spdx-diff 1.0.0__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- spdx_diff-1.0.0/.github/workflows/test.yaml +63 -0
- spdx_diff-1.0.0/.gitignore +56 -0
- spdx_diff-1.0.0/CHANGELOG.md +34 -0
- spdx_diff-1.0.0/INSTALL.md +77 -0
- spdx_diff-1.0.0/LICENSE +21 -0
- spdx_diff-1.0.0/PKG-INFO +233 -0
- spdx_diff-1.0.0/README.md +209 -0
- spdx_diff-1.0.0/pyproject.toml +116 -0
- spdx_diff-1.0.0/src/spdx_diff/__init__.py +4 -0
- spdx_diff-1.0.0/src/spdx_diff/cli.py +627 -0
- spdx_diff-1.0.0/tests/conftest.py +48 -0
- spdx_diff-1.0.0/tests/helper.py +149 -0
- spdx_diff-1.0.0/tests/test_kernel.py +52 -0
- spdx_diff-1.0.0/tests/test_package.py +65 -0
- spdx_diff-1.0.0/tests/test_packageconfig.py +19 -0
|
@@ -0,0 +1,63 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: Test sbom-cve-check
|
|
3
|
+
on:
|
|
4
|
+
- pull_request
|
|
5
|
+
- workflow_dispatch
|
|
6
|
+
|
|
7
|
+
jobs:
|
|
8
|
+
build:
|
|
9
|
+
runs-on: ubuntu-latest
|
|
10
|
+
strategy:
|
|
11
|
+
matrix:
|
|
12
|
+
python-version:
|
|
13
|
+
- "3.10"
|
|
14
|
+
- "3.11"
|
|
15
|
+
- "3.14"
|
|
16
|
+
steps:
|
|
17
|
+
- uses: actions/checkout@v5
|
|
18
|
+
- name: Checkout meta-spdx-diff-test for tests
|
|
19
|
+
uses: actions/checkout@v5
|
|
20
|
+
with:
|
|
21
|
+
repository: bootlin/meta-spdx-diff-test
|
|
22
|
+
path: meta-spdx-diff-test
|
|
23
|
+
- name: Setup Python ${{ matrix.python-version }}
|
|
24
|
+
uses: actions/setup-python@v5
|
|
25
|
+
with:
|
|
26
|
+
python-version: ${{ matrix.python-version }}
|
|
27
|
+
- name: Install dependencies
|
|
28
|
+
run: |
|
|
29
|
+
python -m pip install --upgrade pip
|
|
30
|
+
pip install build
|
|
31
|
+
- name: Build package
|
|
32
|
+
run: |
|
|
33
|
+
python -m build
|
|
34
|
+
- name: Install package
|
|
35
|
+
run: |
|
|
36
|
+
pip install -e .
|
|
37
|
+
- name: Install test dependencies
|
|
38
|
+
run: |
|
|
39
|
+
pip install --group test
|
|
40
|
+
- name: Run tests
|
|
41
|
+
env:
|
|
42
|
+
SPDX_DIFF_SBOM_DATA: ${{ github.workspace }}/meta-spdx-diff-test/sbom-data
|
|
43
|
+
working-directory: tests
|
|
44
|
+
run: |
|
|
45
|
+
pytest -v
|
|
46
|
+
|
|
47
|
+
lint:
|
|
48
|
+
runs-on: ubuntu-latest
|
|
49
|
+
steps:
|
|
50
|
+
- uses: actions/checkout@v5
|
|
51
|
+
- name: Setup Python
|
|
52
|
+
uses: actions/setup-python@v5
|
|
53
|
+
with:
|
|
54
|
+
python-version: "3.10"
|
|
55
|
+
- name: Install dependencies
|
|
56
|
+
run: |
|
|
57
|
+
python -m pip install --upgrade pip
|
|
58
|
+
pip install -e .
