Revert "Added spdx package component information from SPDX file (#766)…

…" (#825) Co-authored-by: Sebastian Gomez <[email protected]>
microsoft · Oct 3, 2023 · b1044c7 · b1044c7
1 parent 56b3100
commit b1044c7
Show file tree

Hide file tree

Showing 7 changed files with 32 additions and 288 deletions.
diff --git a/src/Microsoft.ComponentDetection.Contracts/TypedComponent/SpdxPackageComponent.cs b/src/Microsoft.ComponentDetection.Contracts/TypedComponent/SpdxPackageComponent.cs
diff --git a/src/Microsoft.ComponentDetection.Detectors/spdx/Contracts/CreationInfo.cs b/src/Microsoft.ComponentDetection.Detectors/spdx/Contracts/CreationInfo.cs
diff --git a/src/Microsoft.ComponentDetection.Detectors/spdx/Contracts/SpdxExternalRefs.cs b/src/Microsoft.ComponentDetection.Detectors/spdx/Contracts/SpdxExternalRefs.cs
diff --git a/src/Microsoft.ComponentDetection.Detectors/spdx/Contracts/SpdxFileData.cs b/src/Microsoft.ComponentDetection.Detectors/spdx/Contracts/SpdxFileData.cs
diff --git a/src/Microsoft.ComponentDetection.Detectors/spdx/Contracts/SpdxPackage.cs b/src/Microsoft.ComponentDetection.Detectors/spdx/Contracts/SpdxPackage.cs
diff --git a/src/Microsoft.ComponentDetection.Detectors/spdx/Spdx22ComponentDetector.cs b/src/Microsoft.ComponentDetection.Detectors/spdx/Spdx22ComponentDetector.cs
@@ -1,4 +1,4 @@
-namespace Microsoft.ComponentDetection.Detectors.Spdx;
+namespace Microsoft.ComponentDetection.Detectors.Spdx;
 
 using System;
 using System.Collections.Generic;
@@ -9,9 +9,9 @@ namespace Microsoft.ComponentDetection.Detectors.Spdx;
 using Microsoft.ComponentDetection.Contracts;
 using Microsoft.ComponentDetection.Contracts.Internal;
 using Microsoft.ComponentDetection.Contracts.TypedComponent;
-using Microsoft.ComponentDetection.Detectors.Spdx.Contracts;
 using Microsoft.Extensions.Logging;
 using Newtonsoft.Json;
+using Newtonsoft.Json.Linq;
 
 /// <summary>
 /// Spdx22ComponentDetector discover SPDX SBOM files in JSON format and create components with the information about
@@ -46,7 +46,6 @@ protected override Task OnFileFoundAsync(ProcessRequest processRequest, IDiction
     {
         this.Logger.LogDebug("Discovered SPDX2.2 manifest file at: {ManifestLocation}", processRequest.ComponentStream.Location);
         var file = processRequest.ComponentStream;
-        var singleFileComponentRecorder = processRequest.SingleFileComponentRecorder;
 
         try
         {
@@ -59,46 +58,30 @@ protected override Task OnFileFoundAsync(ProcessRequest processRequest, IDiction
             using var reader = new JsonTextReader(sr);
             var serializer = new JsonSerializer();
 
