buildstream-sbom 1.1__py3-none-any.whl

buildstream_sbom/frontend.py

@@ -0,0 +1,190 @@
+# SPDX-FileCopyrightText: 2025 Codethink Limited
+#
+# SPDX-License-Identifier: Apache-2.0
+
+import argparse
+import json
+import os
+import re
+import subprocess
+import sys
+
+import yaml
+
+from pathlib import Path
+
+from .spdx import generate_spdx
+from .utils import get_hosttool, bst_common_args
+
+
+def configure():
+    parser = argparse.ArgumentParser(
+        description="Generate an SPDX formatted SBoM manifest from a BuildStream project"
+    )
+
+    parser.add_argument(
+        "--spdx-name",
+        metavar="NAME",
+        help="SPDX document name",
+        required=True,
+    )
+    parser.add_argument(
+        "--spdx-namespace",
+        metavar="NAMESPACE",
+        help="SPDX document namespace",
+        required=True,
+    )
+    parser.add_argument(
+        "--spdx-comment",
+        metavar="COMMENT",
+        help="SPDX document comment",
+    )
+    parser.add_argument(
+        "--spdx-creator",
+        metavar="CREATOR",
+        action="append",
+        dest="spdx_creators",
+        help="SPDX creator, in the format mandated by SPDX. "
+        "Can be passed multiple times for multiple creators.",
+    )
+
+    parser.add_argument(
+        "-C",
+        "--directory",
+        metavar="DIRECTORY",
+        help="BuildStream project directory",
+    )
+
+    parser.add_argument(
+        "-o",
+        "--option",
+        metavar="OPTION VALUE",
+        nargs=2,
+        action="append",
+        dest="options",
+        default=[],
+        help="BuildStream project option",
+    )
+
+    parser.add_argument(
+        "--output",
+        metavar="FILE",
+        type=argparse.FileType("w"),
+        help="Output filename",
+        default="-",
+    )
+
+    parser.add_argument("--deps", choices=["all", "run"], default="run")
+
+    parser.add_argument(
+        "--with-licenses",
+        action=argparse.BooleanOptionalAction,
+        default=False,
+        help="Attempt to extract licenses from build artifacts and add them to the SBOM",
+    )
+
+    # A lot of artifacts can be checked out so it is a good idea to let users choose where these
+    # go in case of storage space limitations
+    parser.add_argument(
+        "--artifact-checkout-directory",
+        "-A",
+        default=Path(os.getcwd()),
+        help="Directory to use when checking out artifacts for processing; "
+        "the artifacts will be removed once they have been processed "
+        "(default: %(default)s)",
+        type=Path,
+    )
+
+    parser.add_argument(
+        "elements",
+        metavar="ELEMENT",
+        nargs="+",
+        help="Elements to generate SBoM for",
+    )
+
+    return parser.parse_args()
+
+
+def extract_element_infos(config):
+    element_infos = []
+
+    try:
+        result = run_bst_show(config)
+    except subprocess.CalledProcessError:
+        exit(1)
+
+    documents = yaml.load_all(result.stdout, yaml.BaseLoader)
+    try:
+        while True:
+            name = next(documents)
+            kind = next(documents)
+            source_infos = next(documents)
+            build_deps = next(documents)
+            runtime_deps = next(documents)
+            config = next(documents)
+            public = next(documents)
+            vars = next(documents)
+
+            element_infos.append(
+                {
+                    "name": name,
+                    "kind": None if kind == "%{kind}" else kind,
+                    "source-infos": source_infos,
+                    "build-deps": build_deps,
+                    "runtime-deps": runtime_deps,
+                    "config": config,
+                    "public": public,
+                    "vars": vars,
+                }
+            )
+    except StopIteration:
+        pass
+
+    return element_infos
+
+
+def check_creators(config):
+    spdx_creators = ["Person", "Organization", "Tool"]
+    valid_creator = True
+    for c in config.spdx_creators:
+        valid_creator &= any(re.split(":", c)[0] in sc for sc in spdx_creators)
+    if not valid_creator:
+        sys.exit(
+            "ERROR: SPDX creator should follow the SPDX format.\n"
+            "See: https://spdx.github.io/spdx-spec/v2.3/document-creation-information/#68-creator-field"
+        )
+
+
+def run_bst_show(config):
+    # Python documentation recommends using a full path for the executable
+    # https://docs.python.org/3/library/subprocess.html#subprocess.Popen
+    bst_cmdline = [get_hosttool("bst")]
+
+    bst_cmdline += bst_common_args(config)
+
+    bst_cmdline += [
+        "show",
+        "--format",
+        "---\n%{name}\n---\n'%{kind}'\n---\n%{source-info}\n---\n%{build-deps}\n---\n%{runtime-deps}\n---\n%{config}\n---\n%{public}---\n%{vars}",
+    ]
+    bst_cmdline += config.elements
+
+    return subprocess.run(bst_cmdline, stdout=subprocess.PIPE, text=True, check=True)
+
+
+def main():
+    config = configure()
+
+    if config.spdx_creators:
+        check_creators(config)
+
+    element_infos = extract_element_infos(config)
+
+    spdx = generate_spdx(element_infos, config)
+
+    with config.output:
+        json.dump(spdx, config.output, indent=2)
+
+
+if __name__ == "__main__":
+    main()