|
|
59
|
+
pip install --group lint --group test
|
|
60
|
+
- name: Run mypy
|
|
61
|
+
run: |
|
|
62
|
+
mypy src tests
|
|
63
|
+
- uses: astral-sh/ruff-action@v3
|
|
@@ -0,0 +1,56 @@
|
|
|
1
|
+
# Byte-compiled / optimized / DLL files
|
|
2
|
+
__pycache__/
|
|
3
|
+
*.py[cod]
|
|
4
|
+
*$py.class
|
|
5
|
+
|
|
6
|
+
# Distribution / packaging
|
|
7
|
+
.Python
|
|
8
|
+
build/
|
|
9
|
+
develop-eggs/
|
|
10
|
+
dist/
|
|
11
|
+
downloads/
|
|
12
|
+
eggs/
|
|
13
|
+
.eggs/
|
|
14
|
+
lib/
|
|
15
|
+
lib64/
|
|
16
|
+
parts/
|
|
17
|
+
sdist/
|
|
18
|
+
var/
|
|
19
|
+
wheels/
|
|
20
|
+
*.egg-info/
|
|
21
|
+
.installed.cfg
|
|
22
|
+
*.egg
|
|
23
|
+
MANIFEST
|
|
24
|
+
|
|
25
|
+
# PyInstaller
|
|
26
|
+
*.manifest
|
|
27
|
+
*.spec
|
|
28
|
+
|
|
29
|
+
# Installer logs
|
|
30
|
+
pip-log.txt
|
|
31
|
+
pip-delete-this-directory.txt
|
|
32
|
+
|
|
33
|
+
# Unit test / coverage reports
|
|
34
|
+
htmlcov/
|
|
35
|
+
.tox/
|
|
36
|
+
.coverage
|
|
37
|
+
.coverage.*
|
|
38
|
+
.cache
|
|
39
|
+
nosetests.xml
|
|
40
|
+
coverage.xml
|
|
41
|
+
*.cover
|
|
42
|
+
.hypothesis/
|
|
43
|
+
.pytest_cache/
|
|
44
|
+
|
|
45
|
+
# Virtual environments
|
|
46
|
+
venv/
|
|
47
|
+
ENV/
|
|
48
|
+
env/
|
|
49
|
+
.venv
|
|
50
|
+
|
|
51
|
+
# IDEs
|
|
52
|
+
.vscode/
|
|
53
|
+
.idea/
|
|
54
|
+
*.swp
|
|
55
|
+
*.swo
|
|
56
|
+
*~
|
|
@@ -0,0 +1,34 @@
|
|
|
1
|
+
# Changelog
|
|
2
|
+
|
|
3
|
+
All notable changes to this project will be documented in this file.
|
|
4
|
+
|
|
5
|
+
## [Unreleased]
|
|
6
|
+
|
|
7
|
+
### Added
|
|
8
|
+
|
|
9
|
+
### Changed
|
|
10
|
+
|
|
11
|
+
### Fixed
|
|
12
|
+
|
|
13
|
+
### Removed
|
|
14
|
+
|
|
15
|
+
## [1.0.0] - 2026-02-12
|
|
16
|
+
|
|
17
|
+
### Added
|
|
18
|
+
- Initial stable release of spdx-diff
|
|
19
|
+
---
|
|
20
|
+
|
|
21
|
+
## Release Information
|
|
22
|
+
|
|
23
|
+
- **Version:** 1.0.0
|
|
24
|
+
- **Release Date:** 2026-02-12
|
|
25
|
+
- **Status:** Stable
|
|
26
|
+
- **Breaking Changes:** None (initial release)
|
|
27
|
+
|
|
28
|
+
This is the first stable release of spdx-diff.
|
|
29
|
+
|
|
30
|
+
---
|
|
31
|
+
|
|
32
|
+
<!-- Links -->
|
|
33
|
+
[unreleased]: https://github.com/bootlin/spdx-diff/compare/v1.0.0...HEAD
|
|
34
|
+
[1.0.0]: https://github.com/bootlin/spdx-diff/releases/tag/v1.0.0
|
|
@@ -0,0 +1,77 @@
|
|
|
1
|
+
# Installation
|
|
2
|
+
|
|
3
|
+
## Method 1: Quick Install (System-wide)
|
|
4
|
+
|
|
5
|
+
```bash
|
|
6
|
+
cd spdx-diff
|
|
7
|
+
pip install . --break-system-packages
|
|
8
|
+
```
|
|
9
|
+
|
|
10
|
+
**Use for:** Quick testing, single-user systems
|
|
11
|
+
|
|
12
|
+
---
|
|
13
|
+
|
|
14
|
+
## Method 2: Virtual Environment (Recommended)
|
|
15
|
+
|
|
16
|
+
```bash
|
|
17
|
+
cd spdx-diff
|
|
18
|
+
|
|
19
|
+
# Create virtual environment
|
|
20
|
+
python3 -m venv .venv
|
|
21
|
+
|
|
22
|
+
# Activate
|
|
23
|
+
source .venv/bin/activate
|
|
24
|
+
|
|
25
|
+
# Install
|
|
26
|
+
pip install -e .
