Add integration test for testing generated SBOM with .img files.

"$TOP/build/soong/tests/apex_cc_module_arch_variant_tests.sh"

"$TOP/build/soong/tests/apex_cc_module_arch_variant_tests.sh" "aosp_arm" "armv7-a"

"$TOP/build/soong/tests/apex_cc_module_arch_variant_tests.sh" "aosp_cf_arm64_phone" "armv8-a" "cortex-a53"

"$TOP/build/soong/tests/sbom_test.sh"

#!/bin/bash

# Copyright (C) 2023 The Android Open Source Project

#

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

#

#      http://www.apache.org/licenses/LICENSE-2.0

#

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

set -uo pipefail

# Integration test for verifying generated SBOM for cuttlefish device.

if [ ! -e "build/make/core/Makefile" ]; then

  echo "$0 must be run from the top of the Android source tree."

  exit 1

fi

tmp_dir="$(mktemp -d tmp.XXXXXX)"

function cleanup {

  rm -rf "${tmp_dir}"

}

trap cleanup EXIT

out_dir=$tmp_dir

droid_target=droid

debug=false

if [ $debug = "true" ]; then

  out_dir=out

  droid_target=

fi

# m droid

TARGET_PRODUCT="aosp_cf_x86_64_phone" TARGET_BUILD_VARIANT=userdebug OUT_DIR=$out_dir \

  build/soong/soong_ui.bash --make-mode $droid_target dump.erofs sbom

# Generate installed file list from .img files in PRODUCT_OUT

dump_erofs=$out_dir/host/linux-x86/bin/dump.erofs

product_out=$out_dir/target/product/vsoc_x86_64

declare -A diff_excludes

diff_excludes[odm]="-I /odm/lib/modules"

diff_excludes[vendor]=\

"-I /vendor/lib64/libkeystore2_crypto.so \

 -I /vendor/lib/modules \

 -I /vendor/odm"

diff_excludes[system]=\

"-I /acct/ \

 -I /adb_keys \

 -I /apex/ \

 -I /bin \

 -I /bugreports \

 -I /cache \

 -I /config/ \

 -I /d \

 -I /data/ \

 -I /data_mirror/ \

 -I /debug_ramdisk/ \

 -I /dev/ \

 -I /etc \

 -I /init \

 -I /init.environ.rc \

 -I /linkerconfig/ \

 -I /metadata/ \

 -I /mnt/ \

 -I /odm/app \

 -I /odm/bin \

 -I /odm_dlkm/etc \

 -I /odm/etc \

 -I /odm/firmware \

 -I /odm/framework \

 -I /odm/lib \

 -I /odm/lib64 \

 -I /odm/overlay \

 -I /odm/priv-app \

 -I /odm/usr \

 -I /oem/ \

 -I /postinstall/ \

 -I /proc/ \

 -I /product/ \

 -I /sdcard \

 -I /second_stage_resources/ \

 -I /storage/ \

 -I /sys/ \

 -I /system_dlkm/ \

 -I /system_ext/ \

 -I /system/lib64/android.hardware.confirmationui@1.0.so \

 -I /system/lib64/android.hardware.confirmationui-V1-ndk.so \

 -I /system/lib64/android.hardware.keymaster@4.1.so \

 -I /system/lib64/android.hardware.security.rkp-V3-ndk.so \

 -I /system/lib64/android.hardware.security.sharedsecret-V1-ndk.so \

 -I /system/lib64/android.security.compat-ndk.so \

 -I /system/lib64/libkeymaster4_1support.so \

 -I /system/lib64/libkeymint.so \

 -I /system/lib64/libkeystore2_aaid.so \

 -I /system/lib64/libkeystore2_apc_compat.so \

 -I /system/lib64/libkeystore2_crypto.so \

 -I /system/lib64/libkm_compat_service.so \

 -I /system/lib64/libkm_compat.so \

 -I /system/lib64/vndk-29 \

 -I /system/lib64/vndk-sp-29 \

 -I /system/lib/modules \

 -I /system/lib/vndk-29 \

 -I /system/lib/vndk-sp-29 \

 -I /system/product \

 -I /system/system_ext \

 -I /system/usr/icu \

 -I /system/vendor \

 -I /vendor/ \

 -I /vendor_dlkm/etc"