buildstream_sbom/licensing.py

@@ -0,0 +1,151 @@
+# SPDX-FileCopyrightText: 2026 Codethink Limited
+#
+# SPDX-License-Identifier: Apache-2.0
+
+import subprocess
+import sys
+import json
+import tempfile
+
+from argparse import Namespace
+from pathlib import Path
+
+from .utils import get_hosttool, bst_common_args
+
+
+def get_license_artifacts(
+    element: str,
+    artifact_checkout_path: Path,
+    licenses_path: Path,
+    config: Namespace,
+) -> Path | None:
+    """Use Buildstream artifact checkout to get the installed licenses of an element and outputs the licenses, specified by
+    `license_artifact_path`, to the chosen output directory.
+
+    If the artifact checkout failed then the it will cause the program to exit.
+
+    Returns a Path to the licenses or None if none were found in the artifacts
+    """
+
+    # bst artifact checkout
+    bst_cmdline = [get_hosttool("bst")]
+
+    bst_cmdline += bst_common_args(config)
+
+    bst_cmdline += [
+        "artifact",
+        "checkout",
+        element,
+        "--directory",  # Note: This is the artifact checkout directory arg and not the same as the bst project directory
+        artifact_checkout_path,
+        "--deps",
+        "none",
+        "--no-integrate",
+    ]
+
+    r = subprocess.run(bst_cmdline)
+
+    if r.returncode != 0:
+        sys.exit("ERROR: Failed to checkout artifacts")
+
+    if licenses_path.exists():
+        return licenses_path
+
+    return None
+
+
+def extract_licenses(
+    input_path, element_name, artifact_checkout_path
+) -> list[str] | None:
+    """Attempt to extract licenses from `input_path` using Askalono.
+
+    Unrecognised licenses automatically trigger warning outputs.
+
+    If the Akalono command fails for any reason it will cause the program to exit.
+
+    `element_name` and `artifact_checkout_path` are only used for providing error
+    context reporting and have no impact on the license extraction.
+    """
+    askalono_bin = get_hosttool("askalono")
+
+    r = subprocess.run(
+        [askalono_bin, "--format", "json", "crawl", str(input_path)],
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        text=True,
+    )
+
+    if r.returncode != 0:
+        sys.exit(f"ERROR: Askalono command failed.\n{r.stderr}")
+
+    license_json = r.stdout
+
+    # Askalono ouptuts multiple licenses as separate objects but not as an array,
+    # need to combine them in to an array
+    license_json_split = license_json.splitlines()
+
+    # use set to avoid duplicates
+    licenses = set()
+    failures = {}
+    for license_object_json in license_json_split:
+        license_object = json.loads(license_object_json)
+        license_result = license_object.get("result", None)
+        if license_result is None:
+            offending_file = license_object.get("path", "Missing File Name")
+            if offending_file is not None:
+                offending_file = offending_file.removeprefix(
+                    str(artifact_checkout_path)
+                )
+
+            files_with_error = failures.setdefault(
+                license_object.get("error", "Missing Error"), []
+            )
+            files_with_error.append(offending_file)
+
+            continue
+
+        licenses.add(license_result["license"]["name"])
+
+    for error, files in failures.items():
+        # python doesn't allow for '\' in f-string parts so need to use format
+        print(
+            "{0}: {1} found in\n\t{2}\n".format(
+                element_name, error, "\n\t".join(files)
+            ),
+            file=sys.stderr,
+        )
+
+    if len(licenses) == 0:
+        return None
+
+    return list(licenses)
+
+
+def retrieve_licenses(
+    element_name: str, artifact_license_path: Path, config: Namespace
+) -> list[str] | None:
+    """Retrieve licenses for an element by checking out its artifacts to `artifact_checkout_root` and scanning
+    `licenses_artifact_path` for any identifiable licenses.
+
+    Returns None if none could be found otherwise returns licenses as in a list
+    """
+
+    # path to use for artifact checkout
+    with tempfile.TemporaryDirectory(
+        dir=config.artifact_checkout_directory
+    ) as artifact_checkout_path:
+        # path to the licenses inside the artifact
+        licenses_path = Path(artifact_checkout_path, artifact_license_path)
+
+        license_data_path = get_license_artifacts(
+            element_name, artifact_checkout_path, licenses_path, config
+        )
+
+        if license_data_path is None:
+            return None
+
+        license_data = extract_licenses(
+            license_data_path, element_name, artifact_checkout_path
+        )
+
+    return license_data

