assert_python_interpreter_available("${error_message_prefix}") _qt_internal_sbom_assert_python_dependency_available(GENERATE_CYCLONE_DX_V1_6 "cyclonedx" ${error_message_prefix}) _qt_internal_sbom_get_cyclone_dx_generator_path(generator_path) set(extra_args "") if(arg_VERIFY) list(APPEND extra_args "--validate-json") endif() if(arg_VERIFY_REQUIRED) list(APPEND extra_args "--validate-json-required") endif() if(arg_VERBOSE) list(APPEND extra_args "--verbose") endif() list(JOIN extra_args " " extra_args) set(content " message(STATUS \"Generating final CycloneDX JSON: \${QT_SBOM_OUTPUT_PATH_WITHOUT_EXT}.json\") execute_process( COMMAND \"${QT_INTERNAL_SBOM_PYTHON_EXECUTABLE}\" \"${generator_path}\" --input-path \"\${QT_SBOM_OUTPUT_PATH}\" --output-path \"\${QT_SBOM_OUTPUT_PATH_WITHOUT_EXT}.json\" ${extra_args} RESULT_VARIABLE res ) if(NOT res EQUAL 0) message(FATAL_ERROR \"CycloneDX JSON generation failed: \${res}\") endif() # Remove the intermediate toml file, there's no point in installing it. # Keep the one in the build dir, it's useful for debugging. if(NOT QT_SBOM_BUILD_TIME) message(STATUS \"Removing intermediate TOML file \${QT_SBOM_OUTPUT_PATH}\") file(REMOVE \"\${QT_SBOM_OUTPUT_PATH}\") endif() ") _qt_internal_get_current_project_sbom_dir(sbom_dir) set(generate_cydx "${sbom_dir}/generate_cyclone_dx.cmake") file(GENERATE OUTPUT "${generate_cydx}" CONTENT "${content}") set_property(GLOBAL APPEND PROPERTY _qt_sbom_cmake_post_generation_include_files_cydx "${generate_cydx}") endfunction() # Helper to query whether the all required dependencies are available to generate a tag / value # document from a json one. function(_qt_internal_sbom_verify_deps_for_generate_tag_value_spdx_document) set(opt_args "") set(single_args OUT_VAR_DEPS_FOUND OUT_VAR_REASON_FAILURE_MESSAGE ) set(multi_args "") cmake_parse_arguments(PARSE_ARGV 0 arg "${opt_args}" "${single_args}" "${multi_args}") _qt_internal_validate_all_args_are_parsed(arg) # First try to find dependencies, because they might not have been found yet. _qt_internal_sbom_find_and_handle_sbom_op_dependencies( OP_KEY "GENERATE_JSON" ) _qt_internal_sbom_check_python_interpreter_available( OUT_VAR_DEPS_FOUND python_found OUT_VAR_REASON_FAILURE_MESSAGE python_error ) _qt_internal_sbom_check_generate_json_dependency_available( OUT_VAR_DEPS_FOUND dep_found OUT_VAR_REASON_FAILURE_MESSAGE dep_error ) set(reasons "") if(python_error) string(APPEND reasons "${python_error}\n") endif() if(dep_error) string(APPEND reasons "${dep_error}\n") endif() if(python_found AND dep_found) set(deps_found "TRUE") else() set(deps_found "FALSE") endif() set(${arg_OUT_VAR_DEPS_FOUND} "${deps_found}" PARENT_SCOPE) set(${arg_OUT_VAR_REASON_FAILURE_MESSAGE} "${reasons}" PARENT_SCOPE) endfunction() # Helper to generate a tag/value SPDX file from a SPDX JSON format file. # # Will be used by WebEngine to convert the Chromium JSON file to a tag/value SPDX file. # # This conversion needs to happen before the document is referenced in the SBOM generation process, # so that the file already exists when it is parsed for its unique id and namespace. # It also needs to happen before verification codes are computed for the current document # that will depend on the target one, to ensure the the file exists and its checksum can be # computed. # # OPERATION_ID - a unique id for the operation, used to generate a unique cmake file name for # the SBOM generation process. # # INPUT_JSON_PATH - the absolute path to the input JSON file. # # OUTPUT_FILE_PATH - the absolute path where to create the output tag/value SPDX file. # Note that if the output file path is set, it is up to the caller to also copy / install the file # into the build and install directories where the build system expects to find all external # document references. # # OUTPUT_FILE_NAME - when OUTPUT_FILE_PATH is not specified, the output directory is automatically # set to the SBOM output directory. In this case OUTPUT_FILE_NAME can be used to override the # outout file name. If not specified, it will be derived from the input file name. # # OUT_VAR_OUTPUT_FILE_NAME - output variable where to store the output file. # # OUT_VAR_OUTPUT_ABSOLUTE_FILE_PATH - output variable where to store the output file path. # Note that the path will contain an unresolved '${QT_SBOM_OUTPUT_DIR}' which only has a value at # install time. So the path can't be used sensibly during configure time. # # OPTIONAL - whether the operation should return early, if the required python dependencies are # not found. OUT_VAR_DEPS_FOUND is still set in that case. # # OUT_VAR_DEPS_FOUND - output variable where to store whether the python dependencies for the # operation were found, and thus the conversion will be attempted. function(_qt_internal_sbom_generate_tag_value_spdx_document) if(NOT QT_GENERATE_SBOM) return() endif() set(opt_args OPTIONAL ) set(single_args OPERATION_ID INPUT_JSON_FILE_PATH OUTPUT_FILE_PATH OUTPUT_FILE_NAME OUT_VAR_OUTPUT_FILE_NAME OUT_VAR_OUTPUT_ABSOLUTE_FILE_PATH OUT_VAR_DEPS_FOUND ) set(multi_args "") cmake_parse_arguments(PARSE_ARGV 0 arg "${opt_args}" "${single_args}" "${multi_args}") _qt_internal_validate_all_args_are_parsed(arg) # First try to find dependencies, because they might not have been found yet. _qt_internal_sbom_find_and_handle_sbom_op_dependencies( OP_KEY "GENERATE_JSON" OUT_VAR_DEPS_FOUND deps_found ) if(arg_OPTIONAL) set(deps_are_required FALSE) else() set(deps_are_required TRUE) endif() # If the operation has to succeed, then the deps are required. Assert they are available. if(deps_are_required) set(error_message_prefix "Failed to generate a tag/value SBOM file from a json SBOM file.") _qt_internal_sbom_assert_python_interpreter_available("${error_message_prefix}") _qt_internal_sbom_assert_python_dependency_available(GENERATE_JSON "spdx_tools.spdx.clitools.pyspdxtools" ${error_message_prefix}) # If the operation is optional, don't error out if the deps are not found, but silently return # and mention that the deps are not found. elseif(NOT deps_found) set(${arg_OUT_VAR_DEPS_FOUND} "${deps_found}" PARENT_SCOPE) return() endif() set(${arg_OUT_VAR_DEPS_FOUND} "${deps_found}" PARENT_SCOPE) if(NOT arg_OPERATION_ID) message(FATAL_ERROR "OPERATION_ID is required") endif() if(NOT arg_INPUT_JSON_FILE_PATH) message(FATAL_ERROR "INPUT_JSON_FILE_PATH is required") endif() if(arg_OUTPUT_FILE_PATH) set(output_path "${arg_OUTPUT_FILE_PATH}") else() if(arg_OUTPUT_FILE_NAME) set(output_name "${arg_OUTPUT_FILE_NAME}") else() # Use the input file name without the last extension (without .json) as the output