linux-stable.git/scripts/sbom, branch master

scripts/sbom: catch ValueError from malformed shell quoting

2026-07-31T12:19:36+00:00

parse_inputs_from_commands() only caught CmdParsingError and IndexError
when dispatching to command parsers, but several parsers call
shlex.split() internally, which raises ValueError on malformed shell
quoting (e.g. an unterminated quote). This exception was not caught,
so a single malformed build command would abort SBOM generation
entirely, even with fail_on_unknown_build_command=False, defeating the
purpose of tolerant mode.

The issue was found while reviewing the exception handling around the
saved-command parser after running its existing tests. It can be
reproduced with:

    parse_inputs_from_commands('gcc "unterminated',
                               fail_on_unknown_build_command=False)

Catch ValueError alongside CmdParsingError and IndexError so such
commands are logged as a warning/error and skipped instead of aborting
the whole run.

Add tests covering malformed shell quoting and a missing positional
argument.

Signed-off-by: Carlos Sampaio Ribeiro 
Link: https://patch.msgid.link/20260719081859.1001-1-otakurack@gmail.com
Signed-off-by: Greg Kroah-Hartman

scripts/sbom: add unit tests for SPDX-License-Identifier parsing

2026-05-22T11:14:41+00:00

Verify that SPDX-License-Identifier headers at the top of source files
are parsed correctly.

Assisted-by: Cursor:claude-sonnet-4-5
Assisted-by: OpenCode:GLM-4-7
Co-developed-by: Maximilian Huber 
Signed-off-by: Maximilian Huber 
Signed-off-by: Luis Augenstein 
Signed-off-by: Greg Kroah-Hartman

scripts/sbom: add unit tests for command parsers

2026-05-22T11:14:41+00:00

Add unit tests to verify that command parsers correctly extract
input files from build commands.

Assisted-by: Cursor:claude-sonnet-4-5
Assisted-by: OpenCode:GLM-4-7
Co-developed-by: Maximilian Huber 
Signed-off-by: Maximilian Huber 
Signed-off-by: Luis Augenstein 
Signed-off-by: Greg Kroah-Hartman

scripts/sbom: add SPDX build graph

2026-05-22T11:14:41+00:00

Implement the SPDX build graph to describe the relationships
between source files in the source SBOM and output files in
the output SBOM.

Assisted-by: Cursor:claude-sonnet-4-5
Assisted-by: OpenCode:GLM-4-7
Co-developed-by: Maximilian Huber 
Signed-off-by: Maximilian Huber 
Signed-off-by: Luis Augenstein 
Signed-off-by: Greg Kroah-Hartman

scripts/sbom: add SPDX source graph

2026-05-22T11:14:41+00:00

Implement the SPDX source graph which contains all source files
involved during the build, along with the licensing information
for each file.

Assisted-by: Cursor:claude-sonnet-4-5
Assisted-by: OpenCode:GLM-4-7
Co-developed-by: Maximilian Huber 
Signed-off-by: Maximilian Huber 
Signed-off-by: Luis Augenstein 
Signed-off-by: Greg Kroah-Hartman

scripts/sbom: add SPDX output graph

2026-05-22T11:14:41+00:00

Implement the SPDX output graph which contains the distributable
build outputs and high level metadata about the build.

Assisted-by: Cursor:claude-sonnet-4-5
Assisted-by: OpenCode:GLM-4-7
Co-developed-by: Maximilian Huber 
Signed-off-by: Maximilian Huber 
Signed-off-by: Luis Augenstein 
Signed-off-by: Greg Kroah-Hartman

scripts/sbom: collect file metadata

2026-05-22T11:14:41+00:00

Implement the kernel_file module that collects file metadata,
including license identifier for source files, SHA-256 hash,
Git blob object ID, an estimation of the file type, and
whether files belong to the source, build, or output SBOM.

Assisted-by: Cursor:claude-sonnet-4-5
Assisted-by: OpenCode:GLM-4-7
Co-developed-by: Maximilian Huber 
Signed-off-by: Maximilian Huber 
Signed-off-by: Luis Augenstein 
Signed-off-by: Greg Kroah-Hartman

scripts/sbom: add shared SPDX elements

2026-05-22T11:14:41+00:00

Implement shared SPDX elements used in all three documents.

Assisted-by: Cursor:claude-sonnet-4-5
Assisted-by: OpenCode:GLM-4-7
Co-developed-by: Maximilian Huber 
Signed-off-by: Maximilian Huber 
Signed-off-by: Luis Augenstein 
Signed-off-by: Greg Kroah-Hartman

scripts/sbom: add JSON-LD serialization

2026-05-22T11:14:41+00:00

Add infrastructure to serialize an SPDX graph as a JSON-LD
document. NamespaceMaps in the SPDX document are converted
to custom prefixes in the @context field of the JSON-LD output.

The SBOM tool uses NamespaceMaps solely to shorten SPDX IDs,
avoiding repetition of full namespace URIs by using short prefixes.

Assisted-by: Cursor:claude-sonnet-4-5
Assisted-by: OpenCode:GLM-4-7
Co-developed-by: Maximilian Huber 
Signed-off-by: Maximilian Huber 
Signed-off-by: Luis Augenstein 
Signed-off-by: Greg Kroah-Hartman

scripts/sbom: add SPDX classes

2026-05-22T11:14:41+00:00

Implement Python dataclasses to model the SPDX classes
required within an SPDX document. The class and property
names are consistent with the SPDX 3.0.1 specification.

Assisted-by: Cursor:claude-sonnet-4-5
Assisted-by: OpenCode:GLM-4-7
Co-developed-by: Maximilian Huber 
Signed-off-by: Maximilian Huber 
Signed-off-by: Luis Augenstein 
Signed-off-by: Greg Kroah-Hartman