Defining and generating spdx 3.0 json elements

Microsoft.Sbom.sln

@@ -57,6 +57,10 @@ Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Microsoft.Sbom.Tool.Tests",
 EndProject
 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Microsoft.Sbom.Targets.E2E.Tests", "test\Microsoft.Sbom.Targets.E2E.Tests\Microsoft.Sbom.Targets.E2E.Tests.csproj", "{3FDE7800-F61F-4C45-93AB-648A4C7979C7}"
 EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Microsoft.Sbom.Parsers.Spdx30SbomParser", "src\Microsoft.Sbom.Parsers.Spdx30SbomParser\Microsoft.Sbom.Parsers.Spdx30SbomParser.csproj", "{476B9C87-293F-4BF7-B39A-EB732083409F}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Microsoft.Sbom.Parsers.Spdx30SbomParser.Tests", "test\Microsoft.Sbom.Parsers.Spdx30SbomParser.Tests\Microsoft.Sbom.Parsers.Spdx30SbomParser.Tests.csproj", "{E3FE33BB-FAB2-4F60-B930-BEB736AACE25}"
+EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug|Any CPU = Debug|Any CPU
@@ -131,6 +135,14 @@ Global
 		{3FDE7800-F61F-4C45-93AB-648A4C7979C7}.Debug|Any CPU.Build.0 = Debug|Any CPU
 		{3FDE7800-F61F-4C45-93AB-648A4C7979C7}.Release|Any CPU.ActiveCfg = Release|Any CPU
 		{3FDE7800-F61F-4C45-93AB-648A4C7979C7}.Release|Any CPU.Build.0 = Release|Any CPU
+		{476B9C87-293F-4BF7-B39A-EB732083409F}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{476B9C87-293F-4BF7-B39A-EB732083409F}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{476B9C87-293F-4BF7-B39A-EB732083409F}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{476B9C87-293F-4BF7-B39A-EB732083409F}.Release|Any CPU.Build.0 = Release|Any CPU
+		{E3FE33BB-FAB2-4F60-B930-BEB736AACE25}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{E3FE33BB-FAB2-4F60-B930-BEB736AACE25}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{E3FE33BB-FAB2-4F60-B930-BEB736AACE25}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{E3FE33BB-FAB2-4F60-B930-BEB736AACE25}.Release|Any CPU.Build.0 = Release|Any CPU
 	EndGlobalSection
 	GlobalSection(SolutionProperties) = preSolution
 		HideSolutionNode = FALSE

src/Microsoft.Sbom.Parsers.Spdx30SbomParser/Constants.cs

@@ -0,0 +1,54 @@
+// Copyright (c) Microsoft. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+
+using System.Collections.Generic;
+using Microsoft.Sbom.Extensions.Entities;
+
+namespace Microsoft.Sbom.Parsers.Spdx30SbomParser;
+
+internal static class Constants
+{
+    internal const string SPDXName = "SPDX";
+    internal const string SPDXVersion = "3.0";
+    internal const string DataLicenceValue = "CC0-1.0";
+    internal const string SPDXDocumentIdValue = "SPDXRef-DOCUMENT";
+    internal const string RootPackageIdValue = "SPDXRef-RootPackage";
+    internal const string SPDXRefFile = "SPDXRef-File";
+
+    internal const string SPDXVersionHeaderName = "spdxVersion";
+    internal const string DataLicenseHeaderName = "dataLicense";
+    internal const string SPDXIDHeaderName = "SPDXID";
+    internal const string DocumentNameHeaderName = "name";
+    internal const string DocumentNamespaceHeaderName = "documentNamespace";
+    internal const string CreationInfoHeaderName = "creationInfo";
+    internal const string DocumentDescribesHeaderName = "documentDescribes";
+
+    internal const int ReadBufferSize = 4096;
+
+    internal const string SPDXDocumentNameFormatString = "{0} {1}";
+    internal const string PackageSupplierFormatString = "Organization: {0}";
+
+    /// <summary>
+    /// Use if there is no available information for a field.
+    /// </summary>
+    internal const string NoneValue = "NONE";
+
+    /// <summary>
+    /// Use if SPDX creator
+    /// - made an attempt to retrieve the info but cannot determine correct values.
+    /// - made no attempt to retrieve the info.
+    /// - has intentionally provided no information.
+    /// </summary>
+    internal const string NoAssertionValue = "NOASSERTION";
+
+    /// <summary>
+    /// The <see cref="NoAssertionValue"/> value as a list with a single item.
+    /// </summary>
+    internal static IEnumerable<string> NoAssertionListValue = new List<string> { NoAssertionValue };
+
+    internal static ManifestInfo Spdx30ManifestInfo = new ManifestInfo
+    {
+        Name = SPDXName,
+        Version = SPDXVersion
+    };
+}

