|
@@ -0,0 +1,202 @@
|
|
|
+#!/bin/bash
|
|
|
+
|
|
|
+# Copyright (C) 2023 The Android Open Source Project
|
|
|
+#
|
|
|
+# Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
+# you may not use this file except in compliance with the License.
|
|
|
+# You may obtain a copy of the License at
|
|
|
+#
|
|
|
+# http://www.apache.org/licenses/LICENSE-2.0
|
|
|
+#
|
|
|
+# Unless required by applicable law or agreed to in writing, software
|
|
|
+# distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
+# See the License for the specific language governing permissions and
|
|
|
+# limitations under the License.
|
|
|
+
|
|
|
+set -uo pipefail
|
|
|
+
|
|
|
+# Integration test for verifying generated SBOM for cuttlefish device.
|
|
|
+
|
|
|
+if [ ! -e "build/make/core/Makefile" ]; then
|
|
|
+ echo "$0 must be run from the top of the Android source tree."
|
|
|
+ exit 1
|
|
|
+fi
|
|
|
+
|
|
|
+tmp_dir="$(mktemp -d tmp.XXXXXX)"
|
|
|
+function cleanup {
|
|
|
+ rm -rf "${tmp_dir}"
|
|
|
+}
|
|
|
+trap cleanup EXIT
|
|
|
+
|
|
|
+out_dir=$tmp_dir
|
|
|
+droid_target=droid
|
|
|
+
|
|
|
+debug=false
|
|
|
+if [ $debug = "true" ]; then
|
|
|
+ out_dir=out
|
|
|
+ droid_target=
|
|
|
+fi
|
|
|
+# m droid
|
|
|
+TARGET_PRODUCT="aosp_cf_x86_64_phone" TARGET_BUILD_VARIANT=userdebug OUT_DIR=$out_dir \
|
|
|
+ build/soong/soong_ui.bash --make-mode $droid_target dump.erofs sbom
|
|
|
+
|
|
|
+# Generate installed file list from .img files in PRODUCT_OUT
|
|
|
+dump_erofs=$out_dir/host/linux-x86/bin/dump.erofs
|
|
|
+product_out=$out_dir/target/product/vsoc_x86_64
|
|
|
+
|
|
|
+declare -A diff_excludes
|
|
|
+diff_excludes[odm]="-I /odm/lib/modules"
|
|
|
+diff_excludes[vendor]=\
|
|
|
+"-I /vendor/lib64/libkeystore2_crypto.so \
|
|
|
+ -I /vendor/lib/modules \
|
|
|
+ -I /vendor/odm"
|
|
|
+diff_excludes[system]=\
|
|
|
+"-I /acct/ \
|
|
|
+ -I /adb_keys \
|
|
|
+ -I /apex/ \
|
|
|
+ -I /bin \
|
|
|
+ -I /bugreports \
|
|
|
+ -I /cache \
|
|
|
+ -I /config/ \
|
|
|
+ -I /d \
|
|
|
+ -I /data/ \
|
|
|
+ -I /data_mirror/ \
|
|
|
+ -I /debug_ramdisk/ \
|
|
|
+ -I /dev/ \
|
|
|
+ -I /etc \
|
|
|
+ -I /init \
|
|
|
+ -I /init.environ.rc \
|
|
|
+ -I /linkerconfig/ \
|
|
|
+ -I /metadata/ \
|
|
|
+ -I /mnt/ \
|
|
|
+ -I /odm/app \
|
|
|
+ -I /odm/bin \
|
|
|
+ -I /odm_dlkm/etc \
|
|
|
+ -I /odm/etc \
|
|
|
+ -I /odm/firmware \
|
|
|
+ -I /odm/framework \
|
|
|
+ -I /odm/lib \
|
|
|
+ -I /odm/lib64 \
|
|
|
+ -I /odm/overlay \
|
|
|
+ -I /odm/priv-app \
|
|
|
+ -I /odm/usr \
|
|
|
+ -I /oem/ \
|
|
|
+ -I /postinstall/ \
|
|
|
+ -I /proc/ \
|
|
|
+ -I /product/ \
|
|
|
+ -I /sdcard \
|
|
|
+ -I /second_stage_resources/ \
|
|
|
+ -I /storage/ \
|
|
|
+ -I /sys/ \
|
|
|
+ -I /system_dlkm/ \
|
|
|
+ -I /system_ext/ \
|
|
|
+ -I /system/lib64/android.hardware.confirmationui@1.0.so \
|
|
|
+ -I /system/lib64/android.hardware.confirmationui-V1-ndk.so \
|
|
|
+ -I /system/lib64/android.hardware.keymaster@4.1.so \
|
|
|
+ -I /system/lib64/android.hardware.security.rkp-V3-ndk.so \
|
|
|
+ -I /system/lib64/android.hardware.security.sharedsecret-V1-ndk.so \
|
|
|
+ -I /system/lib64/android.security.compat-ndk.so \
|
|
|
+ -I /system/lib64/libkeymaster4_1support.so \
|
|
|
+ -I /system/lib64/libkeymint.so \
|
|
|
+ -I /system/lib64/libkeystore2_aaid.so \
|
|
|
+ -I /system/lib64/libkeystore2_apc_compat.so \
|
|
|
+ -I /system/lib64/libkeystore2_crypto.so \
|
|
|
+ -I /system/lib64/libkm_compat_service.so \
|
|
|
+ -I /system/lib64/libkm_compat.so \
|
|
|
+ -I /system/lib64/vndk-29 \
|
|
|
+ -I /system/lib64/vndk-sp-29 \
|
|
|
+ -I /system/lib/modules \
|
|
|
+ -I /system/lib/vndk-29 \
|
|
|
+ -I /system/lib/vndk-sp-29 \
|
|
|
+ -I /system/product \
|
|
|
+ -I /system/system_ext \
|
|
|
+ -I /system/usr/icu \
|
|
|
+ -I /system/vendor \
|
|
|
+ -I /vendor/ \
|
|
|
+ -I /vendor_dlkm/etc"
|
|
|
+
|
|
|
+# Example output of dump.erofs is as below, and the data used in the test start
|
|
|
+# at line 11. Column 1 is inode id, column 2 is inode type and column 3 is name.
