[PATCH 2/3] testsuite: refactor sbom tests to avoid overhead

["'Felix Moessbauer' via isar-users" <isar-users@googlegroups.com>]

We currently test the SBOM infrastructure in all image builds, which
adds a significant overhead. We now change this to not generate SBOMs in
general (and by that avoid building the dependencies). To not have a
testing gap, we add a dedicated SBOM test that checks the SBOM creation
for various targets. In addition, we now also check the content of the
SBOM for plausibility.

In the future, the SBOM test can be extended without slowing down the
overall test execution.

Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
---
 testsuite/cibase.py    | 26 ++++++++++++++++++++++++++
 testsuite/cibuilder.py |  4 ++++
 testsuite/citest.py    | 33 +++++++++++++++++++++++++++++++++
 3 files changed, 63 insertions(+)

diff --git a/testsuite/cibase.py b/testsuite/cibase.py
index 5ef1a5b5..fd6a3df9 100755
--- a/testsuite/cibase.py
+++ b/testsuite/cibase.py
@@ -140,6 +140,32 @@ class CIBaseTest(CIBuilder):
         self.delete_from_build_dir('ccache')
         self.unconfigure()
 
+    def perform_sbom_test(self, targets, **kwargs):
+        """
+        Build a rootfs containing a needle package and check if that package
+        is added to the sbom.
+        """
+        import json
+
+        needle_pkg = 'cowsay'
+        self.perform_build_test(
+            targets, image_install=needle_pkg,
+            generate_sbom=True
+        )
+
+        for t in targets:
+            ds, pn, distro, machine = \
+                CIUtils.getVars('DEPLOY_DIR_SBOM', 'PN', 'DISTRO', 'MACHINE',
+                                target=t)
+            for t in ["cdx", "spdx"]:
+                sbom_path = os.path.join(ds, f'{pn}-{distro}-{machine}.{t}.json')
+                self.log.info(f"Check {t} SBOM in {sbom_path}")
+                with open(sbom_path) as f:
+                    sbom = json.load(f)
+                pkg_key = 'components' if t == 'cdx' else 'packages'
+                if not any(c for c in sbom[pkg_key] if c['name'] == needle_pkg):
+                    self.fail(f'{needle_pkg} package not found in SBOM {sbom_path}')
+
     def perform_sstate_populate(self, image_target, **kwargs):
         # Use a different isar root for populating sstate cache
         isar_sstate = f"{isar_root}/isar-sstate"
diff --git a/testsuite/cibuilder.py b/testsuite/cibuilder.py
index 310a3836..614a3397 100755
--- a/testsuite/cibuilder.py
+++ b/testsuite/cibuilder.py
@@ -126,6 +126,7 @@ class CIBuilder(Test):
         installer_distro=None,
         installer_device=None,
         customizations=None,
+        generate_sbom=False,
         lines=None,
         **kwargs,
     ):
@@ -176,6 +177,7 @@ class CIBuilder(Test):
             f"  image_install = {image_install}\n"
             f"  installer_image = {installer_image}\n"
             f"  customizations = {customizations}\n"
+            f"  generate_sbom = {generate_sbom}\n"
             f"  lines = {strlines}\n"
             f"==================================================="
         )
@@ -275,6 +277,8 @@ class CIBuilder(Test):
                     'CUSTOMIZATION_FOR_IMAGES:append = " isar-image-ci"\n'
                     'HOSTNAME:isar-image-ci = "isar-ci"\n'
                 )
+            if generate_sbom is False:
+                f.write('ROOTFS_FEATURES:remove = "generate-sbom"\n')
             if lines is not None:
                 f.writelines((line + '\n' if not line.endswith('\n') else line) for line in lines)
 
diff --git a/testsuite/citest.py b/testsuite/citest.py
index cc2bdf41..2b3efa4a 100755
--- a/testsuite/citest.py
+++ b/testsuite/citest.py
@@ -692,6 +692,39 @@ class CustomizationsTest(CIBaseTest):
         )
 
 
+class SbomTest(CIBaseTest):
+    """
+    Test to check if sbom is generated and contains expected packages.
+    Most tests are rootfs tests to avoid costly initrd build and imaging.
+
+    :avocado: tags=sbom,fast
+    """
+
+    def test_sbom_rootfs_generate(self):
+        targets = [
+            'mc:qemuamd64-bookworm:isar-rootfs-ci',
+            'mc:qemuarm64-bookworm:isar-rootfs-ci',
+            'mc:qemuamd64-trixie:isar-rootfs-ci',
+            'mc:qemuarm64-trixie:isar-rootfs-ci',
+            'mc:qemuamd64-noble:isar-rootfs-ci',
+        ]
+
+        self.init()
+        self.perform_sbom_test(targets)
+
+    def test_sbom_unsupported(self):
+        targets = [
+            'mc:qemuamd64-bullseye:isar-rootfs-ci',
+            'mc:qemuamd64-focal:isar-rootfs-ci',
+        ]
+
+        self.init()
+        self.perform_build_test(
+            targets, bitbake_cmd='do_rootfs', image_install='cowsay',
+            generate_sbom=True
+        )
+
+
 class SignatureTest(CIBaseTest):
 
     """
-- 
2.51.0

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20251218155347.9929-2-felix.moessbauer%40siemens.com.