buildstream_sbom/spdx.py

@@ -0,0 +1,337 @@
+# SPDX-FileCopyrightText: 2025 Codethink Limited
+#
+# SPDX-License-Identifier: Apache-2.0
+
+from buildstream_sbom.utils import bst_common_args
+import os
+import sys
+import re
+import subprocess
+
+from datetime import datetime, timezone
+from pathlib import Path
+
+from .licensing import retrieve_licenses
+
+from .utils import get_hosttool
+
+# buildstream-sbom supported spdx attributes
+# this could be generic for any key in provenance but being
+# explicit about these attributes guarantees valid SPDX
+SOURCE_PROVENANCE_ATTRIBUTES = {
+    "concluded-license": "licenseConcluded",
+    "copyright-text": "copyrightText",
+    "declared-license": "licenseDeclared",
+    "description": "summary",
+    "homepage": "homepage",
+    "name": "name",
+    "originator": "originator",
+    "supplier": "supplier",
+}
+
+
+def generate_spdx(element_infos, config):
+    element_infos = {
+        element_info["name"]: element_info for element_info in element_infos
+    }
+    packages = []
+    relationships = []
+
+    elements_done = set()
+    elements_to_do = set()
+
+    for element in config.elements:
+        relationships.append(
+            {
+                "spdxElementId": "SPDXRef-DOCUMENT",
+                "relationshipType": "DESCRIBES",
+                "relatedSpdxElement": element_spdxid(element),
+            }
+        )
+        elements_to_do.add(element)
+
+    while elements_to_do:
+        name = elements_to_do.pop()
+        if name in elements_done:
+            continue
+        elements_done.add(name)
+
+        elem_info = element_infos[name]
+        source_infos = elem_info["source-infos"]
+
+        element_package, source_packages = generate_spdx_for_element(
+            name,
+            source_infos,
+            elem_info,
+            config,
+        )
+
+        packages.append(element_package)
+        packages.extend(source_packages)
+
+        for source_package in source_packages:
+            relationships.append(
+                {
+                    "spdxElementId": element_spdxid(name),
+                    "relationshipType": "GENERATED_FROM",
+                    "relatedSpdxElement": source_package["SPDXID"],
+                }
+            )
+
+        # Order here doesn't matter, as we're sorting the relationships at the end
+        all_deps = set(elem_info["runtime-deps"])
+
+        extra_deps = get_extra_dependencies(elem_info, config.deps == "all", config)
+        all_deps.update(extra_deps)
+
+        for dep in all_deps:
+            relationships.append(
+                {
+                    "spdxElementId": element_package["SPDXID"],
+                    "relationshipType": "DEPENDS_ON",
+                    "relatedSpdxElement": element_spdxid(dep),
+                }
+            )
+            elements_to_do.add(dep)
+
+    def relationship_sort_key(relationship):
+        return (
+            relationship["spdxElementId"],
+            relationship["relatedSpdxElement"],
+            relationship["relationshipType"],
+        )
+
+    spdx = {
+        "spdxVersion": "SPDX-2.3",
+        "dataLicense": "CC0-1.0",
+        "SPDXID": "SPDXRef-DOCUMENT",
+    }
+
+    creation_info = spdx["creationInfo"] = {}
+
+    spdx["name"] = config.spdx_name
+
+    spdx["documentNamespace"] = config.spdx_namespace
+
+    if config.spdx_comment:
+        spdx["comment"] = config.spdx_comment
+
+    if config.spdx_creators:
+        creation_info["creators"] = config.spdx_creators
+
+    created_datetime = datetime.now(timezone.utc)
+    # This is a specific variant of isoformat, that python's datetime