|
|
27
|
+
|
|
28
|
+
# Use the tool
|
|
29
|
+
spdx-diff --help
|
|
30
|
+
|
|
31
|
+
# When done
|
|
32
|
+
deactivate
|
|
33
|
+
```
|
|
34
|
+
|
|
35
|
+
**Use for:** Development, multiple projects, safety
|
|
36
|
+
|
|
37
|
+
**Note:** The `-e` flag allows code changes to take effect immediately without reinstalling.
|
|
38
|
+
|
|
39
|
+
---
|
|
40
|
+
|
|
41
|
+
## Usage
|
|
42
|
+
|
|
43
|
+
After installation:
|
|
44
|
+
|
|
45
|
+
```bash
|
|
46
|
+
# Show help
|
|
47
|
+
spdx-diff --help
|
|
48
|
+
|
|
49
|
+
# Compare two SPDX files
|
|
50
|
+
spdx-diff reference.json new.json
|
|
51
|
+
|
|
52
|
+
# Show summary only
|
|
53
|
+
spdx-diff reference.json new.json --summary
|
|
54
|
+
|
|
55
|
+
# JSON output for automation
|
|
56
|
+
spdx-diff reference.json new.json --format json --output results.json
|
|
57
|
+
```
|
|
58
|
+
|
|
59
|
+
See `README.md` for full documentation.
|
|
60
|
+
|
|
61
|
+
---
|
|
62
|
+
|
|
63
|
+
## Uninstall
|
|
64
|
+
|
|
65
|
+
**System-wide:**
|
|
66
|
+
```bash
|
|
67
|
+
pip uninstall spdx-diff
|
|
68
|
+
```
|
|
69
|
+
|
|
70
|
+
**Virtual environment:**
|
|
71
|
+
```bash
|
|
72
|
+
source .venv/bin/activate
|
|
73
|
+
pip uninstall spdx-diff
|
|
74
|
+
deactivate
|
|
75
|
+
```
|
|
76
|
+
|
|
77
|
+
Or simply delete the `.venv/` directory.
|
spdx_diff-1.0.0/LICENSE
ADDED
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
GPL-2.0 License
|
|
2
|
+
|
|
3
|
+
Copyright (c) 2025 Schneider Electric
|
|
4
|
+
|
|
5
|
+
This program is free software; you can redistribute it and/or modify
|
|
6
|
+
it under the terms of the GNU General Public License as published by
|
|
7
|
+
the Free Software Foundation; either version 2 of the License, or
|
|
8
|
+
(at your option) any later version.
|
|
9
|
+
|
|
10
|
+
This program is distributed in the hope that it will be useful,
|
|
11
|
+
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
12
|
+
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
13
|
+
GNU General Public License for more details.
|
|
14
|
+
|
|
15
|
+
You should have received a copy of the GNU General Public License along
|
|
16
|
+
with this program; if not, write to the Free Software Foundation, Inc.,
|
|
17
|
+
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
|
18
|
+
|
|
19
|
+
---
|
|
20
|
+
|
|
21
|
+
For the full license text, see: https://www.gnu.org/licenses/old-licenses/gpl-2.0.html
|
spdx_diff-1.0.0/PKG-INFO
ADDED
|
@@ -0,0 +1,233 @@
|
|
|
1
|
+
Metadata-Version: 2.4
|
|
2
|
+
Name: spdx-diff
|
|
3
|
+
Version: 1.0.0
|
|
4
|
+
Summary: SPDX3 SBOM comparison tool for packages, kernel config, and PACKAGECONFIG
|
|
5
|
+
Project-URL: Repository, https://github.com/bootlin/spdx-diff
|
|
6
|
+
Project-URL: Documentation, https://github.com/bootlin/spdx-diff/blob/main/README.md
|
|
7
|
+
Project-URL: Bug Tracker, https://github.com/bootlin/spdx-diff/issues
|
|
