sbom-embedded 0.1.0__py3-none-any.whl

sbom_embedded/__init__.py

@@ -0,0 +1,3 @@
+"""CycloneDX SBOM generation from Yocto and Buildroot build output."""
+
+__version__ = "0.1.0"

sbom_embedded/cli.py

@@ -0,0 +1,153 @@
+"""Command line entry point."""
+
+from __future__ import annotations
+
+import sys
+from enum import StrEnum
+from pathlib import Path
+from typing import Annotated
+
+import typer
+
+from . import __version__
+from .parsers import buildroot, yocto
+from .parsers.detect import BuildSystem, DetectionError, detect
+from .writer import to_json
+
+app = typer.Typer(
+    add_completion=False,
+    help="Generate a CycloneDX SBOM from Yocto or Buildroot build output.",
+)
+
+
+class Format(StrEnum):
+    CYCLONEDX = "cyclonedx"
+
+
+def _version_callback(value: bool) -> None:
+    if value:
+        typer.echo(f"sbom-embedded {__version__}")
+        raise typer.Exit()
+
+
+@app.command()
+def main(
+    path: Annotated[
+        Path,
+        typer.Argument(
+            help="A Yocto deploy directory or a Buildroot output directory.",
+            show_default=False,
+        ),
+    ],
+    output_format: Annotated[
+        Format,
+        typer.Option("--format", help="Output format."),
+    ] = Format.CYCLONEDX,
+    image: Annotated[
+        str | None,
+        typer.Option(
+            "--image",
+            help="Which image to describe, when a Yocto deploy holds several.",
+            show_default=False,
+        ),
+    ] = None,
+    name: Annotated[
+        str | None,
+        typer.Option(
+            "--name",
+            help=(
+                "Name for the product being described. Defaults to the "
+                "manifest label (core-image-minimal-qemux86-64, or "
+                "'buildroot')."
+            ),
+            show_default=False,
+        ),
+    ] = None,
+    product_version: Annotated[
+        str | None,
+        typer.Option(
+            "--product-version",
+            help=(
+                "Version of the product being described. Left out of the SBOM "
+                "when not given -- no manifest records it."
+            ),
+            show_default=False,
+        ),
+    ] = None,
+    output: Annotated[
+        Path | None,
+        typer.Option(
+            "--output",
+            "-o",
+            help="Write here instead of stdout.",
+            show_default=False,
+        ),
+    ] = None,
+    _version: Annotated[
+        bool,
+        typer.Option(
+            "--version",
+            callback=_version_callback,
+            is_eager=True,
+            help="Show the version and exit.",
+        ),
+    ] = False,
+) -> None:
+    """Read an existing build's manifests and write a CycloneDX SBOM."""
+    try:
+        found = detect(path)
+        if found.system is BuildSystem.YOCTO:
+            components, label = yocto.parse(found.root, image=image)
+        elif found.system is BuildSystem.BUILDROOT:
+            if image is not None:
+                raise typer.BadParameter(
+                    "--image applies to Yocto builds; a Buildroot manifest "
+                    "describes a single target."
+                )
+            components, label = buildroot.parse(found.root)
+        else:  # a BuildSystem member was added without a parser
+            raise DetectionError(f"no parser for {found.system}")
+    except (
+        DetectionError,
+        yocto.YoctoParseError,
+        buildroot.BuildrootParseError,
+    ) as err:
+        typer.secho(f"error: {err}", fg=typer.colors.RED, err=True)
+        raise typer.Exit(code=1) from err
+
+    if not components:
+        # A valid, empty SBOM is the worst possible compliance artifact: it
+        # looks like a clean result. Still emit it -- the caller asked -- but
+        # never let it pass without a word.
+        typer.secho(
+            f"warning: no packages found in {path}; the SBOM will be empty",
+            fg=typer.colors.YELLOW,
+            err=True,
+        )
+
+    # product_version stays None unless the user supplies it. No manifest
+    # carries a product version, so anything else would be invented.
+    document = to_json(
+        components,
+        product_name=name or label,
+        product_version=product_version,
+    )
+
+    if output is None:
+        # Deliberately not typer.echo: the SBOM is data on stdout, and the
+        # documented usage pipes it into a file. The trailing newline makes
+        # the redirected file a well-formed text file.
+        sys.stdout.write(document + "\n")
+    else:
+        try:
+            output.write_text(document + "\n", encoding="utf-8")
+        except OSError as err:
+            typer.secho(
+                f"error: cannot write {output}: {err}", fg=typer.colors.RED, err=True
+            )
+            raise typer.Exit(code=1) from err
+        typer.secho(
+            f"wrote {len(components)} components to {output}",
+            fg=typer.colors.GREEN,
+            err=True,
+        )

sbom_embedded/models.py

@@ -0,0 +1,63 @@
+"""The one component model every parser returns.
+
+Parsers know about manifest formats; the CycloneDX writer knows about
+CycloneDX. `Component` is the only thing they share, which is why adding a
+build system means adding a parser and nothing else.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+
+from packageurl import PackageURL
+
+# Neither Yocto nor Buildroot has a registered purl type, and their packages
+# are not published to any ecosystem repository. "generic" with a name and
+# version is what CVE matchers (Grype, Trivy, OSV) can actually consume, and a
+# component without a purl is invisible to all of them -- so every Component
+# gets one, derived if the parser did not supply a better-qualified string.
+PURL_TYPE = "generic"
+
+
+def make_purl(
+    name: str,
+    version: str | None = None,
+    *,
+    qualifiers: dict[str, str | None] | None = None,
+) -> str:
+    """Build a purl string, dropping qualifiers the manifest did not fill in."""
+    kept = {k: v for k, v in (qualifiers or {}).items() if v}
+    return PackageURL(
+        type=PURL_TYPE,
+        name=name,
+        version=version or None,
+        qualifiers=kept or None,
+    ).to_string()
+
+
+@dataclass(slots=True)
+class Component:
+    """One package installed in the image.
+
+    Only `name` is guaranteed by every manifest format we read. A Yocto image
+    manifest, for instance, carries no license and no supplier at all -- those
+    stay None rather than being invented.
+    """
+
+    name: str
+    version: str | None = None
+    supplier: str | None = None
+    license: str | None = None
+    hash: str | None = None
+    purl: str | None = None
+    # Build-system-specific provenance that has no field of its own, keyed by
+    # a namespaced name. A Yocto package records the recipe that produced it:
+    # "libcrypto" and "openssl-conf" both come from openssl, and openssl is
+    # the name a CVE feed knows. Emitted as CycloneDX properties.
+    properties: dict[str, str] = field(default_factory=dict)
+
+    def __post_init__(self) -> None:
+        if not self.name.strip():
+            raise ValueError("component name must not be empty")
+        if self.purl is None:
+            self.purl = make_purl(self.name, self.version)

