python-sbom 0.1.1__py3-none-any.whl

python_sbom/_validate/_licenses.py

@@ -0,0 +1,104 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Final
+
+from license_expression import (
+    AND,
+    ExpressionError,
+    LicenseSymbol,
+    LicenseWithExceptionSymbol,
+    Licensing,
+    get_license_index,
+)
+
+from python_sbom._model._graph import shipped_libraries
+
+if TYPE_CHECKING:
+    from license_expression import LicenseExpression
+
+    from python_sbom._model._types import Component, License
+
+# the SPDX ids alone, without the aliases get_spdx_licensing() adds: those rename ids (LicenseRef-Apache becomes
+# Apache-2.0, Net-SNMP becomes LicenseRef-scancode-net-snmp), so a policy would judge an id other than the one declared;
+# knowing the ids still lets the parser tell "MIT ISC" apart from a single license
+_LICENSING: Final[Licensing] = Licensing(
+    LicenseSymbol(entry["spdx_license_key"], is_exception=entry["is_exception"])
+    for entry in get_license_index()
+    if entry.get("spdx_license_key")
+)
+
+
+def license_problems(contents: list[Component], allowed: frozenset[str]) -> list[str]:
+    # SPDX matches license ids without regard to case
+    folded: Final[frozenset[str]] = frozenset(identifier.casefold() for identifier in allowed)
+    return [
+        f"{component.get('bom-ref', component['name'])}: {problem}"
+        for component in shipped_libraries(contents)
+        if (problem := _judge(component, allowed, folded))
+    ]
+
+
+def _judge(component: Component, allowed: frozenset[str], folded: frozenset[str]) -> str | None:
+    licenses: Final[list[License]] = component.get("licenses", [])
+    terms: Final[list[str]] = [
+        entry["expression"] if "expression" in entry else entry["license"]["id"]
+        for entry in licenses
+        if "expression" in entry or "id" in entry["license"]
+    ]
+    if not terms:
+        if names := [entry["license"]["name"] for entry in licenses if "license" in entry]:
+            return f"declares license names {names} with no SPDX id"
+        return "declares no license"
+    denied: Final[list[str]] = []
+    for term in terms:
+        try:
+            tree = _parse(term)
+        except ValueError as error:
+            return f"license expression {term!r} is malformed: {error}"
+        if not _allowed(tree, folded):
+            denied.append(term)
+    if denied:
+        return f"license {' AND '.join(denied)} is outside the allowed licenses {sorted(allowed)}"
+    return None
+
+
+def _parse(term: str) -> LicenseExpression:
+    try:
+        tree: Final[LicenseExpression | None] = _LICENSING.parse(term)
+    except ExpressionError as error:
+        raise ValueError(str(error)) from error
+    except (AssertionError, IndexError) as error:
+        # boolean.py trips over some malformed input, such as "( OR MIT" or "()", before it reports it
+        msg = "it does not parse"
+        raise ValueError(msg) from error
+    if tree is None:
+        msg = "it is empty"
+        raise ValueError(msg)
+    return tree
+
+
+def _allowed(tree: LicenseExpression, folded: frozenset[str]) -> bool:
+    # the parse tree nests as deep as the expression does, so it is walked with a stack instead of recursion; children
+    # come after their parent in this order, so the reversed walk judges them first
+    order: Final[list[LicenseExpression]] = []
+    pending: Final[list[LicenseExpression]] = [tree]
+    while pending:
+        order.append(node := pending.pop())
+        pending.extend(node.args)
+    verdicts: Final[dict[int, bool]] = {}
+    for node in reversed(order):
+        if isinstance(node, LicenseWithExceptionSymbol):
+            # an exception grants extra permissions on top of the license it modifies, so that license alone decides
+            verdicts[id(node)] = node.license_symbol.key.casefold() in folded
+        elif isinstance(node, LicenseSymbol):
+            verdicts[id(node)] = node.key.casefold() in folded
+        else:
+            # the parser builds only AND and OR around the symbols
+            branches = (verdicts[id(arg)] for arg in node.args)
+            verdicts[id(node)] = all(branches) if isinstance(node, AND) else any(branches)
+    return verdicts[id(tree)]
+
+
+__all__ = [
+    "license_problems",
+]

