aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorLei Maohui <leimaohui@fujitsu.com>2021-12-15 16:27:52 +0900
committerLei Maohui <leimaohui@fujitsu.com>2021-12-15 16:27:52 +0900
commit2e86ac7daf46f5263cb75d357123ae396a6098fc (patch)
tree38940e9b330e64380e3889f6c81a028aa2d5ca0c
parent5f3f603c70777387ff6359c1af987e774d188436 (diff)
parent4bf7a5ce2b6581aa28b78ec6528e8da1c4879ea8 (diff)
downloadmeta-spdxscanner-honister.tar.gz
meta-spdxscanner-honister.tar.bz2
meta-spdxscanner-honister.zip
Merge branch 'master' into honisterhonister
-rw-r--r--README.md30
-rw-r--r--classes/blackduck-upload.bbclass176
-rw-r--r--recipes-devtools/synopsys/synopsys-7.0.0/LICENSE1
-rw-r--r--recipes-devtools/synopsys/synopsys-native_7.0.0.bb26
4 files changed, 221 insertions, 12 deletions
diff --git a/README.md b/README.md
index eb0c389..9364712 100644
--- a/README.md
+++ b/README.md
@@ -1,11 +1,13 @@
# meta-spdxscanner
-meta-spdxscanner supports the following SPDX create tools.
-1. fossology python REST API
-2. fossology REST API (by curl)
-3. scancode-toolkit
+1.meta-spdxscanner supports the following SPDX create tools.
+- fossology python REST API
+- fossology REST API (by curl)
-# This layer supplys invoking scanners as following:
+2.meta-spdxscanner supports upload OSS source code to blackduck server by Synopsys Detect.
+- blackduck-upload.bbclass
+
+# DEPENDS
1. fossology-python.bbclass (https://github.com/fossology/fossology-python)
- openembedded-core
@@ -17,7 +19,7 @@ meta-spdxscanner supports the following SPDX create tools.
- openembedded-core
- meta-oe/meta-python
-3. scancode-tk.bbclass (https://github.com/oss-review-toolkit/ort)
+3. blackduck-upload.bbclass
- openembedded-core
# How to use
@@ -56,16 +58,20 @@ Note
Please reference to https://hub.docker.com/r/fossology/fossology/.
- TOKEN can be created on fossology server after login by "Admin"->"Users"->"Edit user account"->"Create a new token".
-3. scancode-tk.bbclass
+3. blackduck-upload.bbclass
- inherit the folowing class in your conf/local.conf for all of recipes or
in some recipes which you want.
```
- INHERIT += "scancode-tk"
- SPDX_DEPLOY_DIR = "${DeployDir}" //Optional, by default, spdx files will be deployed to ${BUILD_DIR}/tmp/deploy/spdx/
+INHERIT += "blackduck-upload"
+BD_URI = "https://xxx.yyy.com/"
+PRO_NAME = "xxx"
+PRO_VER = "xxx"
+PROXY_HOST = "xxx"
+PROXY_PORT = "xxxx"
+PROXY_UN = "xxx"
+PROXY_PW = "xxxx"
+TOKEN = "NmJ..."
```
-Note
-- scancode-tk has to install on host development under python2. So, please make sure that python2 exists on your build server.
-- If you want to use scancode.bbclass, There is no need to install anything on your host.
diff --git a/classes/blackduck-upload.bbclass b/classes/blackduck-upload.bbclass
new file mode 100644
index 0000000..cad3ad5
--- /dev/null
+++ b/classes/blackduck-upload.bbclass
@@ -0,0 +1,176 @@
+# This class upload source code of OSS by Synopsys Detect during the building process.
+#
+# For more information on Synopsys Detect(CLI):
+# https://synopsys.atlassian.net/wiki/
+#
+# For more information on SPDX:
+# http://www.spdx.org
+#
+# Note:
+HOSTTOOLS += "java"
+
+#SPDXEPENDENCY += "synopsys-native:do_populate_sysroot"
+
+COPYLEFT_RECIPE_TYPES ?= 'target nativesdk'
+inherit copyleft_filter
+
+inherit spdx-common
+
+do_upload[dirs] = "${SPDX_TOPDIR}"
+
+WAIT_TIME ?= "20"
+
+python () {
+
+ #If not for target, won't creat spdx.
+ if bb.data.inherits_class('nopackages', d):
+ return
+
+ pn = d.getVar('PN')
+ assume_provided = (d.getVar("ASSUME_PROVIDED") or "").split()
+ if pn in assume_provided:
+ for p in d.getVar("PROVIDES").split():
+ if p != pn:
+ pn = p
+ break
+
+ # glibc-locale: do_fetch, do_unpack and do_patch tasks have been deleted,
+ # so avoid archiving source here.
