Fix sbom verification test

Author: dwoz

relenv/build/common/__init__.py

@@ -9,25 +9,6 @@
 
 from __future__ import annotations
 
-<<<<<<< HEAD
-=======
-from .builders import (
-    build_openssl,
-    build_openssl_fips,
-    build_sqlite,
-)
-
-from .install import (
-    update_ensurepip,
-    install_runtime,
-    finalize,
-    create_archive,
-    patch_file,
-    update_sbom_checksums,
-    generate_relenv_sbom,
-)
-
->>>>>>> 63cae3d (Initial sbom support)
 from .builder import (
     Dirs,
     builds,
@@ -39,7 +20,6 @@
     build_sqlite,
 )
 from .install import (
-    copy_sbom_files,
     create_archive,
     finalize,
     generate_relenv_sbom,
@@ -56,7 +36,6 @@
     # Dependency version management
     "get_dependency_version",
     # Install functions
-    "copy_sbom_files",
     "finalize",
     "install_runtime",
     "create_archive",

relenv/build/common/install.py

@@ -19,7 +19,7 @@
 import sys
 import tarfile
 import time
-from typing import IO, TYPE_CHECKING, Any, Dict, List, Optional, Union
+from typing import IO, TYPE_CHECKING, Any
 
 import relenv.relocate
 from relenv.common import (
@@ -425,9 +425,10 @@ def generate_relenv_sbom(env: MutableMapping[str, str], dirs: Dirs) -> None:
     :param dirs: The working directories
     :type dirs: ``relenv.build.common.Dirs``
     """
-    from .builder import get_dependency_version
     import relenv
 
+    from .builder import get_dependency_version
+
     python_version = dirs.version
 
     platform_map = {
@@ -438,10 +439,10 @@ def generate_relenv_sbom(env: MutableMapping[str, str], dirs: Dirs) -> None:
     platform = platform_map.get(sys.platform, sys.platform)
 
     # Build dependency list - get versions from python-versions.json
-    packages: List[Dict[str, Any]] = []
+    packages: list[dict[str, Any]] = []
 
     # Add Python itself as the primary package
-    python_package: Dict[str, Any] = {
+    python_package: dict[str, Any] = {
         "SPDXID": "SPDXRef-PACKAGE-Python",
         "name": "Python",
         "versionInfo": python_version,
@@ -503,8 +504,7 @@ def generate_relenv_sbom(env: MutableMapping[str, str], dirs: Dirs) -> None:
             [
                 (
                     "tirpc",
-                    "https://downloads.sourceforge.net/project/libtirpc/"
-                    "libtirpc/{version}/libtirpc-{version}.tar.bz2",
+                    "https://downloads.sourceforge.net/project/libtirpc/libtirpc/{version}/libtirpc-{version}.tar.bz2",
                 ),
                 (
                     "krb5",
@@ -526,7 +526,7 @@ def generate_relenv_sbom(env: MutableMapping[str, str], dirs: Dirs) -> None:
             )
             checksum = dep_info.get("sha256", "")
 
-            package: Dict[str, Any] = {
+            package: dict[str, Any] = {
                 "SPDXID": f"SPDXRef-PACKAGE-{dep_name}",
                 "name": dep_name,
                 "versionInfo": version,
@@ -557,7 +557,7 @@ def generate_relenv_sbom(env: MutableMapping[str, str], dirs: Dirs) -> None:
             parts = dist_name.rsplit("-", 1)
             if len(parts) == 2:
                 pkg_name, pkg_version = parts
-                package2: Dict[str, Any] = {
+                package2: dict[str, Any] = {
                     "SPDXID": f"SPDXRef-PACKAGE-python-{pkg_name}",
                     "name": pkg_name,
                     "versionInfo": pkg_version,
@@ -575,11 +575,12 @@ def generate_relenv_sbom(env: MutableMapping[str, str], dirs: Dirs) -> None:
     bundled_deps = []
 
     # Try to read Python's SBOM to get accurate versions of bundled components
-    python_sbom_path = pathlib.Path(str(dirs.source)) / "Misc" / "sbom.spdx.json"
-    python_bundled_versions: Dict[str, Dict[str, Any]] = {}
+    python_source_dir = dirs.sources / f"Python-{dirs.version}"
+    python_sbom_path = python_source_dir / "Misc" / "sbom.spdx.json"
+    python_bundled_versions: dict[str, dict[str, Any]] = {}
     if python_sbom_path.exists():
         try:
-            with io.open(python_sbom_path, "r") as fp:
+            with open(python_sbom_path) as fp:
                 python_sbom = json.load(fp)
                 for pkg in python_sbom.get("packages", []):
                     pkg_name = pkg.get("name")
@@ -602,7 +603,7 @@ def generate_relenv_sbom(env: MutableMapping[str, str], dirs: Dirs) -> None:
         for comp_name, comp_desc in bundled_components.items():
             if comp_name in python_bundled_versions:
                 src_pkg = python_bundled_versions[comp_name]
-                bundled_pkg: Dict[str, Any] = {
+                bundled_pkg: dict[str, Any] = {
                     "SPDXID": f"SPDXRef-PACKAGE-{comp_name}",
                     "name": comp_name,
                     "versionInfo": src_pkg.get("versionInfo", "NOASSERTION"),
@@ -627,6 +628,16 @@ def generate_relenv_sbom(env: MutableMapping[str, str], dirs: Dirs) -> None:
     timestamp = time.strftime("%Y%m%d%H%M%S", time.gmtime())
     doc_name = f"relenv-{env.get('RELENV_PY_VERSION', 'unknown')}-{env.get('RELENV_HOST', 'unknown')}"
 