python_sbom/_validate/_limits.py

@@ -0,0 +1,27 @@
+from __future__ import annotations
+
+from typing import Final, TypeAlias
+
+# a JSON value, as json.loads hands it over
+Json: TypeAlias = "str | int | float | bool | list[Json] | dict[str, Json] | None"
+
+# every check takes time in proportion to the count, so the cap bounds the work an untrusted document can ask for, far
+# above the few thousand components a wheel with its build tools' files lists
+MAX_COMPONENTS: Final[int] = 100_000
+# an exception's message, or a schema error's, can quote the hostile value that caused it, which runs to megabytes
+MAX_TEXT: Final[int] = 200
+
+
+def byte_limit(max_components: int) -> int:
+    # python-sbom writes about 540 bytes per component, since every file of the wheel and of its build tools is one; a
+    # KiB each leaves room for documents with fuller components, plus a MiB for the metadata, dependencies and
+    # formulation beside them, while tying what the JSON parser may be asked to hold to the component cap
+    return 1024 * 1024 + max_components * 1024
+
+
+__all__ = [
+    "MAX_COMPONENTS",
+    "MAX_TEXT",
+    "Json",
+    "byte_limit",
+]

python_sbom/_validate/_schemas.py

@@ -0,0 +1,124 @@
+from __future__ import annotations
+
+import json
+from collections import Counter
+from importlib.resources import files
+from typing import TYPE_CHECKING, Final
+
+from jsonschema_rs import Draft7Validator, Registry
+from license_expression import ExpressionError, ExpressionParseError, LicenseExpression
+from spdx_tools.common.spdx_licensing import spdx_licensing
+from spdx_tools.spdx.parser.error import SPDXParsingError
+from spdx_tools.spdx.parser.jsonlikedict.json_like_dict_parser import JsonLikeDictParser
+from spdx_tools.spdx.validation.creation_info_validator import validate_creation_info
+from spdx_tools.spdx.validation.extracted_licensing_info_validator import validate_extracted_licensing_infos
+from spdx_tools.spdx.validation.package_validator import validate_package
+from spdx_tools.spdx.validation.spdx_id_validators import validate_spdx_id
+
+from ._limits import MAX_TEXT
+
+if TYPE_CHECKING:
+    from importlib.resources.abc import Traversable
+
+    from jsonschema_rs import ValidationError
+    from spdx_tools.spdx.model import Document, SpdxNoAssertion, SpdxNone
+
+    from python_sbom._formats._spdx import Spdx
+
+    from ._limits import Json
+
+
+def schema_error(document: Json) -> str | None:
+    detail: Final[ValidationError | None] = next(_VALIDATOR.iter_errors(document), None)
+    if detail is None:
+        return None
+    steps: Final[str] = "".join(
+        f"[{step}]" if isinstance(step, int) else f".{step}" if step.isidentifier() else f"[{step!r}]"
+        for step in detail.instance_path
+    )
+    return f"{detail.message[:MAX_TEXT]} at {f'${steps}'[:MAX_TEXT]}"
+
+
+def spdx_problems(spdx: Spdx) -> list[str]:
+    try:
+        parsed: Final[Document] = JsonLikeDictParser().parse(dict(spdx))
+    except SPDXParsingError as error:
+        return [f"SPDX rendering does not parse: {message}" for message in error.get_messages()]
+    return [f"SPDX rendering invalid: {message}" for message in _invalid(parsed)]
+
+
+def _invalid(document: Document) -> list[str]:
+    # spdx-tools' validate_full_spdx_document looks every relationship end, and every package's own relationships, up
+    # in lists, so its time grows with the square of the elements: 16,000 took a minute and a half. This runs its
+    # validators of each element and does the lookups across elements in sets. The rendering writes no files, snippets
+    # or annotations, and always the DESCRIBES relationship, so their checks are left out
+    version: Final[str] = document.creation_info.spdx_version