sbom_embedded/parsers/buildroot.py

@@ -0,0 +1,125 @@
+"""Buildroot build output.
+
+Reads `output/legal-info/manifest.csv`, the CSV `make legal-info` writes. Only
+the target manifest is read: `host-manifest.csv` lists build-time tools such
+as ccache and pkgconf, which are not part of the shipped firmware.
+
+Columns are looked up by header name rather than by position, because the
+column set has changed over the years -- `DEPENDENCIES WITH LICENSES` was
+added in 2018.11, so a manifest from 2017 has six columns and one from 2023
+has seven. Only PACKAGE, VERSION and LICENSE are read, and all three are
+required; anything else in the header is ignored, which is what lets both
+shapes parse.
+"""
+
+from __future__ import annotations
+
+import csv
+from pathlib import Path
+
+from ..models import Component, make_purl
+
+
+class BuildrootParseError(Exception):
+    """The directory does not hold a Buildroot legal-info manifest."""
+
+
+MANIFEST_NAME = "manifest.csv"
+
+# Header spellings seen across releases, newest first.
+_PACKAGE = ("PACKAGE",)
+_VERSION = ("VERSION",)
+_LICENSE = ("LICENSE",)
+
+# Buildroot writes these literals when it has nothing real to record. Carrying
+# them through would put a package named "unknown" at version "custom" into an
+# SBOM, which reads as data rather than as the absence of data.
+_NO_LICENSE = {"", "unknown"}
+_NO_VERSION = {"", "custom"}
+
+
+def find_manifest(root: Path) -> Path:
+    """Locate manifest.csv from whatever the user pointed us at.
+
+    Accepts the legal-info directory, the output directory above it, or the
+    file itself, because all three are things a person reasonably types.
+    """
+    if root.is_file():
+        return root
+    for candidate in (root / MANIFEST_NAME, root / "legal-info" / MANIFEST_NAME):
+        if candidate.is_file():
+            return candidate
+    raise BuildrootParseError(f"no {MANIFEST_NAME} found in or under {root}")
+
+
+def _column(header: list[str], names: tuple[str, ...], path: Path) -> int:
+    for name in names:
+        if name in header:
+            return header.index(name)
+    raise BuildrootParseError(f"{path}: no {names[0]} column in header {header!r}")
+
+
+def parse_manifest_csv(path: Path) -> list[Component]:
+    """Read a legal-info manifest into components."""
+    # newline="" is required by the csv module and matters here: real
+    # manifests in the wild carry CRLF endings. utf-8-sig drops a BOM if an
+    # editor introduced one.
+    try:
+        with path.open(newline="", encoding="utf-8-sig") as handle:
+            rows = list(csv.reader(handle))
+    except (OSError, UnicodeDecodeError, csv.Error) as err:
+        # A non-UTF-8 byte, an unreadable file, or a field over the csv
+        # module's limit would otherwise escape as a traceback.
+        raise BuildrootParseError(f"{path}: cannot read: {err}") from err
+
+    if not rows:
+        raise BuildrootParseError(f"{path}: file is empty")
+
+    header = [cell.strip() for cell in rows[0]]
+    package_at = _column(header, _PACKAGE, path)
+    version_at = _column(header, _VERSION, path)
+    license_at = _column(header, _LICENSE, path)
+
+    components: list[Component] = []
+    for lineno, row in enumerate(rows[1:], 2):
+        if not any(cell.strip() for cell in row):
+            continue
+        # Only the three columns actually read have to be present. A row with
+        # fewer trailing columns than the header is common in older manifests
+        # and harmless; one too short to reach LICENSE is not.
+        needed = max(package_at, version_at, license_at) + 1
+        if len(row) < needed:
+            raise BuildrootParseError(
+                f"{path}:{lineno}: need at least {needed} columns to reach "
+                f"PACKAGE, VERSION and LICENSE, got {len(row)}"
+            )
+        name = row[package_at].strip()
+        if not name:
+            raise BuildrootParseError(f"{path}:{lineno}: empty package name")
+
+        raw_version = row[version_at].strip()
+        version = None if raw_version in _NO_VERSION else raw_version
+
+        raw_license = row[license_at].strip()
+        license_ = None if raw_license in _NO_LICENSE else raw_license
+
+        components.append(
+            Component(
+                name=name,
+                version=version,
+                license=license_,
+                purl=make_purl(name, version),
+            )
+        )
+    return components
+
+
+def parse(root: Path) -> tuple[list[Component], str]:
+    """Parse a Buildroot legal-info directory.
+
+    Returns the components and a label for the SBOM's root component.
+    Buildroot has no image name of its own, so the caller is expected to
+    override the label when the product has a real name.
+    """
+    manifest = find_manifest(root)
+    return parse_manifest_csv(manifest), "buildroot"

