Skip to content

Commit 656e222

Browse files
committed
Point core developers to SBOM devguide on errors
1 parent 36adc79 commit 656e222

File tree

1 file changed

+42
-9
lines changed

1 file changed

+42
-9
lines changed

Tools/build/generate_sbom.py

+42-9
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,14 @@ def spdx_id(value: str) -> str:
8282
return re.sub(r"[^a-zA-Z0-9.\-]+", "-", value)
8383

8484

85+
def error_if_not(value: bool, error_message: str) -> None | typing.NoReturn:
86+
"""Prints an error if a value isn't true along with a link to the Dev Guide"""
87+
if not value:
88+
print(error_message)
89+
print("See 'https://devguide.python.org/developer-workflow/sbom' for more information.")
90+
sys.exit(1)
91+
92+
8593
def filter_gitignored_paths(paths: list[str]) -> list[str]:
8694
"""
8795
Filter out paths excluded by the gitignore file.
@@ -206,22 +214,45 @@ def main() -> None:
206214
discover_pip_sbom_package(sbom_data)
207215

208216
# Ensure all packages in this tool are represented also in the SBOM file.
209-
assert {package["name"] for package in sbom_data["packages"]} == set(PACKAGE_TO_FILES)
217+
error_if_not(
218+
{package["name"] for package in sbom_data["packages"]} == set(PACKAGE_TO_FILES),
219+
"Packages defined in SBOM tool don't match those defined in SBOM file.",
220+
)
210221

211222
# Make a bunch of assertions about the SBOM data to ensure it's consistent.
212223
for package in sbom_data["packages"]:
213-
214224
# Properties and ID must be properly formed.
215-
assert set(package.keys()) == REQUIRED_PROPERTIES_PACKAGE
216-
assert package["SPDXID"] == spdx_id(f"SPDXRef-PACKAGE-{package['name']}")
225+
error_if_not(
226+
"name" in package,
227+
"Package is missing the 'name' field"
228+
)
229+
error_if_not(
230+
set(package.keys()) == REQUIRED_PROPERTIES_PACKAGE,
231+
f"Package '{package['name']}' is missing required fields",
232+
)
233+
error_if_not(
234+
package["SPDXID"] == spdx_id(f"SPDXRef-PACKAGE-{package['name']}"),
235+
f"Package '{package['name']}' has a malformed SPDXID",
236+
)
217237

218238
# Version must be in the download and external references.
219239
version = package["versionInfo"]
220-
assert version in package["downloadLocation"]
221-
assert all(version in ref["referenceLocator"] for ref in package["externalRefs"])
240+
error_if_not(
241+
version in package["downloadLocation"],
242+
f"Version '{version}' for package '{package['name']} not in 'downloadLocation' field",
243+
)
244+
error_if_not(
245+
all(version in ref["referenceLocator"] for ref in package["externalRefs"]),
246+
(
247+
f"Version '{version}' for package '{package['name']} not in "
248+
f"all 'externalRefs[].referenceLocator' fields"
249+
),
250+
)
222251

223252
# License must be on the approved list for SPDX.
224-
assert package["licenseConcluded"] in ALLOWED_LICENSE_EXPRESSIONS, package["licenseConcluded"]
253+
assert package["licenseConcluded"] in ALLOWED_LICENSE_EXPRESSIONS, package[
254+
"licenseConcluded"
255+
]
225256

226257
# Regenerate file information from current data.
227258
sbom_files = []
@@ -232,11 +263,13 @@ def main() -> None:
232263
package_spdx_id = spdx_id(f"SPDXRef-PACKAGE-{name}")
233264
exclude = files.exclude or ()
234265
for include in sorted(files.include):
235-
236266
# Find all the paths and then filter them through .gitignore.
237267
paths = glob.glob(include, root_dir=CPYTHON_ROOT_DIR, recursive=True)
238268
paths = filter_gitignored_paths(paths)
239-
assert paths, include # Make sure that every value returns something!
269+
error_if_not(
270+
len(paths) > 0,
271+
f"No valid paths found at path '{include}' for package '{name}",
272+
)
240273

241274
for path in paths:
242275
# Skip directories and excluded files

0 commit comments

Comments
 (0)