+    # module doesn't support
+    # https://spdx.github.io/spdx-spec/v2.3/document-creation-information/#691-description
+    creation_info["created"] = created_datetime.strftime("%Y-%m-%dT%H:%M:%SZ")
+
+    spdx["packages"] = sorted(packages, key=lambda pkg: pkg["SPDXID"])
+    spdx["relationships"] = sorted(relationships, key=relationship_sort_key)
+
+    return spdx
+
+
+def resolve_element_name(name, config):
+    # Python documentation recommends using a full path for the executable
+    # https://docs.python.org/3/library/subprocess.html#subprocess.Popen
+    bst_cmdline = [get_hosttool("bst")]
+
+    bst_cmdline += bst_common_args(config)
+
+    bst_cmdline += ["show", "--deps", "none", "--format", "%{name}", name]
+
+    return subprocess.run(
+        bst_cmdline, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True
+    )
+
+
+def get_extra_dependencies(elem_info, all_deps, config):
+    """
+    Return extra dependencies (beyond the element runtime dependencies) that need to be
+    included in the SPDX. If `all_deps` is true, then all build dependencies are included.
+    Otherwise, it uses heuristics are based on the element kind, or hints in the element's
+    public data.
+    """
+
+    if all_deps:
+        return elem_info["build-deps"]
+
+    # See if we have explicit configuration in the public data
+    public_data = elem_info["public"].get("sbom", {})
+    if public_data:
+        extra_deps = []
+        junction, _, _ = elem_info["name"].rpartition(":")
+        for dep_name in public_data.get("depends-on", []):
+            # need to account for the junction where the element resides
+            if junction:
+                result = resolve_element_name(f"{junction}:{dep_name}", config)
+                if result.returncode == 0:
+                    resolved_dep_name = result.stdout.strip()
+                else:
+                    sys.exit(
+                        f"Could not find dependency {dep_name}, referenced "
+                        f"from public data of element {elem_info['name']}:\n"
+                        f"{result.stderr.strip()}"
+                    )
+            else:
+                resolved_dep_name = dep_name
+
+            if resolved_dep_name not in elem_info["build-deps"]:
+                deps_str = "\n".join(elem_info["build-deps"])
+                sys.exit(
+                    f"Could not find dependency {dep_name}, referenced "
+                    f"from public data of element {elem_info['name']} "
+                    f"(resolved to {resolved_dep_name}). "
+                    f"Dependency must be one of:\n{deps_str}"
+                )
+
+            extra_deps.append(resolved_dep_name)
+        return extra_deps
+
+    if include_build_deps(elem_info["kind"], elem_info["config"].keys()):
+        return elem_info["build-deps"]
+
+    return []
+
+
+def include_build_deps(kind, config_keys):
+    """
+    Returns whether build dependencies should be always included even when generating
+    an SBoM with runtime dependencies. This currently means the compose and filter
+    elements.
+    """
+    if kind is None:
+        # Try to guess the element kind depending on its configuration
+        if config_keys == set(
+            ["include", "exclude", "include-orphans", "pass-integration"]
+        ):
+            kind = "filter"
+        if config_keys == set(["include", "exclude", "include-orphans", "integrate"]):
+            kind = "compose"
+
+    return kind in ("filter", "compose")
+
+
+def element_licenses(name: str, elem_info, config):
+    license_dir: str = elem_info["vars"].get("licensedir", None)
+
+    if license_dir is not None:
