Repository navigation
sbom: Derive document name and namespace from downstream purl - #1371
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Linked Issues check |  |
Issue [#1370] requires downstream identity alignment, unique namespaces, and unchanged upstream identity. The summary reports that generate_sbom derives the document name and namespace from the down… |
| Out of Scope Changes check | |
The reported changes stay within [#1370]. Production changes implement document identity and namespace generation. Tests verify those changes. Settings docstrings describe the resulting behavior and s… |
| Title check | |
The title clearly and concisely describes the main change: deriving the SBOM document name and namespace from the downstream purl. |
| Description check | |
The description directly explains the purl-based identity changes, UUID uniqueness, percent-encoding, preserved upstream identity, tests, and issue addressed. |
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
rd4398
left a comment
rd4398
left a comment
There was a problem hiding this comment.
This looks good to me! Thanks for the fix
|
This pull request does not currently match the merge queue conditions, so it cannot be queued from here. The box comes back if it matches again. |
The document header previously used the resolved upstream version, so it could disagree with the SPDXRef-wheel package entry it DESCRIBES when purl name/version overrides were set. A random UUID suffix keeps the namespace unique per generated document as SPDX 2.3 requires, and percent-encoding the name and version keeps it a valid URI even when overrides contain URI-hostile characters. Assisted-by: goose (glm-5-3) Signed-off-by: arewm <arewm@users.noreply.github.com>
cb40929 to
06f50f5
Compare
|
Thank you for this fix. We found two related SBOM version problems. They existed before this PR:
|
4 participants
Pull Request Description
What
Derive the SPDX document
nameanddocumentNamespacefrom thedownstream purl instead of the resolved upstream version, and append a
random UUID to the namespace for per-document uniqueness:
purl.name/purl.versionoverrides, and theSPDXRef-wheelentry reuses thesame computed values, so the document header and the package it
DESCRIBEScannot drift apart.<namespace>/<name>-<version>-<uuid>.spdx.json(name and versionpercent-encoded so the namespace stays a valid URI even when
overrides contain URI-hostile characters), satisfying the SPDX 2.3
§6.5.1 requirement that the URI be unique per document version.
SPDXRef-upstreamis unchanged.reference).
Why
Fixes #1370 — when a
purl.versionoverride was set (e.g. a rebuildflow stamping a downstream local-version suffix onto the built
distribution), the document header named the resolved upstream version
while
SPDXRef-wheelcarried the override, so the SBOM disagreed withitself and with the artifact it described. The namespace was also
reused verbatim across rebuilds and regenerations.
Tests: reproduction test for the issue (document identity follows the
purl version override, upstream identity preserved), uniqueness test
(two generations produce distinct namespaces), percent-encoding test
for URI-hostile overrides, and updated exact-namespace and
purl-name-override assertions.
Assisted-by: goose (glm-5-3)