+    # Create relationships - SPDX requires DESCRIBES relationship
+    # The document DESCRIBES the Python package (the primary component)
+    relationships = [
+        {
+            "spdxElementId": "SPDXRef-DOCUMENT",
+            "relatedSpdxElement": "SPDXRef-PACKAGE-Python",
+            "relationshipType": "DESCRIBES",
+        }
+    ]
+
     sbom = {
         "SPDXID": "SPDXRef-DOCUMENT",
         "spdxVersion": "SPDX-2.3",
@@ -643,11 +654,12 @@ def generate_relenv_sbom(env: MutableMapping[str, str], dirs: Dirs) -> None:
             "vulnerability scanning and compliance.",
         },
         "packages": packages,
+        "relationships": relationships,
     }
 
     # Write the SBOM file
     sbom_path = pathlib.Path(dirs.prefix) / "relenv-sbom.spdx.json"
-    with io.open(sbom_path, "w") as fp:
+    with open(sbom_path, "w") as fp:
         json.dump(sbom, fp, indent=2)
     log.info(
         "Generated relenv-sbom.spdx.json with %d packages (Python %s + dependencies + pip packages)",

relenv/build/windows.py

@@ -18,7 +18,7 @@
 import tarfile
 import time
 from collections.abc import MutableMapping
-from typing import IO, Union
+from typing import IO
 
 from ..common import (
     MODULE_DIR,
@@ -36,7 +36,6 @@
     install_runtime,
     patch_file,
     update_ensurepip,
-    update_sbom_checksums,
 )
 
 log = logging.getLogger(__name__)
@@ -1012,6 +1011,10 @@ def runpip(pkg: str | os.PathLike[str]) -> None:
     else:
         runpip("relenv")
 
+    from relenv.build.common.install import generate_relenv_sbom
+
+    generate_relenv_sbom(env, dirs)
+
     for root, _, files in os.walk(dirs.prefix):
         for file in files:
             if file.endswith(".pyc"):
@@ -1024,6 +1027,7 @@ def runpip(pkg: str | os.PathLike[str]) -> None:
         "*.dll",
         "*.lib",
         "*.whl",
+        "*.spdx.json",
         "/Include/*",
         "/Lib/site-packages/*",
     ]

relenv/sbom.py

@@ -1,19 +1,22 @@
-# Copyright 2022-2025 Broadcom.
+# Copyright 2022-2026 Broadcom.
 # SPDX-License-Identifier: Apache-2.0
 """
 SBOM (Software Bill of Materials) management for relenv.
 """
+
 from __future__ import annotations
 
-import argparse
 import json
 import pathlib
 import sys
 import time
-from typing import Any, Dict, List, Optional, Tuple
+from typing import TYPE_CHECKING, Any
+
+if TYPE_CHECKING:
+    import argparse
 
 
-def get_python_version(relenv_root: pathlib.Path) -> Optional[Tuple[int, int, int]]:
+def get_python_version(relenv_root: pathlib.Path) -> tuple[int, int, int] | None:
     """
     Get the Python version of a relenv environment.
 
@@ -73,20 +76,17 @@ def find_relenv_root(start_path: pathlib.Path) -> pathlib.Path:
         return path.parent
 
     # Not a relenv environment
-    raise FileNotFoundError(
-        f"Not a relenv environment: {start_path}\n"
-        f"Expected to find bin/python3 or bin/python3.exe"
-    )
+    raise FileNotFoundError(f"Not a relenv environment: {start_path}\nExpected to find bin/python3 or bin/python3.exe")
 
 
-def scan_installed_packages(relenv_root: pathlib.Path) -> List[Dict[str, Any]]:
+def scan_installed_packages(relenv_root: pathlib.Path) -> list[dict[str, Any]]:
     """
     Scan for installed Python packages in a relenv environment.
 
     :param relenv_root: Path to relenv environment root
     :return: List of package dicts with SPDX metadata
     """
-    packages: List[Dict[str, Any]] = []
+    packages: list[dict[str, Any]] = []
 
     # Find the Python site-packages directory
     lib_dir = relenv_root / "lib"
@@ -102,7 +102,7 @@ def scan_installed_packages(relenv_root: pathlib.Path) -> List[Dict[str, Any]]:
             parts = dist_name.rsplit("-", 1)
             if len(parts) == 2:
                 pkg_name, pkg_version = parts
-                package: Dict[str, Any] = {
+                package: dict[str, Any] = {
                     "SPDXID": f"SPDXRef-PACKAGE-python-{pkg_name}",
                     "name": pkg_name,
                     "versionInfo": pkg_version,
@@ -138,15 +138,14 @@ def update_sbom(relenv_root: pathlib.Path) -> None:
     major, minor, micro = py_version
     if major < 3 or (major == 3 and minor < 12):
         raise RuntimeError(
-            f"SBOM generation is only supported for Python 3.12+. "
-            f"This environment is Python {major}.{minor}.{micro}"
+            f"SBOM generation is only supported for Python 3.12+. This environment is Python {major}.{minor}.{micro}"
         )
 
     sbom_path = relenv_root / "relenv-sbom.spdx.json"
 
     # Load existing SBOM if it exists
     if sbom_path.exists():
-        with open(sbom_path, "r") as f:
+        with open(sbom_path) as f:
             sbom = json.load(f)
     else:
         # Create new SBOM if it doesn't exist
@@ -164,9 +163,7 @@ def update_sbom(relenv_root: pathlib.Path) -> None:
 
     # Separate build dependencies from Python packages
     build_deps = [
-        pkg
-        for pkg in sbom.get("packages", [])
-        if not pkg.get("SPDXID", "").startswith("SPDXRef-PACKAGE-python-")
+        pkg for pkg in sbom.get("packages", []) if not pkg.get("SPDXID", "").startswith("SPDXRef-PACKAGE-python-")
     ]
 
     # Scan for currently installed packages