8
|
+
Project-URL: Changelog, https://github.com/bootlin/spdx-diff/blob/main/CHANGELOG.md
|
|
9
|
+
Author-email: Kamel BOUHARA <kamel.bouhara@bootlin.com>
|
|
10
|
+
License: GPL-2.0
|
|
11
|
+
License-File: LICENSE
|
|
12
|
+
Keywords: embedded,kernel,linux,packageconfig,sbom,spdx,yocto
|
|
13
|
+
Classifier: Development Status :: 5 - Production/Stable
|
|
14
|
+
Classifier: Intended Audience :: Developers
|
|
15
|
+
Classifier: Programming Language :: Python :: 3
|
|
16
|
+
Classifier: Programming Language :: Python :: 3.10
|
|
17
|
+
Classifier: Programming Language :: Python :: 3.11
|
|
18
|
+
Classifier: Programming Language :: Python :: 3.12
|
|
19
|
+
Classifier: Programming Language :: Python :: 3.13
|
|
20
|
+
Classifier: Programming Language :: Python :: 3.14
|
|
21
|
+
Classifier: Topic :: Software Development :: Build Tools
|
|
22
|
+
Requires-Python: >=3.10
|
|
23
|
+
Description-Content-Type: text/markdown
|
|
24
|
+
|
|
25
|
+
SPDX3 Diff Tool
|
|
26
|
+
===============
|
|
27
|
+
|
|
28
|
+
Overview
|
|
29
|
+
--------
|
|
30
|
+
This tool compares two SPDX3 JSON documents and reports differences in:
|
|
31
|
+
- Software packages (name + version)
|
|
32
|
+
- Kernel configuration parameters (CONFIG_*)
|
|
33
|
+
- PACKAGECONFIG entries per package
|
|
34
|
+
|
|
35
|
+
It produces both human-readable output (console) and a structured JSON diff file.
|
|
36
|
+
|
|
37
|
+
Usage
|
|
38
|
+
-----
|
|
39
|
+
```bash
|
|
40
|
+
./spdx-diff reference.json new.json [OPTIONS]
|
|
41
|
+
```
|
|
42
|
+
|
|
43
|
+
Required arguments:
|
|
44
|
+
- `reference`: Path to the baseline SPDX3 JSON file.
|
|
45
|
+
- `new`: Path to the newer SPDX3 JSON file.
|
|
46
|
+
|
|
47
|
+
Optional arguments:
|
|
48
|
+
- `--full`: For console output, always show section names (added, removed,
|
|
49
|
+
changed) even if there is no difference.
|
|
50
|
+
- `--output <file>`: Save diff results to the given JSON file.
|
|
51
|
+
Default: `spdx_diff_<timestamp>.json`
|
|
52
|
+
- `--ignore-proprietary`: Ignore packages with LicenseRef-Proprietary.
|
|
53
|
+
- `--summary`: Show only summary statistics without detailed differences.
|
|
54
|
+
- `--format {text,json,both}`: Control output format:
|
|
55
|
+
- `text`: Console output only (no JSON file)
|
|
56
|
+
- `json`: JSON file only (silent mode for automation)
|
|
57
|
+
- `both`: Both console and JSON output (**default**)
|
|
58
|
+
|
|
59
|
+
Output filtering - change type:
|
|
60
|
+
- `--show-added`: Show only added items.
|
|
61
|
+
- `--show-removed`: Show only removed items.
|
|
62
|
+
- `--show-changed`: Show only changed items.
|
|
63
|
+
|
|
64
|
+
Output filtering - category:
|
|
65
|
+
- `--show-packages`: Show only package differences.
|
|
66
|
+
- `--show-config`: Show only kernel config differences.
|
|
67
|
+
- `--show-packageconfig`: Show only PACKAGECONFIG differences.
