diff --git a/tools/openchain_telco_sbom_validator/README.md b/tools/openchain_telco_sbom_validator/README.md index ac489d6..8355441 100644 --- a/tools/openchain_telco_sbom_validator/README.md +++ b/tools/openchain_telco_sbom_validator/README.md @@ -3,6 +3,9 @@ A script to validate SBOMs against the [OpenChain Telco SBOM Guide](https://github.com/OpenChain-Project/Telco-WG/blob/main/OpenChain-Telco-SBOM-Guide_EN.md). +What is new in version 0.3.5: +* better check in `--strict-purl-check` + What is new in version 0.3.4: * require spdx-tools >= 0.8.5 * require ntia-conformance-checker >= 5.0.0 @@ -59,8 +62,8 @@ options: --debug Prints debug logs. --nr-of-errors NR_OF_ERRORS Sets a limit on the number of errors displayed. - --strict-purl-check Runs a strict check on the given purls. The default behaviour is to run a non-strict purl check - meaning that it is not checked if the purl is translating to a downloadable URL. + --strict-purl-check Runs a strict check on the given PURLs. The default behaviour is to run a non-strict PURL check + meaning that it is not checked if the PURL is translating to a downloadable URL. --strict-url-check Runs a strict check on the URLs of the PackageDownloadLocation. Strict check means that the validator checks also if the given URL can be accessed. The default behaviour is to run a non-strict URL check, meaning that it is not checked if the URL points to a valid page. Strict URL check @@ -100,7 +103,7 @@ def main(): # Do validate result, problems = myValidator.validate(filePath, # path to the SPDX file as a string - strict_purl_check, # If strict purl check is needed + strict_purl_check, # If strict PURL check is needed strict_url_check) # if strict URL check is needed # Print results in an uniform way diff --git a/tools/openchain_telco_sbom_validator/requirements.txt b/tools/openchain_telco_sbom_validator/requirements.txt index 5a6053d..ea71e47 100644 --- a/tools/openchain_telco_sbom_validator/requirements.txt +++ b/tools/openchain_telco_sbom_validator/requirements.txt @@ -4,3 +4,4 @@ prettytable>=3.16.0 packageurl-python>=0.17.6 ntia-conformance-checker>=5.0.0 validators>=0.35.0 +fetchcode>=0.8.2 diff --git a/tools/openchain_telco_sbom_validator/setup.cfg b/tools/openchain_telco_sbom_validator/setup.cfg index bf7403a..7b2921e 100644 --- a/tools/openchain_telco_sbom_validator/setup.cfg +++ b/tools/openchain_telco_sbom_validator/setup.cfg @@ -1,6 +1,6 @@ [metadata] name = openchain-telco-sbom-validator -version = 0.3.4 +version = 0.3.5 author = Gergely Csatari, Marc-Etienne Vargenau author_email = gergely.csatari@nokia.com, marc-etienne.vargenau@nokia.com description = Validator against versions 1.0 and 1.1 of the OpenChain Telco SBOM Guide @@ -35,6 +35,7 @@ install_requires = packageurl-python>=0.17.6 ntia-conformance-checker>=5.0.0 validators>=0.35.0 + fetchcode>=0.8.2 [options.entry_points] console_scripts = openchain-telco-sbom-validator=openchain_telco_sbom_validator.cli:main diff --git a/tools/openchain_telco_sbom_validator/src/openchain_telco_sbom_validator/cli.py b/tools/openchain_telco_sbom_validator/src/openchain_telco_sbom_validator/cli.py index 48ca347..151b41a 100644 --- a/tools/openchain_telco_sbom_validator/src/openchain_telco_sbom_validator/cli.py +++ b/tools/openchain_telco_sbom_validator/src/openchain_telco_sbom_validator/cli.py @@ -114,9 +114,9 @@ def parseArguments(additionalArguments: AdditionalArguments = AdditionalArgument parser.add_argument('--nr-of-errors', help='Sets a limit on the number of errors displayed.') parser.add_argument('--strict-purl-check', action="store_true", - help='Runs a strict check on the given purls. The default behaviour is to' - ' run a non-strict purl check meaning that it is not checked if the' - ' purl is translating to a downloadable URL.') + help='Runs a strict check on the given PURLs. The default behaviour is to' + ' run a non-strict PURL check meaning that it is not checked if the' + ' PURL is translating to a downloadable URL.') parser.add_argument('--strict-url-check', action="store_true", help='Runs a strict check on the URLs of the PackageDowloadLocation. Strict check' ' means that the validator checks also if the given URL can be accessed.' @@ -162,7 +162,7 @@ def parseArguments(additionalArguments: AdditionalArguments = AdditionalArgument logger.error(f"nr-of-errors must be a number and not {args.nr_of_errors}") sys.exit(1) if args.strict_purl_check: - logger.info("Running strict checks for purls, what means that it is tested if the purls can be translated to a downloadable url.") + logger.info("Running strict checks for PURLs, what means that it is tested if the PURLs can be translated to a downloadable url.") if args.strict_url_check: logger.info("Running strict checks for URL, what means that it is tested if the PackageDowloadLocation fields are pointing to real pages.") diff --git a/tools/openchain_telco_sbom_validator/src/openchain_telco_sbom_validator/reporter.py b/tools/openchain_telco_sbom_validator/src/openchain_telco_sbom_validator/reporter.py index 8d69793..84ebb0e 100644 --- a/tools/openchain_telco_sbom_validator/src/openchain_telco_sbom_validator/reporter.py +++ b/tools/openchain_telco_sbom_validator/src/openchain_telco_sbom_validator/reporter.py @@ -45,7 +45,7 @@ def reportCli(result, problems, nr_of_errors, input, guide_version, strict, noas if strict_purl_check: if len(incorrect_purls): - print("Fields with purl that cannot be converted to a downloadable URL:") + print("Fields with PURL that cannot be converted to a downloadable URL:") printTable(incorrect_purls, problems.print_file) if strict_url_check: diff --git a/tools/openchain_telco_sbom_validator/src/openchain_telco_sbom_validator/validator.py b/tools/openchain_telco_sbom_validator/src/openchain_telco_sbom_validator/validator.py index 00f8e5c..3718e7f 100644 --- a/tools/openchain_telco_sbom_validator/src/openchain_telco_sbom_validator/validator.py +++ b/tools/openchain_telco_sbom_validator/src/openchain_telco_sbom_validator/validator.py @@ -23,6 +23,7 @@ from spdx_tools.spdx.model.checksum import ChecksumAlgorithm from spdx_tools.spdx import document_utils from packageurl.contrib import purl2url +from fetchcode import fetch import ntia_conformance_checker as ntia import validators import requests @@ -539,7 +540,20 @@ def validate(self, Problem.SEVERITY_INC_PURL, file) else: - logger.debug(f"Strict PURL check is happy {url}") + try: + logger.debug("Checking Package-URL location") + page = fetch(ref.locator) + logger.debug(f"Strict PURL check is happy {url}") + except Exception as err: + logger.debug(f"Exception received ({format(err)})") + problems.append("Invalid field in Package", + package.spdx_id, + package.name, + f"Package-URL field converts to a nonexisting page ({url})", + Problem.SCOPE_OPEN_CHAIN, + Problem.SEVERITY_INC_PURL, + file) + if strict and not purlFound: problems.append("Missing mandatory field from Package", package.spdx_id,