sbom_embedded/parsers/detect.py

@@ -0,0 +1,109 @@
+"""Work out which build system produced a directory.
+
+The user should not have to know, and more to the point should not have to
+remember, whether a given directory is a Yocto deploy tree or a Buildroot
+output tree.
+
+Both are recognised by the presence of an artifact a parser would go on to
+read, which rules out the obvious false positive: an empty `images/` directory
+is not a Yocto build. It is an existence check, not a parse, so it does not
+promise the parser will then succeed -- a deploy holding only timestamped
+manifests, a zero-byte manifest.csv, or several images and no `--image` all
+detect and then fail in the parser.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from enum import StrEnum
+from pathlib import Path
+
+
+class DetectionError(Exception):
+    """Nothing recognisable was found."""
+
+
+class BuildSystem(StrEnum):
+    YOCTO = "yocto"
+    BUILDROOT = "buildroot"
+
+
+@dataclass(frozen=True)
+class Detected:
+    """What was found, and the directory the matching parser should be given."""
+
+    system: BuildSystem
+    root: Path
+
+
+# Where each build system's evidence sits, relative to what the user typed.
+# The nested entries let someone point at the top of a build tree instead of
+# hunting for the exact subdirectory.
+_YOCTO_PROBES = (
+    Path(),
+    Path("tmp/deploy"),
+    Path("build/tmp/deploy"),
+)
+_BUILDROOT_PROBES = (
+    Path(),
+    Path("legal-info"),
+    Path("output/legal-info"),
+)
+
+# A deploy directory is recognised by an artifact a parser can actually read.
+# Either alone is enough: a build that kept its licenses but not its images is
+# still readable, and so is the reverse.
+_YOCTO_EVIDENCE = (
+    "images/*/*.manifest",
+    "licenses/*/license.manifest",
+    "licenses/*/*/license.manifest",
+)
+
+
+def _yocto_root(start: Path) -> Path | None:
+    for probe in _YOCTO_PROBES:
+        deploy = start / probe
+        if not deploy.is_dir():
+            continue
+        if any(next(deploy.glob(pattern), None) for pattern in _YOCTO_EVIDENCE):
+            return deploy
+    return None
+
+
+def _buildroot_root(start: Path) -> Path | None:
+    for probe in _BUILDROOT_PROBES:
+        directory = start / probe
+        if (directory / "manifest.csv").is_file():
+            return directory
+    return None
+
+
+def detect(root: Path) -> Detected:
+    """Decide which build system produced `root`.
+
+    Raises if nothing is found, or if both are -- guessing between two real
+    build trees would silently drop half the components.
+    """
+    if not root.exists():
+        raise DetectionError(f"{root} does not exist")
+    if not root.is_dir():
+        raise DetectionError(f"{root} is not a directory")
+
+    yocto = _yocto_root(root)
+    buildroot = _buildroot_root(root)
+
+    if yocto and buildroot:
+        raise DetectionError(
+            f"{root} looks like both a Yocto deploy directory ({yocto}) and a "
+            f"Buildroot output directory ({buildroot}); point at one of them"
+        )
+    if yocto:
+        return Detected(BuildSystem.YOCTO, yocto)
+    if buildroot:
+        return Detected(BuildSystem.BUILDROOT, buildroot)
+
+    raise DetectionError(
+        f"{root} is neither a Yocto deploy directory nor a Buildroot output "
+        f"directory: looked for images/*/*.manifest, licenses/*/license.manifest "
+        f"and legal-info/manifest.csv"
+    )