|
|
68
|
+
|
|
69
|
+
Output
|
|
70
|
+
------
|
|
71
|
+
The script prints differences grouped into three sections:
|
|
72
|
+
|
|
73
|
+
1. Packages
|
|
74
|
+
- Added packages
|
|
75
|
+
- Removed packages
|
|
76
|
+
- Changed versions
|
|
77
|
+
|
|
78
|
+
2. Kernel Config (CONFIG_*)
|
|
79
|
+
- Added options
|
|
80
|
+
- Removed options
|
|
81
|
+
- Modified options
|
|
82
|
+
|
|
83
|
+
3. PACKAGECONFIG (per package)
|
|
84
|
+
- Packages with added PACKAGECONFIG entries
|
|
85
|
+
- Packages with removed PACKAGECONFIG entries
|
|
86
|
+
- Packages with changed feature configurations
|
|
87
|
+
- Shows package name and associated features
|
|
88
|
+
|
|
89
|
+
Symbols:
|
|
90
|
+
+ added
|
|
91
|
+
- removed
|
|
92
|
+
~ changed
|
|
93
|
+
|
|
94
|
+
Summary Mode
|
|
95
|
+
------------
|
|
96
|
+
When using --summary, the tool displays aggregate statistics:
|
|
97
|
+
|
|
98
|
+
```
|
|
99
|
+
SPDX-Diff Summary:
|
|
100
|
+
|
|
101
|
+
Packages:
|
|
102
|
+
Added: 5
|
|
103
|
+
Removed: 2
|
|
104
|
+
Changed: 3
|
|
105
|
+
|
|
106
|
+
Kernel Config:
|
|
107
|
+
Added: 10
|
|
108
|
+
Removed: 3
|
|
109
|
+
Changed: 7
|
|
110
|
+
|
|
111
|
+
PACKAGECONFIG:
|
|
112
|
+
Features Added: 12
|
|
113
|
+
Features Removed: 4
|
|
114
|
+
Features Changed: 6
|
|
115
|
+
```
|
|
116
|
+
|
|
117
|
+
JSON Diff File
|
|
118
|
+
--------------
|
|
119
|
+
The output file (default: spdx_diff_<timestamp>.json) contains a structured diff:
|
|
120
|
+
|
|
121
|
+
```json
|
|
122
|
+
{
|
|
123
|
+
"package_diff": {
|
|
124
|
+
"added": { "pkgA": "1.2.3" },
|
|
125
|
+
"removed": { "pkgB": "4.5.6" },
|
|
126
|
+
"changed": { "pkgC": { "from": "1.0", "to": "2.0" } }
|
|
127
|
+
},
|
|
128
|
+
"kernel_config_diff": {
|
|
129
|
+
"added": { "CONFIG_XYZ": "y" },
|
|
130
|
+
"removed": { "CONFIG_ABC": "n" },
|
|
131
|
+
"changed": { "CONFIG_DEF": { "from": "m", "to": "y" } }
|
|
132
|
+
},
|
|
133
|
+
"packageconfig_diff": {
|
|
134
|
+
"added": {
|
|
135
|
+
"xz": { "doc": "enabled" }
|
|
136
|
+
},
|
|
137
|
+
"removed": {
|
|
138
|
+
"old-package": { "feature1": "disabled" }
|
|
139
|
+
},
|
|
140
|
+
"changed": {
|
|
141
|
+
"zstd-native": {
|
|
142
|
+
"added": { "zlib": "enabled" },
|
|
143
|
+
"removed": { "lz4": "disabled" },
|
|
144
|
+
"changed": {
|
|
145
|
+
"doc": { "from": "disabled", "to": "enabled" }
|
|
146
|
+
}
|
|
147
|
+
}
|
|
148
|
+
}
|
|
149
|
+
}
|
|
150
|
+
}
|
|
151
|
+
```
|
|
152
|
+
|
|
153
|
+
PACKAGECONFIG Structure
|
|
154
|
+
-----------------------
|
|
155
|
+
PACKAGECONFIG entries are tracked per package, showing which features are
|
|
156
|
+
enabled/disabled for each specific package:
|
|
157
|
+
|
|
158
|
+
Console output example:
|
|
159
|
+
```
|
|
160
|
+
PACKAGECONFIG - Changed Packages:
|
|
161
|
+
~ xz:
|
|
162
|
+
+ doc: enabled
|
|
163
|
+
~ zstd-native:
|
|
164
|
+
~ lz4: disabled -> enabled
|
|
165
|
+
- lzma: disabled
|
|
166
|
+
```
|
|
167
|
+
|
|
168
|
+
This shows:
|
|
169
|
+
- xz package: doc feature was added and enabled
|
|
170
|
+
- zstd-native package: lz4 changed from disabled to enabled, lzma was removed
|
|
171
|
+
|
|
172
|
+
Logging
|
|
173
|
+
-------
|
|
174
|
+
The script uses Python's logging module:
|
|
175
|
+
```
|
|
176
|
+
INFO Normal operations (file opened, counts, etc.)