+ if pn.startswith('glibc-locale'):
+ return
+ if (d.getVar('PN') == "libtool-cross"):
+ return
+ if (d.getVar('PN') == "libgcc-initial"):
+ return
+ if (d.getVar('PN') == "shadow-sysroot"):
+ return
+
+ # We just archive gcc-source for all the gcc related recipes
+ if d.getVar('BPN') in ['gcc', 'libgcc']:
+ bb.debug(1, 'spdx: There is bug in scan of %s is, do nothing' % pn)
+ return
+
+ temp_dir = os.path.join(d.getVar('WORKDIR'), "temp")
+
+ info = {}
+ info['workdir'] = d.getVar('WORKDIR') or ""
+ info['pn'] = d.getVar( 'PN') or ""
+ info['pv'] = d.getVar( 'PV') or ""
+
+ manifest_dir = d.getVar('SPDX_DEPLOY_DIR') or ""
+ if not os.path.exists( manifest_dir ):
+ bb.utils.mkdirhier( manifest_dir )
+
+ def hasTask(task):
+ return bool(d.getVarFlag(task, "task", False)) and not bool(d.getVarFlag(task, "noexec", False))
+
+ if d.getVar('PACKAGES'):
+ # Some recipes do not have any packaging tasks
+ if hasTask("do_package_write_rpm") or hasTask("do_package_write_ipk") or hasTask("do_package_write_deb"):
+ d.appendVarFlag('do_bd_upload', 'depends', ' synopsys-native:do_populate_sysroot')
+ d.appendVarFlag('do_bd_upload', 'depends', ' %s:do_spdx_creat_tarball' % pn)
+ d.appendVarFlag('do_synopsys_detect', 'depends', ' %s:do_bd_upload' % pn)
+ bb.build.addtask('do_bd_upload', 'do_configure', 'do_patch', d)
+ bb.build.addtask('do_synopsys_detect', 'do_configure', 'do_bd_upload', d)
+}
+
+python do_bd_upload(){
+ import logging, shutil,time
+
+ if bb.data.inherits_class('nopackages', d):
+ return
+
+ logger = logging.getLogger()
+ logger.setLevel(logging.INFO)
+ logging.basicConfig(level=logging.INFO)
+
+ info = {}
+ info['pn'] = d.getVar( 'PN') or ""
+ info['pv'] = d.getVar( 'PV') or ""
+
+ token = d.getVar('TOKEN')
+ spdx_outdir = d.getVar('SPDX_OUTDIR')
+ bb.note("Begin to upload : " + spdx_outdir)
+ upload_oss(d, spdx_outdir)
+ time.sleep(int(d.getVar('WAIT_TIME')))
+}
+
+def upload_oss(d, filepath):
+ import os
+ import subprocess
+ import fnmatch
+
+ server_url = d.getVar('BD_URI', True) or ""
+ if server_url == "":
+ bb.note("Please set blackduck URL by setting BD_URI!\n")
+ raise OSError(errno.ENOENT, "No setting of BD_URI")
+
+ token = d.getVar('TOKEN', True) or ""
+ if token == "":
+ bb.note("Please set token of blackduck by setting TOKEN!\n" + srcPath)
+ raise OSError(errno.ENOENT, "No setting of TOKEN comes from blackduck server.")
+
+ pro_name = d.getVar('PRO_NAME', True) or ""
+ bb.note("pro_name = " + pro_name)
+ pro_ver = d.getVar('PRO_VER', True) or ""
+ proxy_host = d.getVar('PROXY_HOST', True) or ""
+ proxy_port = d.getVar('PROXY_PORT', True) or ""
+ proxy_username = d.getVar('PROXY_UN', True) or ""
+ proxy_pw = d.getVar('PROXY_PW', True) or ""
+ recipesysrootnativedatadir = d.getVar('STAGING_DATADIR_NATIVE')
+ synopsys_detect_jar = ''
+ info_bd_dir = d.getVar('SPDX_DEPLOY_DIR')
+
+ for file in os.listdir(recipesysrootnativedatadir):
+ if fnmatch.fnmatch(file, "synopsys-detect-*.jar"):
+ bb.note("Find " + file)
+ synopsys_detect_jar = recipesysrootnativedatadir + "/" + file
+
+ if synopsys_detect_jar != '':
+ bb.note("synopsys_detect_jar = " + synopsys_detect_jar)
+ else:
+ bb.error("Ther is no synopsys-detect-*.jar file.")
