update_cbom.py

# SPDX-License-Identifier: MIT

# This script generates a Cryptography Bill of Material (CBOM)
# according to https://github.com/IBM/CBOM/blob/main/bom-1.4-cbom-1.0.schema.json

# apt-get install npm python3-git

import argparse
import glob
import yaml
import os
import json
import git
import uuid
from datetime import datetime
import copy

cbom_json_file = "cbom.json"


def load_yaml(filename, encoding='utf-8'):
    with open(filename, mode='r', encoding=encoding) as fh:
        return yaml.safe_load(fh.read())

def file_get_contents(filename, encoding=None):
    with open(filename, mode='r', encoding=encoding) as fh:
        return fh.read()

def out_write(out, str):
    out.write(str)

kem_yamls = []
sig_yamls = []

cbom_components = []
bom_algs_bomrefs = []
bom_algs_use_dependencies = {}

## Common crypto components: aes, sha3
common_crypto_component_aes = {
      "type": "crypto-asset",
      "bom-ref": "alg:aes",
      "name": "aes",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "variant": "aes",
          "primitive": "blockcipher",
          "implementationLevel": "softwarePlainRam"
        }
      }
    }
common_crypto_component_sha3 = {
      "type": "crypto-asset",
      "bom-ref": "alg:sha3",
      "name": "sha3",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "variant": "sha3",
          "primitive": "hash",
          "implementationLevel": "softwarePlainRam"
        }
      }
    }

def add_cbom_component(out, kem_yaml, parameter_set):
    primitive = kem_yaml['type']

    component = {}
    component['type'] = "crypto-asset"
    component['bom-ref'] = "alg:" + parameter_set['name']

    component['name'] = kem_yaml['name']

    algorithmProperties = {}
    algorithmProperties['variant'] = parameter_set['name']
    algorithmProperties['primitive'] = primitive
    algorithmProperties['implementationLevel'] = "softwarePlainRam"
    if primitive == 'kem':
        algorithmProperties['cryptoFunctions'] = ["keygen", "encapsulate", "decapsulate"]
    elif primitive == 'signature':
        algorithmProperties['cryptoFunctions'] = ["keygen", "sign", "verify"]

    cryptoProperties = {}
    cryptoProperties['assetType'] = "algorithm"
    cryptoProperties['algorithmProperties'] = algorithmProperties
    cryptoProperties['nistQuantumSecurityLevel'] = parameter_set['claimed-nist-level']

    component['cryptoProperties'] = cryptoProperties

    for impl in parameter_set['implementations']:
        dic = {
            "all": "generic",
            "x86_64": "x86_64",
            "ARM64_V8": "armv8-a"
        }
        dep = []
        if 'common-crypto' in impl:
            for a in impl['common-crypto']:
                if "SHA3" in a:
                    dep.append(common_crypto_component_sha3['bom-ref'])
                elif "AES" in a:
                    dep.append(common_crypto_component_aes['bom-ref'])

        if impl['supported-platforms'] == "all":
            algorithmProperties['implementationPlatform'] = dic[impl['supported-platforms']]
            component_cpy = copy.deepcopy(component)
            component_cpy['bom-ref'] += ":" + algorithmProperties['implementationPlatform'] 
            cbom_components.append(component_cpy)
            bom_algs_bomrefs.append(component_cpy['bom-ref'])
            if (dep):
                bom_algs_use_dependencies.update({
                    component_cpy['bom-ref'] : dep
                })
        else:
            for plat in impl['supported-platforms']:
                if plat['architecture'] in dic.keys():
                    algorithmProperties['implementationPlatform'] = dic[plat['architecture']]
                    component_cpy = copy.deepcopy(component)
                    if 'upstream' in impl and impl['upstream'] == 'libjade':
                        tag = ":jasmin:"
                        if any('required_flags' in i for i in impl['supported-platforms']):
                            tag += impl['upstream-id'] + ':'
                        component_cpy['bom-ref'] += tag + algorithmProperties['implementationPlatform'] 
                    else:
                        component_cpy['bom-ref'] += ":" + algorithmProperties['implementationPlatform'] 
                    cbom_components.append(component_cpy)
                    bom_algs_bomrefs.append(component_cpy['bom-ref'])
                    if dep:
                        bom_algs_use_dependencies.update({
                            component_cpy['bom-ref'] : dep
                        })

def build_cbom(liboqs_root, liboqs_version):
    ## Add KEM components
    for kem_yaml_path in sorted(glob.glob(os.path.join(liboqs_root, 'docs', 'algorithms', 'kem', '*.yml'))):
        kem_yaml = load_yaml(kem_yaml_path)
        kem_yamls.append(kem_yaml)
        kem_name = os.path.splitext(os.path.basename(kem_yaml_path))[0]
        name = kem_yaml['name']
        for parameter_set in kem_yaml['parameter-sets']:
            add_cbom_component(None, kem_yaml, parameter_set)