src/Microsoft.Sbom.Parsers.Spdx30SbomParser/Entities/AnyLicenseInfo.cs

@@ -0,0 +1,19 @@
+// Copyright (c) Microsoft. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+
+using System.Collections.Generic;
+using System.Text.Json.Serialization;
+
+namespace Microsoft.Sbom.Parsers.Spdx30SbomParser.Entities;
+
+/// <summary>
+/// Class defintion is based on: https://spdx.github.io/spdx-spec/v3.0.1/model/SimpleLicensing/Classes/AnyLicenseInfo/
+/// </summary>
+public class AnyLicenseInfo : Element
+{
+    public AnyLicenseInfo()
+    {
+        Type = "AnyLicenseInfo";
+        SpdxId = "SPDXRef-AnyLicenseInfo";
+    }
+}

src/Microsoft.Sbom.Parsers.Spdx30SbomParser/Entities/ContentIdentifier.cs

@@ -0,0 +1,35 @@
+// Copyright (c) Microsoft. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+
+using System.Collections.Generic;
+using System.Text.Json.Serialization;
+
+namespace Microsoft.Sbom.Parsers.Spdx30SbomParser.Entities;
+
+/// <summary>
+/// A ContentIdentifier is a canonical, unique, immutable identifier of the content of a software artifact, such as a package, a file, or a snippet.
+/// It can be used for verifying its identity and integrity.
+/// https://spdx.github.io/spdx-spec/v3.0.1/model/Software/Classes/ContentIdentifier/
+/// </summary>
+public class ContentIdentifier : Software
+{
+    private string contentIdentifierType;
+
+    public ContentIdentifier()
+    {
+        Type = "ContentIdentifier";
+    }
+
+    /// <summary>
+    /// Gets or sets the content identifier type.
+    /// Allowed types are Git Object ID and Software Hash Identifier (swhid).
+    /// We will use swhid unless otherwise specified.
+    /// </summary>
+    [JsonRequired]
+    [JsonPropertyName("contentIdentifierType")]
+    public override string ContentIdentifierType
+    {
+        get => this.contentIdentifierType ?? "swhid";
+        set => this.contentIdentifierType = value;
+    }
+}

src/Microsoft.Sbom.Parsers.Spdx30SbomParser/Entities/CreationInfo.cs

@@ -0,0 +1,58 @@
+// Copyright (c) Microsoft. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+
+using System.Collections.Generic;
+using System.Text.Json.Serialization;
+
+namespace Microsoft.Sbom.Parsers.Spdx30SbomParser.Entities;
+
+/// <summary>
+/// Used to define creation information about the SPDX element.
+/// https://spdx.github.io/spdx-spec/v3.0.1/model/Core/Classes/CreationInfo/
+/// </summary>
+public class CreationInfo : Element
+{
+    public CreationInfo()
+    {
+        Type = "CreationInfo";
+    }
+
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("@id")]
+    public string Id { get; set; }
+
+    /// <summary>
+    /// Gets or sets a string that specifies the time the SBOM was created on.
+    /// </summary>
+    [JsonRequired]
+    [JsonPropertyName("created")]
+    public string Created { get; set; }
+
+    /// <summary>
+    /// Gets or sets a list of strings that specify metadata about the creators of this SBOM.
+    /// This could be a person, organization, software agent, etc. and is represented by the Agent class.
+    /// This is not to be confused with tools that are used to perform tasks.
+    /// </summary>
+    [JsonRequired]
+    [JsonPropertyName("createdBy")]
+    public IEnumerable<string> CreatedBy { get; set; }
+
+    /// <summary>
+    /// Gets or sets a list of strings that specify metadata about the tools used to create this SBOM.
+    /// A tool is an element of hardware and/or software utilized to carry out a particular function.
+    /// </summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("createdUsing")]
+    public IEnumerable<string> CreatedUsing { get; set; }
+
+    [JsonRequired]
+    [JsonPropertyName("specVersion")]
+    public string SpecVersion { get; set; }
+
+    /// <summary>
+    /// Make sure that creation info details are not serialized/deserialized when creating a CreationInfo element.
+    /// CreationInfoDetails is a property in the base class Element that is inherited by all other classes except for CreationInfo.
+    /// </summary>
+    [JsonIgnore]
+    public new string CreationInfoDetails { get; set; }
+}