+        license_dir = Path(license_dir.lstrip(os.sep))
+
+        licenses = retrieve_licenses(name, license_dir, config)
+        if licenses is None:
+            print(f"{name}: Skipping: No licenses found", file=sys.stderr)
+            return None
+
+        return " AND ".join(licenses)
+    else:
+        print(
+            f"Could not find license directory for {name}, skipping licenses.",
+            file=sys.stderr,
+        )
+
+    return None
+
+
+def generate_spdx_for_element(
+    name,
+    source_infos,
+    elem_info,
+    config,
+):
+    """
+    Generate SPDX package information from the passed-in module, which is an
+    entry from a new style manifest (using the source provenance API)
+    """
+    package_name = element_package_name(name)
+    spdx_name = element_spdxid(name)
+
+    element_package = {
+        "name": package_name,
+        "SPDXID": spdx_name,
+        "filesAnalyzed": False,
+        "downloadLocation": "NOASSERTION",
+    }
+
+    element_ext_refs = []
+    bst_element_name = {
+        "referenceCategory": "OTHER",
+        "referenceType": "bst-element",
+        "referenceLocator": f"{name}",
+    }
+    element_ext_refs.append(bst_element_name)
+
+    element_package["externalRefs"] = element_ext_refs
+
+    if config.with_licenses:
+        licenses = element_licenses(name, elem_info, config)
+        if licenses is not None:
+            element_package["licenseDeclared"] = licenses
+
+    source_packages = []
+
+    for idx, source in enumerate(source_infos):
+        package = {
+            "SPDXID": f"{spdx_name}-{idx}",
+            "filesAnalyzed": False,
+        }
+        source_ext_refs = []
+
+        if "provenance" in source:
+            provenance = source["provenance"]
+            for attribute, spdx_field in SOURCE_PROVENANCE_ATTRIBUTES.items():
+                if attribute in provenance:
+                    package[spdx_field] = provenance[attribute]
+
+        package.setdefault("name", source_package_name(source))
+
+        package["downloadLocation"] = source["url"]
+        if "version-guess" in source:
+            package["versionInfo"] = source["version-guess"]
+        else:
+            package["versionInfo"] = source["version"]
+
+        package["sourceInfo"] = source["kind"]
+
+        source_ext_refs.append(bst_element_name)
+        package["externalRefs"] = source_ext_refs
+
+        source_packages.append(package)
+
+    return element_package, source_packages
+
+
+def element_spdxid(name):
+    # SPDXID can only contain letters, numbers, `.`, and `-`
+    not_allowed = "[^a-zA-Z0-9.-]"
+    spdx_name = re.sub(not_allowed, "-", name)
+    return f"SPDXRef-{spdx_name}"
+
+
+def element_package_name(name):
+    element_name = name.split(":")[-1]
+    return os.path.splitext(os.path.basename(element_name))[0]
+
+
+def source_package_name(source_info):
+    basename = os.path.basename(source_info["url"])
+
+    if "extra-data" in source_info and "crate-name" in source_info["extra-data"]:
+        return source_info["extra-data"]["crate-name"]
+
+    if source_info["medium"] == "git":
+        if basename.endswith(".git"):
+            return basename[: -len(".git")]
+        return basename
+    elif source_info["medium"] in ("remote-file", "archive"):
+        stem = re.split(r"\.(tar|tgz|tbz|zip|crate)", basename)[0]
+        package = re.split("[-_][0-9]", stem)[0]
+        return package
+    elif source_info["medium"] == "local":
+        return basename
+    else:
+        print(
+            f"Can't extract a package name from source info {source_info}",
+            file=sys.stderr,
+        )
+        return "UNKNOWN"