|
|
|
+# Each line is captured in variable "entry", sed is used to trim the leading
|
|
|
+# spaces and cut is used to get field 1 every time. Once a field is extracted,
|
|
|
+# "cut --complement" is used to remove the extracted field so next field can be
|
|
|
+# processed in the same way and to be processed field is always field 1.
|
|
|
+# Output of dump.erofs:
|
|
|
+# File : /
|
|
|
+# Size: 160 On-disk size: 160 directory
|
|
|
+# NID: 39 Links: 10 Layout: 2 Compression ratio: 100.00%
|
|
|
+# Inode size: 64 Extent size: 0 Xattr size: 16
|
|
|
+# Uid: 0 Gid: 0 Access: 0755/rwxr-xr-x
|
|
|
+# Timestamp: 2023-02-14 01:15:54.000000000
|
|
|
+#
|
|
|
+# NID TYPE FILENAME
|
|
|
+# 39 2 .
|
|
|
+# 39 2 ..
|
|
|
+# 47 2 app
|
|
|
+# 1286748 2 bin
|
|
|
+# 1286754 2 etc
|
|
|
+# 5304814 2 lib
|
|
|
+# 5309056 2 lib64
|
|
|
+# 5309130 2 media
|
|
|
+# 5388910 2 overlay
|
|
|
+# 5479537 2 priv-app
|
|
|
+EROFS_IMAGES="\
|
|
|
+ $product_out/product.img \
|
|
|
+ $product_out/system.img \
|
|
|
+ $product_out/system_ext.img \
|
|
|
+ $product_out/system_dlkm.img \
|
|
|
+ $product_out/system_other.img \
|
|
|
+ $product_out/odm.img \
|
|
|
+ $product_out/odm_dlkm.img \
|
|
|
+ $product_out/vendor.img \
|
|
|
+ $product_out/vendor_dlkm.img"
|
|
|
+for f in $EROFS_IMAGES; do
|
|
|
+ partition_name=$(basename $f | cut -d. -f1)
|
|
|
+ file_list_file="${product_out}/sbom-${partition_name}-files.txt"
|
|
|
+ files_in_spdx_file="${product_out}/sbom-${partition_name}-files-in-spdx.txt"
|
|
|
+ rm "$file_list_file" > /dev/null 2>&1
|
|
|
+ all_dirs="/"
|
|
|
+ while [ ! -z "$all_dirs" ]; do
|
|
|
+ dir=$(echo "$all_dirs" | cut -d ' ' -f1)
|
|
|
+ all_dirs=$(echo "$all_dirs" | cut -d ' ' -f1 --complement -s)
|
|
|
+ entries=$($dump_erofs --ls --path "$dir" $f | tail -n +11)
|
|
|
+ while read -r entry; do
|
|
|
+ nid=$(echo $entry | sed 's/^\s*//' | cut -d ' ' -f1)
|
|
|
+ entry=$(echo $entry | sed 's/^\s*//' | cut -d ' ' -f1 --complement)
|
|
|
+ type=$(echo $entry | sed 's/^\s*//' | cut -d ' ' -f1)
|
|
|
+ entry=$(echo $entry | sed 's/^\s*//' | cut -d ' ' -f1 --complement)
|
|
|
+ name=$(echo $entry | sed 's/^\s*//' | cut -d ' ' -f1)
|
|
|
+ case $type in
|
|
|
+ "2") # directory
|
|
|
+ all_dirs=$(echo "$all_dirs $dir/$name" | sed 's/^\s*//')
|
|
|
+ ;;
|
|
|
+ *)
|
|
|
+ (
|
|
|
+ if [ "$partition_name" != "system" ]; then
|
|
|
+ # system partition is mounted to /, not to prepend partition name.
|
|
|
+ printf %s "/$partition_name"
|
|
|
+ fi
|
|
|
+ echo "$dir/$name" | sed 's#^//#/#'
|
|
|
+ ) >> "$file_list_file"
|
|
|
+ ;;
|
|
|
+ esac
|
|
|
+ done <<< "$entries"
|
|
|
+ done
|
|
|
+ sort -n -o "$file_list_file" "$file_list_file"
|
|
|
+
|
|
|
+ # Diff
|
|
|
+ echo ============ Diffing files in $f and SBOM
|
|
|
+ grep "FileName: /${partition_name}/" $product_out/sbom.spdx | sed 's/^FileName: //' | sort -n > "$files_in_spdx_file"
|
|
|
+ exclude=
|
|
|
+ if [ -v 'diff_excludes[$partition_name]' ]; then
|
|
|
+ exclude=${diff_excludes[$partition_name]}
|
|
|
+ fi
|
|
|
+ diff "$file_list_file" "$files_in_spdx_file" $exclude
|
|
|
+ if [ $? != "0" ]; then
|
|
|
+ echo Found diffs in $f and SBOM.
|
|
|
+ exit 1
|
|
|
+ else
|
|
|
+ echo No diffs.
|
|
|
+ fi
|
|
|
+done
|