ncs-sbom fails if package name is None

[Alexey Papkovskiy]

nRF Connect SDK 2.4.0

The issue is in scripts/west_commands/sbom/output_pre_process.py

def pre_process(data: Data):
# ....
    for package in data.packages.values():
        if (package.url is None) or (package.version is None):
            continue
        if (package.name is
                None) and (package.url.startswith('https://github.com/')):
            package.name = package.url.replace('https://github.com/', '')
            if package.name.endswith('.git'):
                package.name = package.name[:-4]
        if package.name in package_name_map:
            existing = package_name_map[package.name]
            del package_name_map[package.name]
            package.name += '-' + package.version

The code `package.name += '-' + package.version` fails if package.name is None

[Edvin]

Hello,

I have never stumbled upon this error before. Did you need to actively use this while building, or was it run by default when you were building a sample?

Is it supposed to run without errors when package.name is None?

BR,
Edvin

[Alexey Papkovskiy]

We want to create SBOM for every release with our CI/CD. We specifically enabled that to get SBOM.

The answer to your question "Is it supposed to run without errors when package.name is None?" is that the script already handles this case, but only if URL startswith('https://github.com/'), lines 6 and 7. Why is only github.com? What's about gitlab? bitbacket? what if ssh is used and URL starts with "git@..."

[Edvin]

I understand. Well, it looks like this is a bit of a lacking feature from our side. I guess you can modify this script to behave as you like, but I also understand your request to patch this from our side. I will take this internally with our team. If you have a specific suggestion, feel free to upload that, and I can forward it to our NCS team.

Best regards,

Edvin

[Alexey Papkovskiy]

Yeh, it will be nice.

My suggestion is to replace

if (package.name is
                None) and (package.url.startswith('https://github.com/')):
            package.name = package.url.replace('https://github.com/', '')
            if package.name.endswith('.git'):
                package.name = package.name[:-4]

with

if (package.name is None):
        pattern = r'^(?:https?:\/\/)?(?:[^@\/\n]+@)?(?:www\.)?(?:git@)?([^:\/\n]+:?\/?)?'
        package.name = re.sub(pattern, '', package.url)
        if package.name.endswith('.git'):
            package.name = package.name[:-4]

[Edvin]

Thank you, and sorry for the delayed answer.

I have forwarded this now, so hopefully it will be adjusted in a future release.

Thank you for the report, and the suggestion

Best regards,

Edvin

[Alexey Papkovskiy]

Thx for the support)))