buildstream_sbom/utils.py

@@ -0,0 +1,30 @@
+# SPDX-FileCopyrightText: 2026 Codethink Limited
+#
+# SPDX-License-Identifier: Apache-2.0
+
+from argparse import Namespace
+import shutil
+import sys
+
+
+def get_hosttool(name: str):
+    """Returns the path to the executable of the specified command.
+
+    Errors if the command could not be found.
+    """
+    command = shutil.which(name)
+    if command is None:
+        sys.exit(f"`{name}` is not installed or could not be found.")
+
+    return command
+
+
+def bst_common_args(config: Namespace) -> list[str]:
+    args = []
+    if config.directory:
+        args += ["--directory", config.directory]
+
+    for option, value in config.options:
+        args += ["--option", option, value]
+
+    return args

buildstream_sbom-1.1.dist-info/METADATA

@@ -0,0 +1,111 @@
+Metadata-Version: 2.4
+Name: buildstream-sbom
+Version: 1.1
+Summary: A tool to generate SPDX SBoMs from buildstream projects
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+Requires-Dist: pyyaml
+
+<!--
+SPDX-FileCopyrightText: 2025 Codethink Limited
+
+SPDX-License-Identifier: Apache-2.0
+-->
+
+# BuildStream SBOM generator
+
+This tool can be used to produce an SBoM (Software Bill of Materials)
+describing a BuildStream element and its dependencies. It currently
+generates [SPDX](https://spdx.dev/) version 2.3.
+
+The manifest contains useful information, such as the package name, version,
+source locations and dependencies.
+
+
+## Source provenance data
+
+This tool relies on the [Source Provenance API](https://docs.buildstream.build/2.5/buildstream.source.html#generating-sourceinfo-for-provenance-information)
+introduced in BuildStream 2.5. This API is implemented by buildstream-plugins
+version 2.5.0 and buildstream-plugins-community 2.1.0. Please make sure your
+project is using those (or more recent) versions. If your project uses custom
+source plugins, please make sure that they also implement this API.
+
+Version guessing is handled by individual source plugins, please check the
+individual plugin documentation for details. Most plugins that implement it
+do something similar to what [DownloadableFileSource](https://docs.buildstream.build/2.5/buildstream.downloadablefilesource.html#core-downloadable-source-builtins)
+does, so it is a good starting point for understanding how this works.
+
+The list of currently supported source provenance attributes that can be
+specified and used for a Buildstream project is as follows:
+
+| Attribute name | Corresponding SPDX attribute |
+| -------------- | ---------------------------- |
+| concluded-license | [licenseConcluded](https://spdx.github.io/spdx-spec/v2.3/package-information/#713-concluded-license-field) |
+| copyright-text | [copyrightText](https://spdx.github.io/spdx-spec/v2.3/package-information/#717-copyright-text-field) |
+| declared-license | [licenseDeclared](https://spdx.github.io/spdx-spec/v2.3/package-information/#715-declared-license-field) |
+| description | [summary](https://spdx.github.io/spdx-spec/v2.3/package-information/#718-package-summary-description-field) |
+| homepage | [homepage](https://spdx.github.io/spdx-spec/v2.3/package-information/#711-package-home-page-field) |
+| name | [name](https://spdx.github.io/spdx-spec/v2.3/package-information/#71-package-name-field) |
+| originator | [originator](https://spdx.github.io/spdx-spec/v2.3/package-information/#76-package-originator-field) |
+| supplier | [supplier](https://spdx.github.io/spdx-spec/v2.3/package-information/#75-package-supplier-field) |
+
+These can be used in projects by use of the `source-provenance-attributes`
+field in the project.conf, this is described in the provenance section of
+the [BuildStream documentation](https://docs.buildstream.build/master/buildstream.source.html#built-in-functionality).
+
+### source-provenance-attributes snippet
+
+```
+# project.conf
+
+source-provenance-attributes:
+  concluded-license: The license as determined by the evidence provided by the source project
+  copyright-text: Copyright text defined by the source project
+  declared-license: The license of the source project as decided by the authors
+  description: Description of the source project
+  homepage: The URL of the source project's homepage
+  name: The name of the source project
+  originator: The name of the person or organisation that created the source package originally
+  supplier: The name of the person or organisation that provided the source package
+```
+
+Should any BuildStream plugins implement tracking for source provenance attributes, similar to
+[source tracking](https://docs.buildstream.build/master/using_commands.html#bst-source-track),
+it is recommended for all projects and plugins to use the attribute names exactly as seen above.
+This ensures the source provenance attributes are always generated identically between different
+plugins and makes sure they align with projects' definitions in the same way.
+
+## Usage
+
+To install, clone this repository and install it using `pip` (or preferably a
+tool like [`uv tool`](https://docs.astral.sh/uv/#tools) or
+[`pipx`](https://pipx.pypa.io/stable/) which install it in a virtual
+environment).
+
+To use, run `buildstream-sbom` in a buildstream project passing in the name of
+elements like you would pass to `bst`. There are two additional required
+arguments `--spdx-name` and `--spdx-namespace`, to set the SPDX document name
+and document namespace respectively. See the [SPDX specification](https://spdx.github.io/spdx-spec/v2.3/document-creation-information/)
+for details.
+
+`buildstream-sbom` also accepts some buildstream options, notably `-o/--option`
+to set buildstream options, `-C/--directory` to set the directory containing
+the buildstream project, and `--deps` to choose whether to include only runtime
+dependencies or all dependencies.
+
+On the topic of runtime dependencies, two BuildStream core plugins are treated
+specially: `filter` and `compose`. All build dependencies of elements using
+these plugins are considered runtime dependencies. You can set the `depends-on`
+key in the `sbom` public domain data to a list of build dependencies to have
+`buildstream-sbom` treat these build dependencies as runtime dependencies. This
+is useful for a `script` or `manual` element that copies artifacts from a build
+dependency into its own artifact.
+
+You can also include licenses that have been extracted from the element's
+artifacts using `--include-licenses`. This uses license information installed
+with tooling such as [Freedesktop-SDK's install-extra script](https://gitlab.com/freedesktop-sdk/freedesktop-sdk/-/blob/master/include/install-extra.yml?ref_type=heads). This option can
+also be used in conjunction with `--artifact-checkout-directory` (`-A`), to
+control where element artifacts are checked out to during processing; useful
+for if you are checking out larger artifacts and want to specify a different
+part of a filesystem with more available space (note that artifacts are removed
+once processed anyway to minimise required storage space).