+    messages: Final[list[str]] = [
+        message.validation_message for message in validate_creation_info(document.creation_info, version)
+    ]
+    license_refs: Final[frozenset[str | None]] = frozenset(
+        info.license_id for info in document.extracted_licensing_info
+    )
+    for package in document.packages:
+        messages.extend(validate_spdx_id(package.spdx_id, document))
+        messages.extend(_license_problems(package.license_concluded, license_refs))
+        messages.extend(_license_problems(package.license_declared, license_refs))
+        messages.extend(message.validation_message for message in validate_package(package, version))
+    ids: Final[Counter[str]] = Counter(package.spdx_id for package in document.packages)
+    ids[document.creation_info.spdx_id] += 1
+    for relationship in document.relationships:
+        ends = (relationship.spdx_element_id, relationship.related_spdx_element_id)
+        messages.extend(
+            f'did not find the referenced spdx_id "{end}" in the SPDX document' for end in ends if end not in ids
+        )
+    messages.extend(
+        message.validation_message for message in validate_extracted_licensing_infos(document.extracted_licensing_info)
+    )
+    if duplicates := sorted(spdx_id for spdx_id, count in ids.items() if count > 1):
+        messages.append(
+            f"every spdx_id must be unique within the document, but found the following duplicates: {duplicates}"
+        )
+    return messages
+
+
+def _license_problems(
+    expression: LicenseExpression | SpdxNoAssertion | SpdxNone | None, license_refs: frozenset[str | None]
+) -> list[str]:
+    # spdx-tools' validate_license_expression, with the LicenseRef ids it lists for every call gathered once
+    if not isinstance(expression, LicenseExpression):
+        return []
+    problems: Final[list[str]] = [
+        f"Unrecognized license reference: {symbol}. license_expression must only use IDs from the license list or"
+        f" extracted licensing info, but is: {expression}"
+        for symbol in spdx_licensing.validate(expression).invalid_symbols
+        if symbol not in license_refs
+    ]
+    try:
+        spdx_licensing.parse(str(expression), validate=True, strict=True)
+    except ExpressionParseError as error:
+        # an exception used as a license or the other way around; unknown symbols raise ExpressionError, listed above
+        problems.append(f"{error}. for license_expression: {expression}")
+    except ExpressionError:
+        pass
+    return problems
+
+
+# the official CycloneDX schema files, unchanged: bom-1.6 and the jsf-0.82 it references from the specification's 1.6.2
+# release, and the spdx license list from its 1.7.2 release, the newest, as the cyclonedx.org URL every schema version
+# references serves the newest; Apache-2.0, see the LICENSE beside them. Format assertion is on, as in CycloneDX's own
+# Draft 7 validation, and offline, so a reference missing from the registry fails instead of reaching the network
+_SCHEMAS: Final[Traversable] = files(__package__) / "schemas"
+_REFERENCED: Final[list[dict[str, Json]]] = [
+    json.loads((_SCHEMAS / name).read_text(encoding="utf-8")) for name in ("spdx.schema.json", "jsf-0.82.schema.json")
+]
+_VALIDATOR: Final[Draft7Validator] = Draft7Validator(
+    json.loads((_SCHEMAS / "bom-1.6.schema.json").read_text(encoding="utf-8")),
+    validate_formats=True,
+    offline=True,
+    registry=Registry([(str(schema["$id"]), schema) for schema in _REFERENCED]),
+)
+
+__all__ = [
+    "schema_error",
+    "spdx_problems",
+]

python_sbom/_validate/schemas/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright OWASP Foundation
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.