sbom_embedded/parsers/yocto.py

@@ -0,0 +1,347 @@
+"""Yocto / OpenEmbedded build output.
+
+Reads what a finished build already wrote to `tmp/deploy`. Nothing here runs
+bitbake, and nothing here needs the build tree to still exist.
+
+The image manifest is written by `format_pkg_list(..., "ver")` in
+oe/utils.py as `"%s %s %s" % (pkg, arch, ver)` -- one space, no quoting, no
+header. That has been stable across every release and every package backend.
+What is *in* those columns is not, which is what the parsing below is about.
+"""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+from enum import StrEnum
+from pathlib import Path
+
+from ..models import Component, make_purl
+
+
+class YoctoParseError(Exception):
+    """The deploy directory does not hold what we need to read."""
+
+
+def _excerpt(text: str, limit: int = 120) -> str:
+    """Keep an error message the size of an error message.
+
+    These messages interpolate raw input, and a manifest is allowed to be
+    enormous: a single 100 MB line otherwise produces 100 MB of stderr. The
+    line number already says where to look.
+    """
+    if len(text) <= limit:
+        return repr(text)
+    return f"{text[:limit]!r}... ({len(text)} chars)"
+
+
+# The rpm backend reports a bare PKGV; deb and ipk both report the control
+# file's Version field, which is "[PKGE:]PKGV-PKGR" -- so the same image built
+# with PACKAGE_CLASSES=package_ipk yields "1.36.1-r0" where rpm yields
+# "1.36.1". PKGR is Yocto's packaging revision and PKGE its epoch; neither is
+# part of the upstream version a CVE feed knows. Stripping them is what makes
+# the SBOM identical regardless of which backend produced the image.
+_EPOCH = re.compile(r"^(?P<epoch>\d+):(?P<rest>.*)$")
+_REVISION = re.compile(r"-(?P<revision>r\d+)$")
+
+
+def normalize_version(raw: str) -> str:
+    """Reduce a package-manager version string to the upstream version.
+
+    The `+git0+<sha>` suffix OE appends to git recipes is deliberately kept:
+    it is part of PKGV and identifies the actual source revision.
+    """
+    version = raw
+    if match := _EPOCH.match(version):
+        version = match["rest"]
+    if match := _REVISION.search(version):
+        version = version[: match.start()]
+    return version
+
+
+class ManifestKind(StrEnum):
+    """Which artifact a manifest file is, in order of usefulness.
+
+    LICENSE wins wherever both describe the same image: it is a complete
+    inventory of the installed packages *and* carries licenses and recipe
+    names, which the image manifest does not.
+    """
+
+    LICENSE = "license"
+    IMAGE = "image"
+
+
+@dataclass(frozen=True)
+class ManifestFile:
+    """A manifest found in a deploy directory, and what it describes."""
+
+    path: Path
+    kind: ManifestKind
+    # "core-image-minimal-qemux86-64" -- the SBOM's root component name.
+    label: str
+    # The image alone, when the machine could be split off the label. Image
+    # manifests always can (the machine is their parent directory); license
+    # manifests only can when an image manifest revealed the machine name.
+    image: str | None = None
+
+    def matches(self, selector: str) -> bool:
+        return selector == self.label or selector == self.image
+
+    @property
+    def choice(self) -> str:
+        return self.image or self.label
+
+
+# Yocto appends a build timestamp to the license directory and writes a
+# symlink without it: "<image>-<machine>.rootfs-20250610090225" beside
+# "<image>-<machine>.rootfs". Releases before 4.3 omit the ".rootfs" infix.
+_TIMESTAMPED = re.compile(r"-\d{14}$")
+
+
+def _license_label(directory: Path) -> str:
+    return _TIMESTAMPED.sub("", directory.name).removesuffix(".rootfs")
+
+
+def find_license_manifests(deploy: Path, machines: set[str]) -> list[ManifestFile]:
+    """Locate every `license.manifest` under a deploy directory.
+
+    The arch level in `licenses/<arch>/<image>-<machine>/` was added in Yocto
+    4.3, so both depths are searched. `image_license.manifest` is deliberately
+    not picked up: it describes deployed artifacts, not installed packages.
+    """
+    found: dict[str, ManifestFile] = {}
+    licenses = deploy / "licenses"
+    for pattern in ("*/license.manifest", "*/*/license.manifest"):
+        for path in sorted(licenses.glob(pattern)):
+            label = _license_label(path.parent)
+            if label in found:
+                # The timestamped directory and its symlink hold the same file.
+                continue
+            image = next(
+                (
+                    label.removesuffix(f"-{m}")
+                    for m in machines
+                    if label.endswith(f"-{m}")
+                ),
+                None,
+            )
+            found[label] = ManifestFile(
+                path=path, kind=ManifestKind.LICENSE, label=label, image=image
+            )
+    return list(found.values())
+
+
+def find_image_manifests(deploy: Path) -> list[ManifestFile]:
+    """Locate every image manifest under a `tmp/deploy` directory.
+
+    Yocto writes a timestamped manifest plus a stable symlink to it. Only the
+    stable name is returned, so an image is never counted twice. Releases
+    before 4.3 omit the `.rootfs` infix, which is why it is stripped
+    optionally rather than required.
+    """
+    found: list[ManifestFile] = []
+    for path in sorted((deploy / "images").glob("*/*.manifest")):
+        machine = path.parent.name
+        # "core-image-minimal-qemux86-64.rootfs.manifest" -> "core-image-minimal"
+        stem = path.name.removesuffix(".manifest").removesuffix(".rootfs")
+        if not stem.endswith(f"-{machine}"):
+            # A timestamped copy (or a -dbg/SDK manifest). The symlink beside
+            # it carries the same content under the stable name.
+            continue
+        image = stem.removesuffix(f"-{machine}")
+        found.append(
+            ManifestFile(path=path, kind=ManifestKind.IMAGE, label=stem, image=image)
+        )
+    return found
+
+
+def find_manifests(deploy: Path) -> list[ManifestFile]:
+    """Find every manifest in a deploy directory, best source per image first."""
+    images = find_image_manifests(deploy)
+    machines = {m.label.removeprefix(f"{m.image}-") for m in images if m.image}
+    licenses = find_license_manifests(deploy, machines)
+
+    by_label: dict[str, ManifestFile] = {m.label: m for m in images}
+    for manifest in licenses:
+        by_label[manifest.label] = manifest
+    return sorted(by_label.values(), key=lambda m: m.label)
+
+
+def _read(path: Path) -> str:
+    """Read a manifest, turning read failures into our own error type.
+
+    Without this, a non-UTF-8 byte, an unreadable file or a dangling symlink
+    escapes as a traceback instead of the documented `error: ...` line.
+    """
+    try:
+        return path.read_text(encoding="utf-8")
+    except (OSError, UnicodeDecodeError) as err:
+        raise YoctoParseError(f"{path}: cannot read: {err}") from err
+
+
+def parse_image_manifest(path: Path) -> list[Component]:
+    """Read a three-column image manifest: `name arch version`."""
+    components: list[Component] = []
+    text = _read(path)
+    for lineno, line in enumerate(text.splitlines(), 1):
+        if not line.strip():
+            continue
+        # Split on the single separator space rather than on runs of
+        # whitespace: opkg_query initialises both arch and version to "", so a
+        # package missing either field produces "name  version" or "name arch "
+        # -- three fields, one of them empty. str.split() would silently see
+        # two fields and this would look like a malformed line.
+        fields = line.split(" ", 2)
+        if len(fields) != 3:
+            raise YoctoParseError(
+                f"{path}:{lineno}: expected 'name arch version', got {_excerpt(line)}"
+            )
+        name, _arch, raw_version = fields
+        # Not `if not name`: a name of only tabs or non-breaking space is
+        # truthy, and packageurl then fails with an opaque TypeError naming
+        # neither the file nor the line.
+        if not name.strip():
+            raise YoctoParseError(f"{path}:{lineno}: empty package name")
+        # maxsplit=2 puts everything after the second space in the version.
+        # No package version contains a space, so a fourth field means this is
+        # not the file we think it is -- and folding it into the version would
+        # produce a corrupt purl rather than an error.
+        if " " in raw_version.strip():
+            raise YoctoParseError(
+                f"{path}:{lineno}: version {raw_version.strip()!r} contains a "
+                f"space; expected exactly three fields"
+            )
+        # The architecture is deliberately not carried into the purl: rpm
+        # spells it core2_64, deb spells it core2-64, and purl-spec removed
+        # `arch` from the yocto type outright. It also adds nothing to
+        # identity, since a package name appears at most once per image.
+        version = normalize_version(raw_version.strip()) or None
+        components.append(
+            Component(name=name, version=version, purl=make_purl(name, version))
+        )
+    return components
+
+
+def parse_license_manifest(path: Path) -> list[Component]:
+    """Read a license.manifest into components.
+
+    Blocks of `KEY: value` lines separated by one blank line, written by
+    `write_license_files()` in license_image.bbclass:
+
+        PACKAGE NAME: libcrypto
+        PACKAGE VERSION: 3.3.2
+        RECIPE NAME: openssl
+        LICENSE: Apache-2.0
+
+    The recipe name is kept as a property because it is what a CVE feed
+    knows: this image installs `libcrypto`, `openssl-conf` and
+    `openssl-ossl-module-legacy`, and all three are openssl.
+    """
+    components: list[Component] = []
+    text = _read(path)
+
+    # Blocks are separated by a blank line. Splitting on the literal "\n\n"
+    # would treat a separator line holding a stray space or tab as ordinary
+    # content, silently merging two packages into one record -- and because a
+    # block is a dict, the second package's values would quietly win while the
+    # first disappeared from the SBOM with a zero exit code.
+    blocks: list[list[str]] = []
+    current: list[str] = []
+    for line in text.splitlines():
+        if line.strip():
+            current.append(line)
+        elif current:
+            blocks.append(current)
+            current = []
+    if current:
+        blocks.append(current)
+
+    for lines in blocks:
+        fields: dict[str, str] = {}
+        for line in lines:
+            key, separator, value = line.partition(":")
+            if not separator:
+                raise YoctoParseError(
+                    f"{path}: expected 'KEY: value', got {_excerpt(line)}"
+                )
+            key = key.strip()
+            if key in fields:
+                # Two blocks run together with no separator at all. Last-wins
+                # would drop a package without a word.
+                raise YoctoParseError(
+                    f"{path}: duplicate key {key!r} in one block "
+                    f"({_excerpt(fields[key])} then {_excerpt(value.strip())}); "
+                    f"blocks must be separated by a blank line"
+                )
+            fields[key] = value.strip()
+
+        if "PACKAGE NAME" not in fields:
+            # image_license.manifest uses RECIPE NAME / VERSION / LICENSE /
+            # FILES and describes deployed artifacts rather than installed
+            # packages. Reading it as a package list would be wrong, and
+            # keying on "PACKAGE NAME" would silently yield nothing.
+            raise YoctoParseError(
+                f"{path}: no 'PACKAGE NAME' in block with keys "
+                f"{sorted(fields)} -- this looks like an "
+                f"image_license.manifest, which lists deployed files"
+            )
+
+        name = fields["PACKAGE NAME"]
+        if not name:
+            raise YoctoParseError(f"{path}: empty PACKAGE NAME")
+        version = normalize_version(fields.get("PACKAGE VERSION", "")) or None
+        recipe = fields.get("RECIPE NAME") or None
+
+        components.append(
+            Component(
+                name=name,
+                version=version,
+                license=fields.get("LICENSE") or None,
+                purl=make_purl(name, version),
+                properties={"yocto:recipe": recipe} if recipe else {},
+            )
+        )
+    return components
+
+
+def parse(deploy: Path, *, image: str | None = None) -> tuple[list[Component], str]:
+    """Parse one image from a deploy directory.
+
+    Returns the components and the image label to use as the SBOM's root
+    component. Where a license manifest and an image manifest describe the
+    same image the license manifest is used, because it is the same inventory
+    with licenses and recipe names attached.
+
+    A deploy directory holding several images is ambiguous rather than wrong,
+    so the caller is told to choose instead of getting a guess.
+    """
+    manifests = find_manifests(deploy)
+    if not manifests:
+        raise YoctoParseError(f"no image or license manifest found under {deploy}")
+
+    if image is not None:
+        # An exact label wins over a short image name. Without this, a license
+        # directory named "core-image-minimal" beside an image manifest for
+        # "core-image-minimal-qemux86-64" leaves no string that selects the
+        # first: the short name matches both, and the label matches both too.
+        exact = [m for m in manifests if m.label == image]
+        manifests = exact or [m for m in manifests if m.matches(image)]
+        if not manifests:
+            raise YoctoParseError(f"no manifest matching {image!r} under {deploy}")
+
+    if len(manifests) > 1:
+        # `choice` is the short image name where one could be derived. Where
+        # two manifests share it -- a license directory that omits the machine
+        # suffix beside an image manifest that has it -- the short names would
+        # name the same image twice and neither would select anything.
+        short = [m.choice for m in manifests]
+        names = short if len(set(short)) == len(short) else [m.label for m in manifests]
+        choices = ", ".join(sorted(names))
+        raise YoctoParseError(
+            f"{deploy} holds several images ({choices}); pick one with --image"
+        )
+
+    manifest = manifests[0]
+    if manifest.kind is ManifestKind.LICENSE:
+        return parse_license_manifest(manifest.path), manifest.label
+    return parse_image_manifest(manifest.path), manifest.label