buildstream_sbom-1.1.dist-info/RECORD

@@ -0,0 +1,9 @@
+buildstream_sbom/frontend.py,sha256=6R_aPdfTg-2FxCSp-ZecDDz3CFtIfdGR-WVQ_ovqVo4,5014
+buildstream_sbom/licensing.py,sha256=ql_BKyJGNqujnjtM64tjuBxXNhdouhNLD_bwio1xpaQ,4533
+buildstream_sbom/spdx.py,sha256=Ir-_GIhtSR6aMVP7rSw6BmBCx89h9BxoHJ4mKBvXHAs,10645
+buildstream_sbom/utils.py,sha256=aTILJ6VWqisHAFRYohyrzjr-pU4NJuYCjuwd-xqtM-k,694
+buildstream_sbom-1.1.dist-info/METADATA,sha256=k-gsPxqJyWPuDA0QM_r2AdC0PGfyHaM1X8CXeOOZSjQ,6178
+buildstream_sbom-1.1.dist-info/WHEEL,sha256=aeYiig01lYGDzBgS8HxWXOg3uV61G9ijOsup-k9o1sk,91
+buildstream_sbom-1.1.dist-info/entry_points.txt,sha256=EkX2hGZJaWEHr38PebgrbxzFfVZodXWb9JAKcabtv1M,68
+buildstream_sbom-1.1.dist-info/top_level.txt,sha256=ohCnaVZk9kD6XX4uugH099Lld1PvWwi0mXTmw_v0LU0,17
+buildstream_sbom-1.1.dist-info/RECORD,,

buildstream_sbom-1.1.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (82.0.1)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

buildstream_sbom-1.1.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+buildstream-sbom = buildstream_sbom.frontend:main

buildstream_sbom-1.1.dist-info/top_level.txt

@@ -0,0 +1 @@
+buildstream_sbom