added parsing spdx-license-headers

Signed-off-by: Luis Augenstein <luis.augenstein@tngtech.com>

Author: augelu-tng

sbom/lib/sbom/spdx_graph/kernel_file.py

@@ -5,6 +5,7 @@
 import hashlib
 import logging
 import os
+import re
 from typing import Any, Literal
 from sbom.path_utils import PathStr, is_relative_to
 from sbom.spdx.core import Hash
@@ -15,17 +16,22 @@
 
 @dataclass(kw_only=True)
 class KernelFile(File):
-    """SPDX File Element annotated with additional metadata"""
+    """SPDX file element with kernel-specific metadata."""
 
     absolute_path: PathStr
+    """Absolute file system path."""
 
     tree: Literal["src_tree", "output_tree"] | None
-    """Determines whether the file lives in the source tree, the output tree or outside of both"""
+    """File location: source tree, output tree, or external."""
+
+    license_identifier: str | None
+    """SPDX license ID if from source tree; otherwise None."""
 
     def to_dict(self) -> dict[str, Any]:
         d = super().to_dict()
         d.pop("absolute_path", None)
         d.pop("tree", None)
+        d.pop("license_identifier", None)
         return d
 
 
@@ -53,12 +59,16 @@ def build_kernel_file_element(absolute_path: PathStr, output_tree: PathStr, src_
     else:
         logging.warning(f"Cannot compute hash for {absolute_path} because file does not exist.")
 
+    # parse spdx license identifier
+    license_identifier = _parse_spdx_license_identifier(absolute_path) if tree == "src_tree" else None
+
     file_element = KernelFile(
         spdxId=generate_spdx_id("software_File", file_element_name),
         name=file_element_name,
         verifiedUsing=verifiedUsing,
         absolute_path=absolute_path,
         tree=tree,
+        license_identifier=license_identifier,
     )
 
     return file_element
@@ -69,3 +79,29 @@ def _sha256(path: PathStr) -> str:
     with open(path, "rb") as f:
         data = f.read()
     return hashlib.sha256(data).hexdigest()
+
+
+SPDX_LICENSE_IDENTIFIER_PATTERN = re.compile(
+    r"SPDX-License-Identifier:\s*(?P<id>[^\s]+(?:\s+(?:AND|OR|WITH)\s+[^\s]+)*)",
+    re.IGNORECASE,
+)
+
+
+def _parse_spdx_license_identifier(absolute_path: str, max_lines: int = 5) -> str | None:
+    """
+    Extracts the SPDX-License-Identifier from the first few lines of a source file.
+
+    Args:
+        absolute_path: Path to the source file.
+        max_lines: Number of lines to scan from the top (default: 5).
+
+    Returns:
+        The license identifier string (e.g., 'GPL-2.0-only') if found, otherwise None.
+    """
+    with open(absolute_path, "r") as f:
+        for _ in range(max_lines):
+            match = SPDX_LICENSE_IDENTIFIER_PATTERN.search(f.readline())
+            if match:
+                return match.group("id")
+    logging.warning(f"Failed to parse SPDX-License-Identifier from {absolute_path}")
+    return None

sbom/lib/sbom/spdx_graph/spdx_graph.py

@@ -1,11 +1,11 @@
 # SPDX-License-Identifier: GPL-2.0-only
 # SPDX-FileCopyrightText: 2025 TNG Technology Consulting GmbH
 
+from typing import Mapping
 from sbom.cmd_graph.cmd_graph import CmdGraph, iter_cmd_graph
 from sbom.path_utils import PathStr
 from sbom.spdx.build import Build
 from sbom.spdx.core import (
-    Element,
     SoftwareAgent,
     SpdxObject,
     CreationInfo,
@@ -27,6 +27,7 @@ def build_spdx_graph(
     package_license: str,
     build_version: str,
 ) -> list[SpdxObject]:
+    # Main Skeletton
     spdx_document = SpdxDocument(profileConformance=["core", "software", "build", "simpleLicensing"])
     agent = SoftwareAgent(name="KernelSbom")
     creation_info = CreationInfo(createdBy=[agent])
@@ -53,16 +54,6 @@ def build_spdx_graph(
         from_=output_tree_element,
         to=[],
     )
-    src_and_output_tree_elements: list[Element] = (
-        [
-            src_tree_element,
-            src_tree_contains_relationship,
-            output_tree_element,
-            output_tree_contains_relationship,
-        ]
-        if src_tree != output_tree
-        else []
-    )
 