sbom_embedded/writer.py

@@ -0,0 +1,147 @@
+"""CycloneDX output.
+
+Written once, against `Component`. Parsers never touch CycloneDX types, so
+the schema details -- and the library that validates them -- live here alone.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Iterable
+from datetime import datetime
+from uuid import UUID
+
+from cyclonedx.contrib.hash.factories import HashTypeFactory
+from cyclonedx.contrib.license.factories import LicenseFactory
+from cyclonedx.model import Property
+from cyclonedx.model.bom import Bom
+from cyclonedx.model.component import Component as CdxComponent
+from cyclonedx.model.component import ComponentType
+from cyclonedx.model.contact import OrganizationalEntity
+from cyclonedx.model.dependency import Dependency
+from cyclonedx.output import make_outputter
+from cyclonedx.schema import OutputFormat, SchemaVersion
+from packageurl import PackageURL
+
+from . import __version__
+from .models import Component
+
+# 1.6 is what the CRA-adjacent tooling (Dependency-Track, Grype, Trivy) reads
+# today; 1.7 is newer than most of it.
+DEFAULT_SCHEMA_VERSION = SchemaVersion.V1_6
+
+_licenses = LicenseFactory()
+_hashes = HashTypeFactory()
+
+
+def _to_cyclonedx(component: Component) -> CdxComponent:
+    """Translate one parsed component into a CycloneDX component."""
+    licenses = []
+    if component.license:
+        # Yocto writes "GPL-2.0-only & MIT" and Buildroot "GPL-2.0+, MIT" --
+        # neither is a valid SPDX expression. make_from_string keeps a real
+        # SPDX id or expression as such and falls back to a named license
+        # instead of dropping the string on the floor.
+        licenses.append(_licenses.make_from_string(component.license))
+
+    hashes = []
+    if component.hash:
+        hashes.append(_hashes.from_composite_str(component.hash))
+
+    return CdxComponent(
+        name=component.name,
+        version=component.version,
+        type=ComponentType.LIBRARY,
+        purl=PackageURL.from_string(component.purl) if component.purl else None,
+        bom_ref=component.purl,
+        supplier=(
+            OrganizationalEntity(name=component.supplier)
+            if component.supplier
+            else None
+        ),
+        licenses=licenses or None,
+        hashes=hashes or None,
+        properties=[
+            Property(name=name, value=value)
+            for name, value in sorted(component.properties.items())
+        ]
+        or None,
+    )
+
+
+def build_bom(
+    components: Iterable[Component],
+    *,
+    product_name: str,
+    product_version: str | None = None,
+    serial_number: UUID | None = None,
+    timestamp: datetime | None = None,
+) -> Bom:
+    """Assemble a BOM whose root component is the image itself.
+
+    `serial_number` and `timestamp` exist so tests (and reproducible builds)
+    can pin the two fields that would otherwise change on every run.
+    """
+    bom = Bom(serial_number=serial_number)
+
+    root = CdxComponent(
+        name=product_name,
+        version=product_version,
+        # The deliverable is a firmware image, not an application -- this is
+        # the distinction a CRA reviewer cares about.
+        type=ComponentType.FIRMWARE,
+        bom_ref=product_name,
+    )
+    bom.metadata.component = root
+    if timestamp is not None:
+        bom.metadata.timestamp = timestamp
+    bom.metadata.tools.components.add(
+        CdxComponent(
+            name="sbom-embedded",
+            version=__version__,
+            type=ComponentType.APPLICATION,
+        )
+    )
+
+    rendered = [_to_cyclonedx(component) for component in components]
+    for cdx in rendered:
+        bom.components.add(cdx)
+
+    # Every package is a direct part of the image. This is not a real
+    # dependency graph -- the manifests do not carry one -- but consumers that
+    # walk `dependencies` from the root would otherwise see nothing.
+    #
+    # Built directly rather than through Bom.register_dependency, which scans
+    # the whole dependency set on every call and so costs O(n^2): rendering
+    # 4000 packages took 2.7 s through it and 1.6 s this way, for
+    # byte-identical output. Real images reach a few thousand packages.
+    bom.dependencies.add(
+        Dependency(
+            ref=root.bom_ref,
+            dependencies=[Dependency(ref=cdx.bom_ref) for cdx in rendered],
+        )
+    )
+    for cdx in rendered:
+        bom.dependencies.add(Dependency(ref=cdx.bom_ref))
+
+    return bom
+
+
+def to_json(
+    components: Iterable[Component],
+    *,
+    product_name: str,
+    product_version: str | None = None,
+    serial_number: UUID | None = None,
+    timestamp: datetime | None = None,
+    schema_version: SchemaVersion = DEFAULT_SCHEMA_VERSION,
+) -> str:
+    """Render components as a CycloneDX JSON document."""
+    bom = build_bom(
+        components,
+        product_name=product_name,
+        product_version=product_version,
+        serial_number=serial_number,
+        timestamp=timestamp,
+    )
+    outputter = make_outputter(bom, OutputFormat.JSON, schema_version)
+    return outputter.output_as_string(indent=2)