name. get_filename_component(output_name "${arg_INPUT_JSON_FILE_PATH}" NAME_WLE) endif() set(output_path "\${QT_SBOM_OUTPUT_DIR}/${output_name}") endif() if(arg_OUT_VAR_OUTPUT_FILE_NAME) get_filename_component(output_name_resolved "${output_path}" NAME) set(${arg_OUT_VAR_OUTPUT_FILE_NAME} "${output_name_resolved}" PARENT_SCOPE) endif() if(arg_OUT_VAR_OUTPUT_ABSOLUTE_FILE_PATH) set(${arg_OUT_VAR_OUTPUT_ABSOLUTE_FILE_PATH} "${output_path}" PARENT_SCOPE) endif() set(content " message(STATUS \"Generating tag/value SPDX document: ${output_path} from \" \"${arg_INPUT_JSON_FILE_PATH}\") execute_process( COMMAND \"${QT_INTERNAL_SBOM_PYTHON_EXECUTABLE}\" -m spdx_tools.spdx.clitools.pyspdxtools -i \"${arg_INPUT_JSON_FILE_PATH}\" -o \"${output_path}\" RESULT_VARIABLE res ) if(NOT res EQUAL 0) message(FATAL_ERROR \"SBOM conversion to tag/value failed: \${res}\") endif() ") _qt_internal_get_current_project_sbom_dir(sbom_dir) set(convert_sbom "${sbom_dir}/convert_to_tag_value_${arg_OPERATION_ID}.cmake") file(GENERATE OUTPUT "${convert_sbom}" CONTENT "${content}") set_property(GLOBAL APPEND PROPERTY _qt_sbom_cmake_include_files "${convert_sbom}") endfunction() # Helper to verify the generated sbom is valid. function(_qt_internal_sbom_verify_valid) set(error_message_prefix "Failed to verify SBOM file syntax.") _qt_internal_sbom_assert_python_interpreter_available("${error_message_prefix}") _qt_internal_sbom_assert_python_dependency_available(VERIFY_SBOM "spdx_tools.spdx.clitools.pyspdxtools" ${error_message_prefix}) set(content " message(STATUS \"Verifying: \${QT_SBOM_OUTPUT_PATH}\") execute_process( COMMAND \"${QT_INTERNAL_SBOM_PYTHON_EXECUTABLE}\" -m spdx_tools.spdx.clitools.pyspdxtools -i \"\${QT_SBOM_OUTPUT_PATH}\" RESULT_VARIABLE res ) if(NOT res EQUAL 0) message(FATAL_ERROR \"SBOM verification failed: \${res}\") endif() ") _qt_internal_get_current_project_sbom_dir(sbom_dir) set(verify_sbom "${sbom_dir}/verify_valid.cmake") file(GENERATE OUTPUT "${verify_sbom}" CONTENT "${content}") set_property(GLOBAL APPEND PROPERTY _qt_sbom_cmake_verify_include_files "${verify_sbom}") endfunction() # Helper to verify the generated sbom is NTIA compliant. function(_qt_internal_sbom_verify_ntia_compliant) set(error_message_prefix "Failed to run NTIA checker on SBOM file.") _qt_internal_sbom_assert_python_interpreter_available("${error_message_prefix}") _qt_internal_sbom_assert_python_dependency_available(RUN_NTIA "ntia_conformance_checker.main" ${error_message_prefix}) set(content " message(STATUS \"Checking for NTIA compliance: \${QT_SBOM_OUTPUT_PATH}\") execute_process( COMMAND \"${QT_INTERNAL_SBOM_PYTHON_EXECUTABLE}\" -m ntia_conformance_checker.main --file \"\${QT_SBOM_OUTPUT_PATH}\" RESULT_VARIABLE res ) if(NOT res EQUAL 0) message(FATAL_ERROR \"SBOM NTIA verification failed: \${res}\") endif() ") _qt_internal_get_current_project_sbom_dir(sbom_dir) set(verify_sbom "${sbom_dir}/verify_ntia.cmake") file(GENERATE OUTPUT "${verify_sbom}" CONTENT "${content}") set_property(GLOBAL APPEND PROPERTY _qt_sbom_cmake_verify_include_files "${verify_sbom}") endfunction() # Helper to show the main sbom document info in the form of a CLI table. function(_qt_internal_sbom_show_table) set(extra_code_begin "") if(DEFINED ENV{COIN_UNIQUE_JOB_ID}) # The output of the process dynamically