feluda 1.12.0

A CLI tool to check dependency licenses.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72

use crate::debug::{log, FeludaError, FeludaResult, LogLevel};
use serde_json::Value as JsonValue;
use std::fs;

mod cyclonedx_validator;
mod parser;
mod reporter;
mod spdx_validator;

#[derive(Debug, Clone, Copy, PartialEq)]
enum SbomType {
    Spdx,
    CycloneDx,
}

fn detect_sbom_type(content: &str) -> FeludaResult<SbomType> {
    let json: JsonValue = serde_json::from_str(content)
        .map_err(|e| FeludaError::Validation(format!("Failed to parse JSON: {e}")))?;

    if let Some(obj) = json.as_object() {
        if obj.contains_key("spdxVersion") || obj.contains_key("SPDXID") {
            return Ok(SbomType::Spdx);
        }
        if obj.contains_key("bomFormat") || obj.contains_key("specVersion") {
            return Ok(SbomType::CycloneDx);
        }
    }

    Err(FeludaError::Validation(
        "Could not detect SBOM type. File is neither SPDX nor CycloneDX.".to_string(),
    ))
}

pub fn handle_sbom_validate_command(
    sbom_file: String,
    output: Option<String>,
    json_output: bool,
) -> FeludaResult<()> {
    log(
        LogLevel::Info,
        &format!("Validating SBOM file: {sbom_file}"),
    );

    let content = fs::read_to_string(&sbom_file)
        .map_err(|_| FeludaError::Validation(format!("Failed to read SBOM file: {sbom_file}")))?;

    log(LogLevel::Info, "Parsing SBOM file");
    let json: JsonValue = serde_json::from_str(&content)
        .map_err(|e| FeludaError::Validation(format!("Invalid JSON: {e}")))?;

    log(LogLevel::Info, "Detecting SBOM type");
    let sbom_type = detect_sbom_type(&content)?;
    log(
        LogLevel::Info,
        &format!("Detected SBOM type: {sbom_type:?}"),
    );

    let validation_report = match sbom_type {
        SbomType::Spdx => {
            log(LogLevel::Info, "Running SPDX validation");
            spdx_validator::validate(&json)?
        }
        SbomType::CycloneDx => {
            log(LogLevel::Info, "Running CycloneDX validation");
            cyclonedx_validator::validate(&json)?
        }
    };

    validation_report.write_output(json_output, output)?;

    Ok(())
}