|
|
177
|
+
WARNING Missing sections (no build_Build objects found)
|
|
178
|
+
ERROR Invalid input or format issues
|
|
179
|
+
```
|
|
180
|
+
|
|
181
|
+
Examples
|
|
182
|
+
--------
|
|
183
|
+
|
|
184
|
+
### Basic comparison with both console and JSON output:
|
|
185
|
+
./spdx-diff reference.json new.json
|
|
186
|
+
|
|
187
|
+
### Full details with proprietary packages excluded:
|
|
188
|
+
./spdx-diff reference.json new.json --ignore-proprietary --full
|
|
189
|
+
|
|
190
|
+
### Quick summary check:
|
|
191
|
+
./spdx-diff reference.json new.json --summary
|
|
192
|
+
|
|
193
|
+
### Silent mode for CI/CD (JSON output only):
|
|
194
|
+
./spdx-diff reference.json new.json --format json --output results.json
|
|
195
|
+
|
|
196
|
+
### Console output only (no JSON file):
|
|
197
|
+
./spdx-diff reference.json new.json --format text --full
|
|
198
|
+
|
|
199
|
+
### Show only changed packages:
|
|
200
|
+
./spdx-diff reference.json new.json --show-packages --show-changed
|
|
201
|
+
|
|
202
|
+
### Show only added packages:
|
|
203
|
+
./spdx-diff reference.json new.json --show-packages --show-added
|
|
204
|
+
|
|
205
|
+
### Show only kernel config changes:
|
|
206
|
+
./spdx-diff reference.json new.json --show-config --show-changed
|
|
207
|
+
|
|
208
|
+
### Show added and changed items across all categories:
|
|
209
|
+
./spdx-diff reference.json new.json --show-added --show-changed
|
|
210
|
+
|
|
211
|
+
### Show only PACKAGECONFIG differences:
|
|
212
|
+
./spdx-diff reference.json new.json --show-packageconfig
|
|
213
|
+
|
|
214
|
+
Console output example:
|
|
215
|
+
```
|
|
216
|
+
Packages - Added:
|
|
217
|
+
+ libfoo: 2.0
|
|
218
|
+
|
|
219
|
+
Packages - Changed:
|
|
220
|
+
~ zlib: 1.2.11 -> 1.2.13
|
|
221
|
+
|
|
222
|
+
Kernel Config - Removed:
|
|
223
|
+
- CONFIG_OLD_FEATURE
|
|
224
|
+
|
|
225
|
+
PACKAGECONFIG - Added Packages:
|
|
226
|
+
+ newpkg:
|
|
227
|
+
gtk: enabled
|
|
228
|
+
doc: disabled
|
|
229
|
+
|
|
230
|
+
PACKAGECONFIG - Changed Packages:
|
|
231
|
+
~ xz:
|
|
232
|
+
+ lzma: enabled
|
|
233
|
+
```
|
|
@@ -0,0 +1,209 @@
|
|
|
1
|
+
SPDX3 Diff Tool
|
|
2
|
+
===============
|
|
3
|
+
|
|
4
|
+
Overview
|
|
5
|
+
--------
|
|
6
|
+
This tool compares two SPDX3 JSON documents and reports differences in:
|
|
7
|
+
- Software packages (name + version)
|
|
8
|
+
- Kernel configuration parameters (CONFIG_*)
|
|
9
|
+
- PACKAGECONFIG entries per package
|
|
10
|
+
|
|
11
|
+
It produces both human-readable output (console) and a structured JSON diff file.
|
|
12
|
+
|
|
13
|
+
Usage
|
|
14
|
+
-----
|
|
15
|
+
```bash
|
|
16
|
+
./spdx-diff reference.json new.json [OPTIONS]
|
|
17
|
+
```
|
|
18
|
+
|
|
19
|
+
Required arguments:
|
|
20
|
+
- `reference`: Path to the baseline SPDX3 JSON file.
|
|
21
|
+
- `new`: Path to the newer SPDX3 JSON file.
|
|
22
|
+
|
|
23
|
+
Optional arguments:
|
|
24
|
+
- `--full`: For console output, always show section names (added, removed,
|
|
25
|
+
changed) even if there is no difference.
|
|
26
|
+
- `--output <file>`: Save diff results to the given JSON file.
|
|
27
|
+
Default: `spdx_diff_<timestamp>.json`
|
|
28
|
+
- `--ignore-proprietary`: Ignore packages with LicenseRef-Proprietary.
|
|
29
|
+
- `--summary`: Show only summary statistics without detailed differences.