    ## Add Sig components
    for sig_yaml_path in sorted(glob.glob(os.path.join(liboqs_root, 'docs', 'algorithms', 'sig', '*.yml'))):
        sig_yaml = load_yaml(sig_yaml_path)
        sig_yamls.append(sig_yaml)
        sig_name = os.path.splitext(os.path.basename(sig_yaml_path))[0]
        for parameter_set in sig_yaml['parameter-sets']:
            add_cbom_component(None, sig_yaml, parameter_set)

    ## liboqs component
    liboqs_component = {}
    version = liboqs_version
    if version == "git":
        repo = git.Repo(search_parent_directories=True, odbt=git.GitDB)
        version = repo.head.object.hexsha
    liboqs_component['type'] = "library"
    liboqs_component['bom-ref'] = "pkg:github/open-quantum-safe/liboqs@" + version
    liboqs_component['name'] = "liboqs"
    liboqs_component['version'] = version

    cbom_components.insert(0, liboqs_component)

    metadata = {}
    metadata['timestamp'] = datetime.now().isoformat()
    metadata['component'] = liboqs_component

    ## Dependencies

    dependencies = []
    dependencies.append({
        "ref": liboqs_component['bom-ref'],
        "dependsOn": bom_algs_bomrefs,
        "dependencyType": "implements"
    })
    for usedep in bom_algs_use_dependencies.keys():
        dependencies.append({
            "ref": usedep,
            "dependsOn": bom_algs_use_dependencies[usedep],
            "dependencyType": "uses"
        })


    ## CBOM
    cbom = {}
    cbom['bomFormat'] = "CBOM"
    cbom['specVersion'] = "1.4-cbom-1.0"
    cbom['serialNumber'] = "urn:uuid:" + str(uuid.uuid4())
    cbom['version'] = 1
    cbom['metadata'] = metadata
    cbom['components'] = cbom_components + [common_crypto_component_aes, common_crypto_component_sha3]
    cbom['dependencies'] = dependencies
    return cbom
    

def algorithms_changed(cbom, cbom_path):
    if os.path.isfile(cbom_path):
        with open(cbom_path, mode='r', encoding='utf-8') as c:
            existing_cbom = json.load(c)
            existing_cbom['serialNumber'] = cbom['serialNumber']
            existing_cbom['metadata']['timestamp'] = cbom['metadata']['timestamp']
            existing_cbom['metadata']['component']['bom-ref'] = cbom['metadata']['component']['bom-ref']
            existing_cbom['metadata']['component']['version'] = cbom['metadata']['component']['version']
            existing_cbom['components'][0]['bom-ref'] = cbom['components'][0]['bom-ref']
            existing_cbom['components'][0]['version'] = cbom['components'][0]['version']
            existing_cbom['dependencies'][0]['ref'] = cbom['dependencies'][0]['ref']
            update_cbom = existing_cbom != cbom
            c.close()
            return update_cbom
    else:
        return True

def update_cbom_if_algs_not_changed(liboqs_root, liboqs_version):
    cbom_path = os.path.join(liboqs_root, 'docs', cbom_json_file)
    cbom = build_cbom(liboqs_root, liboqs_version)
    if algorithms_changed(cbom, cbom_path):
        with open(cbom_path, mode='w', encoding='utf-8') as out_md:
            out_md.write(json.dumps(cbom, indent=2))
            out_md.close()

if __name__ == '__main__':
    parser = argparse.ArgumentParser()
    parser.add_argument("--liboqs-root", default=".")
    parser.add_argument("--liboqs-version", default="git")
    args = parser.parse_args()
    update_cbom_if_algs_not_changed(args.liboqs_root, args.liboqs_version)