adjusts the width of the shown table based on the # console width. In the CI, the width is very short for some reason, and thus the output # is truncated in the CI log. Explicitly set a bigger width to avoid this. set(extra_code_begin " set(backup_env_columns \$ENV{COLUMNS}) set(ENV{COLUMNS} 150) ") set(extra_code_end " set(ENV{COLUMNS} \${backup_env_columns}) ") endif() set(content " message(STATUS \"Showing main SBOM document info: \${QT_SBOM_OUTPUT_PATH}\") ${extra_code_begin} execute_process( COMMAND \"${QT_SBOM_PROGRAM_SBOM2DOC}\" -i \"\${QT_SBOM_OUTPUT_PATH}\" RESULT_VARIABLE res ) ${extra_code_end} if(NOT res EQUAL 0) message(FATAL_ERROR \"Showing SBOM document failed: \${res}\") endif() ") _qt_internal_get_current_project_sbom_dir(sbom_dir) set(verify_sbom "${sbom_dir}/show_table.cmake") file(GENERATE OUTPUT "${verify_sbom}" CONTENT "${content}") set_property(GLOBAL APPEND PROPERTY _qt_sbom_cmake_verify_include_files "${verify_sbom}") endfunction() # Helper to audit the generated sbom. function(_qt_internal_sbom_audit) set(opt_args NO_ERROR) set(single_args "") set(multi_args "") cmake_parse_arguments(PARSE_ARGV 0 arg "${opt_args}" "${single_args}" "${multi_args}") _qt_internal_validate_all_args_are_parsed(arg) set(handle_error "") if(NOT arg_NO_ERROR) set(handle_error " if(NOT res EQUAL 0) message(FATAL_ERROR \"SBOM Audit failed: \${res}\") endif() ") endif() set(content " message(STATUS \"Auditing SBOM: \${QT_SBOM_OUTPUT_PATH}\") execute_process( COMMAND \"${QT_SBOM_PROGRAM_SBOMAUDIT}\" -i \"\${QT_SBOM_OUTPUT_PATH}\" --disable-license-check --cpecheck --offline RESULT_VARIABLE res ) ${handle_error} ") _qt_internal_get_current_project_sbom_dir(sbom_dir) set(verify_sbom "${sbom_dir}/audit.cmake") file(GENERATE OUTPUT "${verify_sbom}" CONTENT "${content}") set_property(GLOBAL APPEND PROPERTY _qt_sbom_cmake_verify_include_files "${verify_sbom}") endfunction() # Returns path to project's potential root source reuse.toml file. function(_qt_internal_sbom_get_project_reuse_toml_path out_var) set(reuse_toml_path "${PROJECT_SOURCE_DIR}/REUSE.toml") set(${out_var} "${reuse_toml_path}" PARENT_SCOPE) endfunction() # Shows reuse.toml not found message. function(_qt_internal_sbom_show_skip_source_sbom_message reuse_toml_path) message(STATUS "Skipping source SBOM generation: No reuse.toml file found at '${reuse_toml_path}'.") endfunction() # Helper that generates a source SPDX sbom using 'reuse' and then verifies it with the # tst_licenses.pl script from qtqa if the verification flag is set. function(_qt_internal_sbom_generate_and_verify_reuse_source_sbom_helper) set(opt_args NO_ERROR VERIFY_SOURCE_SBOM FORCE_SOURCE_SBOM_GENERATION ) set(single_args REUSE_PATH LICENSE_TEST_SCRIPT_PATH LICENSE_TEST_SCRIPT_WORKING_DIR REUSE_TOML_PATH PROJECT_SOURCE_DIR PROJECT_SUPPLIER PROJECT_SUPPLIER_URL SOURCE_SBOM_OUTPUT_PATH ) set(multi_args "") cmake_parse_arguments(PARSE_ARGV 0 arg "${opt_args}" "${single_args}" "${multi_args}") _qt_internal_validate_all_args_are_parsed(arg) set(reuse_toml_path "${arg_REUSE_TOML_PATH}") if(NOT EXISTS "${reuse_toml_path}" AND NOT arg_FORCE_SOURCE_SBOM_GENERATION) _qt_internal_sbom_show_skip_source_sbom_message("${reuse_toml_path}") return() endif() set(extra_reuse_args "") if(arg_PROJECT_SUPPLIER) set(project_supplier "${arg_PROJECT_SUPPLIER}") # Add the supplier url if available. Add it in parenthesis to stop reuse from adding its # own empty parenthesis. if(arg_PROJECT_SUPPLIER_URL) string(APPEND project_supplier " (${arg_PROJECT_SUPPLIER_URL})") endif() # Unfortunately there's no way to silence the addition of the 'Creator: Person' field, # even though 'Creator: Organization' is supplied. list(APPEND extra_reuse_args --creator-organization "${project_supplier}") endif() message(STATUS "Generating source SBOM using reuse tool: ${arg_SOURCE_SBOM_OUTPUT_PATH}") execute_process( COMMAND "${arg_REUSE_PATH}" --root "${arg_PROJECT_SOURCE_DIR}" spdx -o "${arg_SOURCE_SBOM_OUTPUT_PATH}" ${extra_reuse_args} RESULT_VARIABLE res ) if(NOT arg_NO_ERROR AND NOT res EQUAL 0) message(FATAL_ERROR "Source SBOM generation using reuse tool failed: Result: '${res}'") endif() if(arg_VERIFY_SOURCE_SBOM AND res EQUAL 0) file(TO_CMAKE_PATH "${arg_LICENSE_TEST_SCRIPT_PATH}" full_path_to_license_test) set(license_test_script_working_dir "${arg_LICENSE_TEST_SCRIPT_WORKING_DIR}") message(STATUS "Verifying source SBOM '${arg_SOURCE_SBOM_OUTPUT_PATH}' using qtqa tst_licenses.pl " "at '${full_path_to_license_test}'") if(NOT EXISTS "${full_path_to_license_test}") message(FATAL_ERROR "Source SBOM check has failed: The tst_licenses.pl script could not be found at " "'${full_path_to_license_test}'") endif() execute_process( COMMAND perl "${full_path_to_license_test}" -sbomonly -sbom "${arg_SOURCE_SBOM_OUTPUT_PATH}" WORKING_DIRECTORY "${license_test_script_working_dir}" RESULT_VARIABLE res COMMAND_ECHO STDOUT ) if(NOT res EQUAL 0) message(FATAL_ERROR "Source SBOM check has failed: Result: '${res}'") endif() endif() endfunction() # Helper to create a script that will generate and install a source SBOM using the 'reuse' tool, # and optionally verify the SBOM using the qtqa tst_licenses.pl script if the necessary env vars # are set (which are usually set by the CI instructions). # The generated script runs at install time, or during build time in the 'sbom' custom target. function(_qt_internal_sbom_generate_reuse_source_sbom) set(opt_args NO_ERROR) set(single_args "") set(multi_args "") cmake_parse_arguments(PARSE_ARGV 0 arg "${opt_args}" "${single_args}" "${multi_args}") _qt_internal_validate_all_args_are_parsed(arg) set(func_args "") _qt_internal_sbom_get_project_reuse_toml_path(reuse_toml_path) list(APPEND func_args REUSE_TOML_PATH "${reuse_toml_path}") if(QT_FORCE_SOURCE_SBOM_GENERATION) list(APPEND func_args FORCE_SOURCE_SBOM_GENERATION) endif() if(arg_NO_ERROR) list(APPEND func_args NO_ERROR) endif() if(NOT EXISTS "${reuse_toml_path}" AND NOT QT_FORCE_SOURCE_SBOM_GENERATION) _qt_internal_sbom_show_skip_source_sbom_message("${reuse_toml_path}") # Fall through to create the driving script anyway, to show the message at install time # too. endif() set(source_sbom_path "\${QT_SBOM_OUTPUT_PATH_WITHOUT_EXT}.source.spdx") list(APPEND func_args SOURCE_SBOM_OUTPUT_PATH "${source_sbom_path}") # Pass the license test info if the env vars are available. set(maybe_qt_qa_license_test_dir "$ENV{QT_QA_LICENSE_TEST_DIR}") set(maybe_qt_source_sbom_test_script "$ENV{QT_SOURCE_SBOM_TEST_SCRIPT}") if(maybe_qt_qa_license_test_dir AND maybe_qt_source_sbom_test_script) # Avoid backslashes on Windows. file(TO_CMAKE_PATH "${maybe_qt_qa_license_test_dir}/${maybe_qt_source_sbom_test_script}" license_test_script_path) file(TO_CMAKE_PATH "${maybe_qt_qa_license_test_dir}" license_test_script_working_dir) list(APPEND func_args LICENSE_TEST_SCRIPT_PATH "${license_test_script_path}" LICENSE_TEST_SCRIPT_WORKING_DIR "${license_test_script_working_dir}" ) endif() get_property(project_supplier GLOBAL PROPERTY _qt_sbom_project_supplier) if(project_supplier) list(APPEND func_args PROJECT_SUPPLIER "${project_supplier}") get_property(project_supplier_url GLOBAL PROPERTY _qt_sbom_project_supplier_url) if(project_supplier_url) list(APPEND func_args PROJECT_SUPPLIER_URL "${project_supplier_url}") endif() endif() list(APPEND func_args PROJECT_SOURCE_DIR "${PROJECT_SOURCE_DIR}" REUSE_PATH "${QT_SBOM_PROGRAM_REUSE}" ) set(verify_source_sbom_env "$ENV{VERIFY_SOURCE_SBOM}") if(verify_source_sbom_env) list(APPEND func_args VERIFY_SOURCE_SBOM) endif() # Join the args in a way that it looks nice in the generated script file, as well # as quoting values just in case. set(func_args_wrapped "") foreach(func_arg IN LISTS func_args) list(APPEND func_args_wrapped "\"${func_arg}\"") endforeach() list(JOIN func_args_wrapped "\n " func_args_pretty) set(content " _qt_internal_sbom_generate_and_verify_reuse_source_sbom_helper( ${func_args_pretty} ) ") _qt_internal_get_current_project_sbom_dir(sbom_dir) set(file_op "${sbom_dir}/generate_reuse_source_sbom.cmake") file(GENERATE OUTPUT "${file_op}" CONTENT "${content}") set_property(GLOBAL APPEND PROPERTY _qt_sbom_cmake_post_generation_include_files "${file_op}") # Used by separate build target. set_property(GLOBAL PROPERTY _qt_sbom_verify_source_sbom_script "${file_op}") endfunction() # Helper to create a build time custom target that generates and license checks the source SBOM. # The new target will be used in the CI to run the license verification earlier. function(_qt_internal_sbom_add_verify_source_sbom_build_time_target) set(opt_args "") set(single_args REPO_PROJECT_NAME_LOWERCASE SBOM_BUILD_OUTPUT_DIR SBOM_BUILD_OUTPUT_PATH_WITHOUT_EXT ) set(multi_args "") cmake_parse_arguments(PARSE_ARGV 0 arg "${opt_args}" "${single_args}" "${multi_args}") _qt_internal_validate_all_args_are_parsed(arg) # Add per-repo custom targets which generate a spdx source sbom in the build dir and optionally # runs the perl license checker on the output (if the required env vars are set). # If the script exists, it means the builder opted into the feature and we can create the # build target. get_cmake_property(verify_script _qt_sbom_verify_source_sbom_script) if(NOT verify_script) return() endif() get_property(macro_module_base_dir GLOBAL PROPERTY __qt_sbom_generation_helpers_base_dir) set(content " # Include helpers functions. include(\"${macro_module_base_dir}/QtPublicCMakeIncludeGuardHelpers.cmake\") include(\"${macro_module_base_dir}/QtPublicCMakeHelpers.cmake\") include(\"${macro_module_base_dir}/QtPublicSbomOpsHelpers.cmake\") # Setup required vars set(QT_SBOM_OUTPUT_PATH_WITHOUT_EXT \"${arg_SBOM_BUILD_OUTPUT_PATH_WITHOUT_EXT}\") # Create the dir file(MAKE_DIRECTORY \"${arg_SBOM_BUILD_OUTPUT_DIR}\") # Include actual script. include(\"${verify_script}\") ") _qt_internal_get_current_project_sbom_dir(sbom_dir) set(script_wrapper "${sbom_dir}/run_sbom_source_verify_build_time_${arg_REPO_PROJECT_NAME_LOWERCASE}.cmake") file(GENERATE OUTPUT "${script_wrapper}" CONTENT "${content}") string(CONCAT comment "Generating source sbom and verifying licenses for " "'${arg_REPO_PROJECT_NAME_LOWERCASE}'.") set(repo_sbom_target "sbom_${arg_REPO_PROJECT_NAME_LOWERCASE}") add_custom_target(${repo_sbom_target}_source_verify COMMAND "${CMAKE_COMMAND}" -P "${script_wrapper}" COMMENT "${comment}" VERBATIM USES_TERMINAL # To avoid running multiple repo verifications in parallel ) if(NOT TARGET sbom_source_verify) add_custom_target(sbom_source_verify) endif() add_dependencies(sbom_source_verify ${repo_sbom_target}_source_verify) endfunction() # Creates or removes a file in the build dir depending on whether the sbom_source_verify target # was created. This is used as a marker file for the CI to decide whether to run the source SBOM # verification step. function(_qt_internal_update_sbom_source_verify_file_marker_for_ci) if(NOT DEFINED ENV{COIN_UNIQUE_JOB_ID} AND NOT QT_FORCE_UPDATE_SBOM_SOURCE_VERIFY_MARKER_FILE) return() endif() set(marker_path "${CMAKE_BINARY_DIR}/sbom_source_verify_should_run_in_ci.txt") if(TARGET sbom_source_verify) if(NOT EXISTS "${marker_path}") file(TOUCH "${marker_path}") endif() elseif(EXISTS "${marker_path}") file(REMOVE "${marker_path}") endif() endfunction() # Helper to run 'reuse lint' on the project source dir. function(_qt_internal_sbom_run_reuse_lint) set(opt_args NO_ERROR ) set(single_args "") set(multi_args "") cmake_parse_arguments(PARSE_ARGV 0 arg "${opt_args}" "${single_args}" "${multi_args}") _qt_internal_validate_all_args_are_parsed(arg) # If no reuse.toml file exists, it means the repo is likely not reuse compliant yet, # so we shouldn't error out during installation when running the lint. _qt_internal_sbom_get_project_reuse_toml_path(reuse_toml_path) if(NOT EXISTS "${reuse_toml_path}" AND NOT QT_FORCE_REUSE_LINT_ERROR) set(arg_NO_ERROR TRUE) endif() set(handle_error "") if(NOT arg_NO_ERROR) set(handle_error " if(NOT res EQUAL 0) message(FATAL_ERROR \"Running 'reuse lint' failed: \${res}\") endif() ") endif() set(content " message(STATUS \"Running 'reuse lint' in '${PROJECT_SOURCE_DIR}'.\") execute_process( COMMAND \"${QT_SBOM_PROGRAM_REUSE}\" --root \"${PROJECT_SOURCE_DIR}\" lint RESULT_VARIABLE res ) ${handle_error} ") _qt_internal_get_current_project_sbom_dir(sbom_dir) set(file_op_build "${sbom_dir}/run_reuse_lint_build.cmake") file(GENERATE OUTPUT "${file_op_build}" CONTENT "${content}") # Allow skipping running 'reuse lint' during installation. But still allow running it during # build time. This is a fail safe opt-out in case some repo needs it. if(QT_FORCE_SKIP_REUSE_LINT_ON_INSTALL) set(skip_message "Skipping running 'reuse lint' in '${PROJECT_SOURCE_DIR}'.") set(content " message(STATUS \"${skip_message}\") ") set(file_op_install "${sbom_dir}/run_reuse_lint_install.cmake") file(GENERATE OUTPUT "${file_op_install}" CONTENT "${content}") else() # Just reuse the already generated script for installation as well. set(file_op_install "${file_op_build}") endif() set_property(GLOBAL APPEND PROPERTY _qt_sbom_cmake_verify_include_files "${file_op_install}") set_property(GLOBAL APPEND PROPERTY _qt_sbom_cmake_reuse_lint_build_time_script "${file_op_build}") endfunction()