|
|
30
|
+
- `--format {text,json,both}`: Control output format:
|
|
31
|
+
- `text`: Console output only (no JSON file)
|
|
32
|
+
- `json`: JSON file only (silent mode for automation)
|
|
33
|
+
- `both`: Both console and JSON output (**default**)
|
|
34
|
+
|
|
35
|
+
Output filtering - change type:
|
|
36
|
+
- `--show-added`: Show only added items.
|
|
37
|
+
- `--show-removed`: Show only removed items.
|
|
38
|
+
- `--show-changed`: Show only changed items.
|
|
39
|
+
|
|
40
|
+
Output filtering - category:
|
|
41
|
+
- `--show-packages`: Show only package differences.
|
|
42
|
+
- `--show-config`: Show only kernel config differences.
|
|
43
|
+
- `--show-packageconfig`: Show only PACKAGECONFIG differences.
|
|
44
|
+
|
|
45
|
+
Output
|
|
46
|
+
------
|
|
47
|
+
The script prints differences grouped into three sections:
|
|
48
|
+
|
|
49
|
+
1. Packages
|
|
50
|
+
- Added packages
|
|
51
|
+
- Removed packages
|
|
52
|
+
- Changed versions
|
|
53
|
+
|
|
54
|
+
2. Kernel Config (CONFIG_*)
|
|
55
|
+
- Added options
|
|
56
|
+
- Removed options
|
|
57
|
+
- Modified options
|
|
58
|
+
|
|
59
|
+
3. PACKAGECONFIG (per package)
|
|
60
|
+
- Packages with added PACKAGECONFIG entries
|
|
61
|
+
- Packages with removed PACKAGECONFIG entries
|
|
62
|
+
- Packages with changed feature configurations
|
|
63
|
+
- Shows package name and associated features
|
|
64
|
+
|
|
65
|
+
Symbols:
|
|
66
|
+
+ added
|
|
67
|
+
- removed
|
|
68
|
+
~ changed
|
|
69
|
+
|
|
70
|
+
Summary Mode
|
|
71
|
+
------------
|
|
72
|
+
When using --summary, the tool displays aggregate statistics:
|
|
73
|
+
|
|
74
|
+
```
|
|
75
|
+
SPDX-Diff Summary:
|
|
76
|
+
|
|
77
|
+
Packages:
|
|
78
|
+
Added: 5
|
|
79
|
+
Removed: 2
|
|
80
|
+
Changed: 3
|
|
81
|
+
|
|
82
|
+
Kernel Config:
|
|
83
|
+
Added: 10
|
|
84
|
+
Removed: 3
|
|
85
|
+
Changed: 7
|
|
86
|
+
|
|
87
|
+
PACKAGECONFIG:
|
|
88
|
+
Features Added: 12
|
|
89
|
+
Features Removed: 4
|
|
90
|
+
Features Changed: 6
|
|
91
|
+
```
|
|
92
|
+
|
|
93
|
+
JSON Diff File
|
|
94
|
+
--------------
|
|
95
|
+
The output file (default: spdx_diff_<timestamp>.json) contains a structured diff:
|
|
96
|
+
|
|
97
|
+
```json
|
|
98
|
+
{
|
|
99
|
+
"package_diff": {
|
|
100
|
+
"added": { "pkgA": "1.2.3" },
|
|
101
|
+
"removed": { "pkgB": "4.5.6" },
|
|
102
|
+
"changed": { "pkgC": { "from": "1.0", "to": "2.0" } }
|
|
103
|
+
},
|
|
104
|
+
"kernel_config_diff": {
|
|
105
|
+
"added": { "CONFIG_XYZ": "y" },
|
|
106
|
+
"removed": { "CONFIG_ABC": "n" },
|
|
107
|
+
"changed": { "CONFIG_DEF": { "from": "m", "to": "y" } }
|
|
108
|
+
},
|
|
109
|
+
"packageconfig_diff": {
|
|
110
|
+
"added": {
|
|
111
|
+
"xz": { "doc": "enabled" }
|
|
112
|
+
},
|
|
113
|
+
"removed": {
|
|
114
|
+
"old-package": { "feature1": "disabled" }
|
|
115
|
+
},
|
|
116
|
+
"changed": {
|
|
117
|
+
"zstd-native": {
|
|
118
|
+
"added": { "zlib": "enabled" },
|
|
119
|
+
"removed": { "lz4": "disabled" },
|
|
120
|
+
"changed": {
|
|
121
|
+
"doc": { "from": "disabled", "to": "enabled" }