# Example output of dump.erofs is as below, and the data used in the test start

# at line 11. Column 1 is inode id, column 2 is inode type and column 3 is name.

# Each line is captured in variable "entry", sed is used to trim the leading

# spaces and cut is used to get field 1 every time. Once a field is extracted,

# "cut --complement" is used to remove the extracted field so next field can be

# processed in the same way and to be processed field is always field 1.

# Output of dump.erofs:

#     File : /

#     Size: 160  On-disk size: 160  directory

#     NID: 39   Links: 10   Layout: 2   Compression ratio: 100.00%

#     Inode size: 64   Extent size: 0   Xattr size: 16

#     Uid: 0   Gid: 0  Access: 0755/rwxr-xr-x

#     Timestamp: 2023-02-14 01:15:54.000000000

#

#            NID TYPE  FILENAME

#             39    2  .

#             39    2  ..

#             47    2  app

#        1286748    2  bin

#        1286754    2  etc

#        5304814    2  lib

#        5309056    2  lib64

#        5309130    2  media

#        5388910    2  overlay

#        5479537    2  priv-app

EROFS_IMAGES="\

  $product_out/product.img \

  $product_out/system.img \

  $product_out/system_ext.img \

  $product_out/system_dlkm.img \

  $product_out/system_other.img \

  $product_out/odm.img \

  $product_out/odm_dlkm.img \

  $product_out/vendor.img \

  $product_out/vendor_dlkm.img"

for f in $EROFS_IMAGES; do

  partition_name=$(basename $f | cut -d. -f1)

  file_list_file="${product_out}/sbom-${partition_name}-files.txt"

  files_in_spdx_file="${product_out}/sbom-${partition_name}-files-in-spdx.txt"

  rm "$file_list_file" > /dev/null 2>&1

  all_dirs="/"

  while [ ! -z "$all_dirs" ]; do

    dir=$(echo "$all_dirs" | cut -d ' ' -f1)

    all_dirs=$(echo "$all_dirs" | cut -d ' ' -f1 --complement -s)

    entries=$($dump_erofs --ls --path "$dir" $f | tail -n +11)

    while read -r entry; do

      nid=$(echo $entry | sed 's/^\s*//' | cut -d ' ' -f1)

      entry=$(echo $entry | sed 's/^\s*//' | cut -d ' ' -f1 --complement)

      type=$(echo $entry | sed 's/^\s*//' | cut -d ' ' -f1)

      entry=$(echo $entry | sed 's/^\s*//' | cut -d ' ' -f1 --complement)

      name=$(echo $entry | sed 's/^\s*//' | cut -d ' ' -f1)

      case $type in

        "2")  # directory

          all_dirs=$(echo "$all_dirs $dir/$name" | sed 's/^\s*//')

          ;;

        *)

          (

          if [ "$partition_name" != "system" ]; then

            # system partition is mounted to /, not to prepend partition name.

            printf %s "/$partition_name"

          fi

          echo "$dir/$name" | sed 's#^//#/#'

          ) >> "$file_list_file"

          ;;

      esac

    done <<< "$entries"

  done

  sort -n -o "$file_list_file" "$file_list_file"

  # Diff

  echo ============ Diffing files in $f and SBOM

  grep "FileName: /${partition_name}/" $product_out/sbom.spdx | sed 's/^FileName: //' | sort -n > "$files_in_spdx_file"

  exclude=

  if [ -v 'diff_excludes[$partition_name]' ]; then

    exclude=${diff_excludes[$partition_name]}

  fi

  diff "$file_list_file" "$files_in_spdx_file" $exclude

  if [ $? != "0" ]; then

    echo Found diffs in $f and SBOM.

    exit 1

  else

    echo No diffs.

  fi

done

 No newline at end of file