-            var spdxFileData = serializer.Deserialize<SpdxFileData>(reader);
-
-            if (spdxFileData == null)
-            {
-                this.Logger.LogWarning("Discovered SPDX file at {ManifestLocation} is not a valid document, skipping", processRequest.ComponentStream.Location);
-                return Task.CompletedTask;
-            }
-
-            if (!this.IsSPDXVersionSupported(spdxFileData.Version))
-            {
-                this.Logger.LogWarning("Discovered SPDX at {ManifestLocation} is not SPDX-2.2 document, skipping", processRequest.ComponentStream.Location);
-                return Task.CompletedTask;
-            }
-
-            var sbomComponent = this.ConvertJObjectToSbomComponent(processRequest, spdxFileData, hash);
-            singleFileComponentRecorder.RegisterUsage(new DetectedComponent(sbomComponent));
-
-            if (spdxFileData.HasPackages())
+            try
             {
-                foreach (var package in spdxFileData.Packages)
+                var document = serializer.Deserialize<JObject>(reader);
+                if (document != null)
                 {
-                    SpdxPackageComponent spdxPackageComponent;
-
-                    var extRefLocator = package.ExternalRefs?.FirstOrDefault(x => x.Type == "purl")?.Locator;
-                    if (extRefLocator is not null)
+                    if (this.IsSPDXVersionSupported(document))
                     {
-                        spdxPackageComponent = new SpdxPackageComponent(package.Name, package.Version, package.Supplier, package.CopyrightText, package.DownloadLocation, extRefLocator);
+                        var sbomComponent = this.ConvertJObjectToSbomComponent(processRequest, document, hash);
+                        processRequest.SingleFileComponentRecorder.RegisterUsage(new DetectedComponent(sbomComponent));
                     }
                     else
                     {
-                        spdxPackageComponent = new SpdxPackageComponent(package.Name, package.Version, package.Supplier, package.CopyrightText, package.DownloadLocation);
+                        this.Logger.LogWarning("Discovered SPDX at {ManifestLocation} is not SPDX-2.2 document, skipping", processRequest.ComponentStream.Location);
                     }
-
-                    singleFileComponentRecorder.RegisterUsage(new DetectedComponent(spdxPackageComponent));
+                }
+                else
+                {
+                    this.Logger.LogWarning("Discovered SPDX file at {ManifestLocation} is not a valid document, skipping", processRequest.ComponentStream.Location);
                 }
             }
-        }
-        catch (JsonException je)
-        {
-            this.Logger.LogWarning(je, "Unable to parse file at {ManifestLocation}, skipping", processRequest.ComponentStream.Location);
+            catch (JsonReaderException)
+            {
+                this.Logger.LogWarning("Unable to parse file at {ManifestLocation}, skipping", processRequest.ComponentStream.Location);
+            }
         }
         catch (Exception e)
         {
@@ -108,13 +91,16 @@ protected override Task OnFileFoundAsync(ProcessRequest processRequest, IDiction
         return Task.CompletedTask;
     }
 
-    private bool IsSPDXVersionSupported(string version) => this.supportedSPDXVersions.Contains(version?.ToString(), StringComparer.OrdinalIgnoreCase);
+    private bool IsSPDXVersionSupported(JObject document) => this.supportedSPDXVersions.Contains(document["spdxVersion"]?.ToString(), StringComparer.OrdinalIgnoreCase);
 
-    private SpdxComponent ConvertJObjectToSbomComponent(ProcessRequest processRequest, SpdxFileData spdxFileData, string fileHash)
+    private SpdxComponent ConvertJObjectToSbomComponent(ProcessRequest processRequest, JObject document, string fileHash)
     {
-        var rootElements = spdxFileData.DocumentDescribes;
+        var sbomNamespace = document["documentNamespace"]?.ToString();
+        var rootElements = document["documentDescribes"]?.ToObject<string[]>();
+        var name = document["name"]?.ToString();
+        var spdxVersion = document["spdxVersion"]?.ToString();
 
-        if (rootElements?.Count() > 1)
+        if (rootElements?.Length > 1)
         {
             this.Logger.LogWarning("SPDX file at {ManifestLocation} has more than one element in documentDescribes, first will be selected as root element.", processRequest.ComponentStream.Location);
         }
@@ -126,7 +112,7 @@ private SpdxComponent ConvertJObjectToSbomComponent(ProcessRequest processReques
 
         var rootElementId = rootElements?.FirstOrDefault() ?? "SPDXRef-Document";
         var path = processRequest.ComponentStream.Location;
-        var component = new SpdxComponent(spdxFileData.Version, new Uri(spdxFileData.DocumentNamespace), spdxFileData.Name, fileHash, rootElementId, path);
+        var component = new SpdxComponent(spdxVersion, new Uri(sbomNamespace), name, fileHash, rootElementId, path);
 
         return component;
     }