|
|
122
|
+
}
|
|
123
|
+
}
|
|
124
|
+
}
|
|
125
|
+
}
|
|
126
|
+
}
|
|
127
|
+
```
|
|
128
|
+
|
|
129
|
+
PACKAGECONFIG Structure
|
|
130
|
+
-----------------------
|
|
131
|
+
PACKAGECONFIG entries are tracked per package, showing which features are
|
|
132
|
+
enabled/disabled for each specific package:
|
|
133
|
+
|
|
134
|
+
Console output example:
|
|
135
|
+
```
|
|
136
|
+
PACKAGECONFIG - Changed Packages:
|
|
137
|
+
~ xz:
|
|
138
|
+
+ doc: enabled
|
|
139
|
+
~ zstd-native:
|
|
140
|
+
~ lz4: disabled -> enabled
|
|
141
|
+
- lzma: disabled
|
|
142
|
+
```
|
|
143
|
+
|
|
144
|
+
This shows:
|
|
145
|
+
- xz package: doc feature was added and enabled
|
|
146
|
+
- zstd-native package: lz4 changed from disabled to enabled, lzma was removed
|
|
147
|
+
|
|
148
|
+
Logging
|
|
149
|
+
-------
|
|
150
|
+
The script uses Python's logging module:
|
|
151
|
+
```
|
|
152
|
+
INFO Normal operations (file opened, counts, etc.)
|
|
153
|
+
WARNING Missing sections (no build_Build objects found)
|
|
154
|
+
ERROR Invalid input or format issues
|
|
155
|
+
```
|
|
156
|
+
|
|
157
|
+
Examples
|
|
158
|
+
--------
|
|
159
|
+
|
|
160
|
+
### Basic comparison with both console and JSON output:
|
|
161
|
+
./spdx-diff reference.json new.json
|
|
162
|
+
|
|
163
|
+
### Full details with proprietary packages excluded:
|
|
164
|
+
./spdx-diff reference.json new.json --ignore-proprietary --full
|
|
165
|
+
|
|
166
|
+
### Quick summary check:
|
|
167
|
+
./spdx-diff reference.json new.json --summary
|
|
168
|
+
|
|
169
|
+
### Silent mode for CI/CD (JSON output only):
|
|
170
|
+
./spdx-diff reference.json new.json --format json --output results.json
|
|
171
|
+
|
|
172
|
+
### Console output only (no JSON file):
|
|
173
|
+
./spdx-diff reference.json new.json --format text --full
|
|
174
|
+
|
|
175
|
+
### Show only changed packages:
|
|
176
|
+
./spdx-diff reference.json new.json --show-packages --show-changed
|
|
177
|
+
|
|
178
|
+
### Show only added packages:
|
|
179
|
+
./spdx-diff reference.json new.json --show-packages --show-added
|
|
180
|
+
|
|
181
|
+
### Show only kernel config changes:
|
|
182
|
+
./spdx-diff reference.json new.json --show-config --show-changed
|
|
183
|
+
|
|
184
|
+
### Show added and changed items across all categories:
|
|
185
|
+
./spdx-diff reference.json new.json --show-added --show-changed
|
|
186
|
+
|
|
187
|
+
### Show only PACKAGECONFIG differences:
|
|
188
|
+
./spdx-diff reference.json new.json --show-packageconfig
|
|
189
|
+
|
|
190
|
+
Console output example:
|
|
191
|
+
```
|
|
192
|
+
Packages - Added:
|
|
193
|
+
+ libfoo: 2.0
|
|
194
|
+
|
|
195
|
+
Packages - Changed:
|
|
196
|
+
~ zlib: 1.2.11 -> 1.2.13
|
|
197
|
+
|
|
198
|
+
Kernel Config - Removed:
|
|
199
|
+
- CONFIG_OLD_FEATURE
|
|
200
|
+
|
|
201
|
+
PACKAGECONFIG - Added Packages:
|
|
202
|
+
+ newpkg:
|
|
203
|
+
gtk: enabled
|
|
204
|
+
doc: disabled
|
|
205
|
+
|
|
206
|
+
PACKAGECONFIG - Changed Packages:
|
|
207
|
+
~ xz:
|
|
208
|
+
+ lzma: enabled
|
|
209
|
+
```
|