sbom_embedded-0.1.0.dist-info/METADATA

@@ -0,0 +1,313 @@
+Metadata-Version: 2.5
+Name: sbom-embedded
+Version: 0.1.0
+Summary: CycloneDX SBOM generator for Yocto and Buildroot build output
+Project-URL: Homepage, https://github.com/RchrdWrd/sbom-embedded
+Project-URL: Source, https://github.com/RchrdWrd/sbom-embedded
+Author-email: Richard Ward <richard.daily.ward@gmail.com>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: buildroot,cra,cyclonedx,embedded,sbom,yocto
+Requires-Python: >=3.11
+Requires-Dist: cyclonedx-python-lib>=11.6
+Requires-Dist: packageurl-python>=0.15
+Requires-Dist: typer>=0.16
+Description-Content-Type: text/markdown
+
+# sbom-embedded
+
+[![CI](https://github.com/RchrdWrd/sbom-embedded/actions/workflows/ci.yml/badge.svg)](https://github.com/RchrdWrd/sbom-embedded/actions/workflows/ci.yml)
+[![Python](https://img.shields.io/badge/python-3.11%20%7C%203.12%20%7C%203.13%20%7C%203.14-blue)](https://github.com/RchrdWrd/sbom-embedded/blob/main/pyproject.toml)
+[![License: MIT](https://img.shields.io/badge/license-MIT-green)](https://github.com/RchrdWrd/sbom-embedded/blob/main/LICENSE)
+
+Generate a CycloneDX SBOM from a Yocto or Buildroot build you have already
+run, by reading the manifest files the build wrote — no rebuild, no bitbake,
+under a tenth of a second.
+
+The EU Cyber Resilience Act (2024/2847) requires device manufacturers to keep
+a machine-readable component list for their products. Syft, Trivy and cdxgen
+are good at containers and npm and weak at embedded Linux build systems. This
+fills that gap.
+
+## Install and run
+
+```bash
+pipx run --spec git+https://github.com/RchrdWrd/sbom-embedded sbom-embedded ./output > sbom.json
+```
+
+With `uv`:
+
+```bash
+uvx --from git+https://github.com/RchrdWrd/sbom-embedded sbom-embedded ./output > sbom.json
+```
+
+Or install it properly:
+
+```bash
+pipx install git+https://github.com/RchrdWrd/sbom-embedded
+```
+
+Python 3.11 or newer. The tool only reads files, so it runs anywhere Python
+does.
+
+## Usage
+
+Point it at a build directory. It works out which build system produced it —
+you do not have to say.
+
+```bash
+sbom-embedded ./build/tmp/deploy > sbom.json    # Yocto
+sbom-embedded ./output > sbom.json              # Buildroot
+```
+
+| Option | Meaning |
+| --- | --- |
+| `--format` | Output format. `cyclonedx` is the only one. |
+| `--image` | Which image to describe, when a Yocto deploy holds several. |
+| `--name` | Name for the product. Defaults to the image name, or `buildroot`. |
+| `--product-version` | Version of the product. Omitted from the SBOM if not given. |
+| `--output`, `-o` | Write to a file instead of stdout. |
+
+### Real output
+
+Run against a Buildroot manifest in this repository:
+
+```console
+$ sbom-embedded tests/fixtures/buildroot-2023.02
+{
+  "components": [
+    {
+      "bom-ref": "pkg:generic/busybox@1.36.1",
+      "licenses": [
+        {
+          "license": {
+            "name": "GPL-2.0, bzip2-1.0.4"
+          }
+        }
+      ],
+      "name": "busybox",
+      "purl": "pkg:generic/busybox@1.36.1",
+      "type": "library",
+      "version": "1.36.1"
+    },
+    ...
+```
+
+If a Yocto deploy directory holds more than one image, it stops and lists them
+rather than picking one:
+
+```console
+$ sbom-embedded tests/fixtures/yocto-6.0.2
+error: tests/fixtures/yocto-6.0.2 holds several images (core-image-full-cmdline,
+core-image-minimal); pick one with --image
+```
+
+### On a real Buildroot build
+
+Verified end to end on Buildroot `2026.08-rc3-28-g79fd6241e4`:
+
+```bash
+git clone https://gitlab.com/buildroot.org/buildroot.git
+cd buildroot
+make qemu_x86_64_defconfig
+make legal-info          # downloads sources, does not compile: 10-30 min
+sbom-embedded ./output -o sbom.json
+```
+
+```console
+$ sbom-embedded ./output -o sbom.json
+wrote 44 components to sbom.json
+```
+
+44 components in **0.09 s**; all 44 carry a purl, a version and a license; 26
+distinct license expressions; the document validates against the CycloneDX 1.6
+schema. That build's manifest is committed as
+`tests/fixtures/buildroot-2026.08/` — see
+[PROVENANCE.md](https://github.com/RchrdWrd/sbom-embedded/blob/main/tests/fixtures/PROVENANCE.md).
+
+> **Ubuntu 25.10 and newer:** `make legal-info` refuses to start with
+> *"You have an uutils 'install' version installed"*, because those releases
+> ship uutils coreutils rather than GNU coreutils. You can fix it system-wide
+> with `sudo update-alternatives --install /usr/bin/install install /usr/bin/gnuinstall 100`,
+> or just for one build without touching the system:
+>
+> ```bash
+> mkdir -p /tmp/gnushim && ln -sf /usr/bin/gnuinstall /tmp/gnushim/install
+> PATH=/tmp/gnushim:$PATH make legal-info
+> ```
+
+## Read this before you scan the output
+
+**A vulnerability scan of this SBOM can report zero findings while the
+firmware is full of known vulnerabilities.** This is not a hypothetical.
+
+Every component gets a `pkg:generic/<name>@<version>` purl. Neither Yocto nor
+Buildroot packages exist in any ecosystem repository, so there is no better
+purl type available. But Grype, Trivy and Dependency-Track do not resolve
+`pkg:generic` to a vulnerability namespace — they reach the NVD through CPEs,
+which this tool does not emit, because a CPE would be a guess about vendor and
+product strings rather than something any manifest records.
+
+Measured, not assumed. The SBOM from the real Buildroot build above, scanned
+with Grype 0.118.0:
+
+```console
+$ grype sbom:sbom.json
+No vulnerabilities found
+```
+
+The same five packages, with CPEs added by hand purely to demonstrate the
+difference:
+
+```console
+NAME     INSTALLED  TYPE            VULNERABILITY   SEVERITY  EPSS         RISK
+busybox  1.38.0     UnknownPackage  CVE-2026-38754  High      0.4% (33rd)  0.3
+busybox  1.38.0     UnknownPackage  CVE-2026-38755  High      0.3% (27th)  0.2
+busybox  1.38.0     UnknownPackage  CVE-2026-38753  High      0.2% (15th)  0.2
+```
+
+Same document, same packages, same scanner. The difference is the identifier,
+not the firmware.
+
+So: use this SBOM as a component inventory and a compliance record. **Do not
+read a clean Grype run on it as evidence that the firmware is clean.** For
+vulnerability matching you need a tool that maps package names to CPEs, or a
+scanner configured for these package names specifically.
+
+## How much of this is verified on real builds