     # package elements
     package = Package(
@@ -82,29 +73,55 @@ def build_spdx_graph(
         to=[],
     )
 
-    file_elements, build_and_relationship_elements = _build_kernel_file_graph(
-        cmd_graph, output_tree, src_tree, spdx_uri_prefix
-    )
+    # file elements
+    files: dict[PathStr, KernelFile] = {
+        node.absolute_path: build_kernel_file_element(node.absolute_path, output_tree, src_tree)
+        for node in iter_cmd_graph(cmd_graph)
+    }
+    file_relationships = _build_file_relationships(cmd_graph, files, spdx_uri_prefix)
+    file_license_identifiers = {
+        file.license_identifier: LicenseExpression(simplelicensing_licenseExpression=file.license_identifier)
+        for file in files.values()
+        if file.license_identifier is not None
+    }
+    file_license_relationships = [
+        Relationship(
+            relationshipType="hasDeclaredLicense",
+            from_=file,
+            to=[file_license_identifiers[file.license_identifier]],
+        )
+        for file in files.values()
+        if file.license_identifier is not None
+    ]
 
     # update relationships
     spdx_document.rootElement = [sbom]
 
     sbom.rootElement = [package]
     sbom.element = [
-        *src_and_output_tree_elements,
         package,
         package_license_expression,
         package_hasDeclaredLicense_relationship,
         package_contains_roots_relationship,
-        *file_elements,
-        *build_and_relationship_elements,
+        *files.values(),
+        *file_relationships,
+        *file_license_identifiers.values(),
+        *file_license_relationships,
     ]
 
-    src_tree_contains_relationship.to = [file for file in file_elements if file.tree == "src_tree"]
-    output_tree_contains_relationship.to = [file for file in file_elements if file.tree == "output_tree"]
-
     root_paths = {node.absolute_path for node in cmd_graph.roots}
-    package_contains_roots_relationship.to = [file for file in file_elements if file.absolute_path in root_paths]
+    package_contains_roots_relationship.to = [file for file in files.values() if file.absolute_path in root_paths]
+
+    if src_tree != output_tree:
+        sbom.element = [
+            src_tree_element,
+            src_tree_contains_relationship,
+            output_tree_element,
+            output_tree_contains_relationship,
+            *sbom.element,
+        ]
+        src_tree_contains_relationship.to = [file for file in files.values() if file.tree == "src_tree"]
+        output_tree_contains_relationship.to = [file for file in files.values() if file.tree == "output_tree"]
 
     return [
         spdx_document,
@@ -115,19 +132,10 @@ def build_spdx_graph(
     ]
 
 
-def _build_kernel_file_graph(
-    cmd_graph: CmdGraph,
-    output_tree: PathStr,
-    src_tree: PathStr,
-    spdx_uri_prefix: str,
-) -> tuple[list[KernelFile], list[Build | Relationship]]:
-    # First cmd graph traversal: create a file element for each node
-    file_elements: dict[PathStr, KernelFile] = {
-        node.absolute_path: build_kernel_file_element(node.absolute_path, output_tree, src_tree)
-        for node in iter_cmd_graph(cmd_graph)
-    }
-
-    # Second cmd graph traversal: create a relationship for each (child)node representing the generation of all its parents
+def _build_file_relationships(
+    cmd_graph: CmdGraph, file_elements: Mapping[PathStr, File], spdx_uri_prefix: str
+) -> list[Build | Relationship]:
+    # create a relationship between each node (output file) and its children (input files)
     build_and_relationship_elements: list[Build | Relationship] = []
     for node in iter_cmd_graph(cmd_graph):
         if len(node.children) == 0:
@@ -152,4 +160,4 @@ def _build_kernel_file_graph(
         )
         build_and_relationship_elements += [build_element, hasInput_relationship, hasOutput_relationship]
 
-    return list(file_elements.values()), build_and_relationship_elements
+    return build_and_relationship_elements