+
+ synopsys_detect_cmd = "java -jar " + synopsys_detect_jar \
+ + " --blackduck.url=" + server_url \
+ + " --blackduck.api.token=" + token \
+ + " --detect.source.path=" + filepath \
+ + " --blackduck.trust.cert=true "\
+ + " --detect.notices.report.path=" + info_bd_dir \
+
+ if pro_name != '':
+ synopsys_detect_cmd = synopsys_detect_cmd + " --detect.project.name=" + pro_name
+ if pro_ver != '':
+ synopsys_detect_cmd = synopsys_detect_cmd + " --detect.project.version.name=" + pro_ver
+ if proxy_host!= '':
+ synopsys_detect_cmd = synopsys_detect_cmd + " --blackduck.proxy.host=" + proxy_host
+ if proxy_port != '':
+ synopsys_detect_cmd = synopsys_detect_cmd + " --blackduck.proxy.port=" + proxy_port
+ if proxy_username != '':
+ synopsys_detect_cmd = synopsys_detect_cmd + " --blackduck.proxy.username=" + proxy_username
+ if proxy_pw != '':
+ synopsys_detect_cmd = synopsys_detect_cmd + " --blackduck.proxy.password=" + proxy_pw
+
+ bb.note("Invoke synopsys_detect_cmd = " + synopsys_detect_cmd)
+ try:
+ rst = subprocess.check_output(synopsys_detect_cmd, stderr=subprocess.STDOUT, shell=True)
+ except subprocess.CalledProcessError as e:
+ bb.error(d.getVar('PN', True) + ": Upload to BD fail: \n%s" % e.output.decode("utf-8"))
+ return False
+
+ bb.note(str(rst, encoding = "utf-8"))
+
+SSTATETASKS += "do_synopsys_detect"
+python do_synopsys_detect_setscene () {
+ sstate_setscene(d)
+}
+addtask do_synopsys_detect_setscene
+do_synopsys_detect () {
+ echo "Upload OSS to blackduck server."
+}
+addtask do_spdx_creat_tarball after do_patch
+addtask do_bd_upload after do_patch
+addtask do_synopsys_detect
+do_build[recrdeptask] += "do_synopsys_detect"
+do_populate_sdk[recrdeptask] += "do_synopsys_detect"
+
diff --git a/recipes-devtools/synopsys/synopsys-7.0.0/LICENSE b/recipes-devtools/synopsys/synopsys-7.0.0/LICENSE
new file mode 100644
index 0000000..c487c85
--- /dev/null
+++ b/recipes-devtools/synopsys/synopsys-7.0.0/LICENSE
@@ -0,0 +1 @@
+Use subject to the terms and conditions of the Synopsys End User Software License and Maintenance Agreement. All rights reserved worldwide.
diff --git a/recipes-devtools/synopsys/synopsys-native_7.0.0.bb b/recipes-devtools/synopsys/synopsys-native_7.0.0.bb
new file mode 100644
index 0000000..8cedde4
--- /dev/null
+++ b/recipes-devtools/synopsys/synopsys-native_7.0.0.bb
@@ -0,0 +1,26 @@
+SUMMARY = "Download synopsys-detect-${PN}.jar"
+DESCRIPTION = "Download synopsys-detect-${PN}.jar for blackduck-upload.bbclass."
+HOMEPAGE = "https://sig-repo.synopsys.com/bds-integrations-release/com/synopsys/integration/synopsys-detect/"
+SECTION = "devel"
+
+LICENSE = "Synopsys End User Software License & Maintenance Agreement"
+LIC_FILES_CHKSUM = "file://LICENSE;md5=700445109629d278c8224c1fd727a991"
+
+inherit native
+
+SRCREV = "2e2ff0f3c6d8be53ef80aa8df2e60abfa0866906"
+
+S = "${WORKDIR}"
+
+SRC_URI = "https://sig-repo.synopsys.com/bds-integrations-release/com/synopsys/integration/synopsys-detect/${PV}/synopsys-detect-${PV}.jar \
+ file://LICENSE \
+ "
+
+SRC_URI[md5sum] = "44a4c3a4a07491ada8c2bfe76e266340"
+SRC_URI[sha256sum] = "3a426bc1a0b5902e7a744c406257c80ff689e03575df42cdcaa4a58f6316c84d"
+
+do_install(){
+ install -d ${D}${datadir}/
+ install -m 0755 ${DL_DIR}/synopsys-detect-${PV}.jar ${D}${datadir}/
+}
+