+
+Both paths have been walked from a build to an SBOM on real hardware, not
+from fixtures alone.
+
+**Buildroot.** A real `make legal-info` on Buildroot 2026.08-rc3 produced the
+44-package manifest shown above, and a real `make` produced a complete output
+tree of 867,355 files. That tree turned out to contain ten files named
+`*.manifest` — all of them Windows application manifests inside host package
+sources (host-python3, host-cmake, host-ninja, gcc). None sits at
+`images/<dir>/*.manifest`, which is the only reason Yocto detection does not
+fire on a Buildroot tree; there is a test pinning that.
+
+**Yocto.** `bitbake core-image-minimal` was run to completion for qemux86-64
+on the Yocto 6.0.2 release revisions, and the tool was run against the
+`tmp/deploy` directory it wrote:
+
+```console
+$ sbom-embedded ./deploy -o sbom.json
+wrote 39 components to sbom.json
+```
+
+39 components in 0.09 s, every one with a purl, a license and a `yocto:recipe`
+property, validating against the CycloneDX 1.6 schema. That deploy tree is
+committed as `tests/fixtures/yocto-6.0.2-live/`.
+
+The same image was then rebuilt with `PACKAGE_CLASSES = "package_ipk"`. That
+matters because every other fixture here comes from an rpm-backend build, and
+rpm is the one backend whose version column carries no package revision. In
+the ipk manifest all 38 rows do (`busybox 1.37.0-r0`), two carry `-r1`, and
+`netbase all 1:6.5-r0` carries an epoch. The tool strips all of that, so the
+37 purls the two images share are byte-identical: **the same firmware
+described the same way regardless of how it was packaged.** Both manifests are
+committed, and a test compares them.
+
+It is the only fixture holding both manifest kinds from a single build, which
+makes it the one that demonstrates why they must never be joined by package
+name: the image manifest lists 37 packages, the license manifest 39, and 11 of
+the 37 names have no counterpart on the other side — `libc6` against `glibc`,
+`libz1` against `zlib`, `libcrypto3` against `libcrypto`, and so on.
+
+> **Building Yocto on a current host:** the 6.0.2 release works, but the
+> 5.0.9 release does not — its bitbake crashes on Python 3.14, and its
+> `UNINATIVE_MAXGLIBCVERSION` is below a current glibc. Configuring
+> `SSTATE_MIRRORS` against `sstate.yoctoproject.org` is what makes the build
+> practical: 373 of 396 wanted objects came from the mirror, so it fit on a
+> machine with 7 GB of free disk instead of needing 20-40.
+
+## Known limitations
+
+* **Yocto builds without a license manifest produce no licenses.** The image
+  manifest has no license column. If your build kept
+  `tmp/deploy/licenses/`, that is read instead and you get licenses and recipe
+  names; otherwise you get names, versions and purls only. Buildroot always
+  carries licenses.
+* **Package names are not upstream project names.** Your firmware contains
+  `libcrypto`, `openssl-conf` and `openssl-ossl-module-legacy`; a CVE database
+  knows `openssl`. Where a Yocto license manifest is read, the recipe behind
+  each package is recorded as a `yocto:recipe` property. Where only the image
+  manifest exists, the names are the Debian-renamed forms (`libc6`, `libz1`)
+  with no way back.
+* **License strings are copied, not normalised.** Yocto writes
+  `GPL-2.0-only & MIT` and Buildroot `GPL-2.0+ (programs), LGPL-2.1+` — neither
+  is a valid SPDX expression. Valid SPDX identifiers and expressions are
+  emitted as such; everything else is emitted as a named license, verbatim.
+  Nothing is guessed at or dropped.
+* **No supplier and no hashes.** Neither build system records a supplier or a
+  per-package hash, so those fields are absent rather than invented.
+* **The dependency graph is flat.** Every package hangs off the image. The
+  manifests read do not carry inter-package dependencies.
+* **Buildroot `SOURCE ARCHIVE`, `SOURCE SITE` and `LICENSE FILES` are not
+  emitted.**
+* **The product name and version are yours to supply.** A Buildroot manifest
+  carries no product identity, so the root component is named `buildroot`
+  unless you pass `--name`, and has no version unless you pass
+  `--product-version`. Nothing is invented to fill them.
+
+The underlying reasoning, and the manifest formats in detail, are in
+[DESIGN.md](https://github.com/RchrdWrd/sbom-embedded/blob/main/DESIGN.md).
+
+## Releasing
+
+Publishing runs from `.github/workflows/publish.yml` through PyPI Trusted
+Publishing, so there is no API token anywhere in the repository or in GitHub
+secrets — PyPI verifies the workflow's identity over OpenID Connect.
+
+One-time setup, on PyPI under *Your projects → Publishing → Add a pending
+publisher*:
+
+| Field | Value |
+| --- | --- |
+| PyPI project name | `sbom-embedded` |
+| Owner | `RchrdWrd` |
+| Repository name | `sbom-embedded` |
+| Workflow name | `publish.yml` |
+| Environment name | `pypi` |
+
+Repeat it on [test.pypi.org](https://test.pypi.org) with environment
+`testpypi`. Then, in the repository's *Settings → Environments*, create both
+environments — add a required reviewer on `pypi` if you want a manual gate.
+
+To release:
+
+1. Run the **Publish** workflow manually against `testpypi` and check the
+   rendered project page.
+2. Bump `version` in `pyproject.toml`, update `CHANGELOG.md`, commit.
+3. Tag and push: `git tag -a v0.2.0 -m "..." && git push origin v0.2.0`.
+
+The tag push publishes to PyPI. The workflow refuses to publish if the tag and
+the packaged version disagree, and it installs the built wheel and generates an
+SBOM from it before either upload step runs. A PyPI release cannot be replaced,
+only yanked, which is why TestPyPI comes first.
+
+## Development
+
+```bash
+uv sync
+uv run pytest
+```
+
+Without `uv`:
+
+```bash
+python3 -m venv .venv
+.venv/bin/pip install -e . --group dev   # needs pip 25.1+ for --group
+.venv/bin/python -m pytest
+```
+
+92 tests, a second or two. They run from fixture files under
+`tests/fixtures`, never from a live build. Every fixture is unmodified output
+from a real Yocto or Buildroot build —
+[PROVENANCE.md](https://github.com/RchrdWrd/sbom-embedded/blob/main/tests/fixtures/PROVENANCE.md) records where each came from and
+what it is kept for. The format details matter too much to mock.
+
+## License
+
+MIT — see [LICENSE](https://github.com/RchrdWrd/sbom-embedded/blob/main/LICENSE).

sbom_embedded-0.1.0.dist-info/RECORD

@@ -0,0 +1,14 @@
+sbom_embedded/__init__.py,sha256=FfqzTmaeOxJp1tHwAosjACYE7Db6t9CKGiSLz5dDrAA,94
+sbom_embedded/cli.py,sha256=mkOYPH6BSliddXSLYtJ-u-RL6E2Jx_6Zen0fVjBpJLY,4644
+sbom_embedded/models.py,sha256=awnRLm1mdLmZimJP84Q1axF8X43153x2yLmAJv_9SOU,2242
+sbom_embedded/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+sbom_embedded/writer.py,sha256=WsAGPdYa1rKL85BCRGckOFmAL_NqbtUtJQwTyONzn9I,4992
+sbom_embedded/parsers/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+sbom_embedded/parsers/buildroot.py,sha256=t6vwaHn1ao_ntG4IiyLb_j0KVTHh-WWWto4YqqmgOLM,4710
+sbom_embedded/parsers/detect.py,sha256=m27-E4Qyuj57Y7F_5WUpg3MwNl5j3BAtq0DI4M00U8E,3334
+sbom_embedded/parsers/yocto.py,sha256=zJQ6pLEdbblda4i6rTWqelwnY4FeCsXWDAuDxvqzeC4,14404
+sbom_embedded-0.1.0.dist-info/METADATA,sha256=J8cdgf2ybHeV5kZp2aRrhbZbqiTOi8s2PxnRjB29fo0,12490
+sbom_embedded-0.1.0.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
+sbom_embedded-0.1.0.dist-info/entry_points.txt,sha256=Ca8oRgbjaNl2ithnIQDCJ7otixjsL3pOFXlNQxFz_F0,56
+sbom_embedded-0.1.0.dist-info/licenses/LICENSE,sha256=k-JiC0-uu0JRXqMfu1238PBZhG7giCrWauKThcIKdkY,1069
+sbom_embedded-0.1.0.dist-info/RECORD,,

sbom_embedded-0.1.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.32.0
+Root-Is-Purelib: true
+Tag: py3-none-any

sbom_embedded-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+sbom-embedded = sbom_embedded.cli:app

sbom_embedded-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Richard Ward
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.