src/Microsoft.Sbom.Parsers.Spdx30SbomParser/Entities/Element.cs

@@ -0,0 +1,70 @@
+// Copyright (c) Microsoft. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+
+using System.Collections;
+using System.Collections.Generic;
+using System.Text.Json.Serialization;
+
+namespace Microsoft.Sbom.Parsers.Spdx30SbomParser.Entities;
+
+/// <summary>
+/// Base domain class from which all other SPDX-3.0 domain classes derive.
+/// https://spdx.github.io/spdx-spec/v3.0.1/model/Core/Classes/Element/
+/// </summary>
+public class Element
+{
+    protected Element()
+    {
+        CreationInfoDetails = "_:creationinfo";
+    }
+
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("comment")]
+    public string Comment { get; set; }
+
+    [JsonRequired]
+    [JsonPropertyName("creationInfo")]
+    public string CreationInfoDetails { get; set; }
+
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("description")]
+    public string Description { get; set; }
+
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingDefault)]
+    [JsonPropertyName("extension")]
+    public List<object> Extension { get; set; }
+
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingDefault)]
+    [JsonPropertyName("externalIdentifier")]
+    public List<string> ExternalIdentifier { get; set; }
+
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingDefault)]
+    [JsonPropertyName("externalRef")]
+    public List<string> ExternalRef { get; set; }
+
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("name")]
+    public string Name { get; set; }
+
+    /// <summary>
+    /// Gets or sets unique Identifier for elements in SPDX document.
+    /// </summary>
+    [JsonRequired]
+    [JsonPropertyName("spdxId")]
+    public string SpdxId { get; set; }
+
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("summary")]
+    public string Summary { get; set; }
+
+    /// <summary>
+    /// Gets or sets on how packages were verified.
+    /// </summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingDefault)]
+    [JsonPropertyName("verifiedUsing")]
+    public List<PackageVerificationCode> VerifiedUsing { get; set; }
+
+    [JsonRequired]
+    [JsonPropertyName("type")]
+    public string Type { get; set; }
+}

src/Microsoft.Sbom.Parsers.Spdx30SbomParser/Entities/Enums/HashAlgorithm.cs

@@ -0,0 +1,41 @@
+// Copyright (c) Microsoft. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+
+using System.Diagnostics.CodeAnalysis;
+using System.Text.Json.Serialization;
+
+namespace Microsoft.Sbom.Parsers.Spdx30SbomParser.Entities.Enums;
+
+/// <summary>
+/// Defined hash algorithms: https://spdx.github.io/spdx-spec/v3.0.1/model/Core/Vocabularies/HashAlgorithm/
+/// </summary>
+[JsonConverter(typeof(JsonStringEnumConverter))]
+[SuppressMessage(
+    "StyleCop.CSharp.NamingRules",
+    "SA1300:Element should begin with upper-case letter",
+    Justification = "These are enum types that are case sensitive and defined by external code.")]
+public enum HashAlgorithm
+{
+    adler32,
+    blake2b256,
+    blake2b384,
+    blake2b512,
+    blake3,
+    crystalsDilithium,
+    crystalsKyber,
+    falcon,
+    md2,
+    md4,
+    md5,
+    md6,
+    other,
+    sha1,
+    sha224,
+    sha256,
+    sha384,
+    sha3_224,
+    sha3_256,
+    sha3_384,
+    sha3_512,
+    sha512
+}

src/Microsoft.Sbom.Parsers.Spdx30SbomParser/Entities/Enums/ProfileIdentifierType.cs

@@ -0,0 +1,30 @@
+// Copyright (c) Microsoft. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+
+using System.Diagnostics.CodeAnalysis;
+using System.Text.Json.Serialization;
+
+namespace Microsoft.Sbom.Parsers.Spdx30SbomParser.Entities.Enums;
+
+/// <summary>
+/// There are a set of profiles that have been defined by a profile team.
+/// https://spdx.github.io/spdx-spec/v3.0.1/model/Core/Vocabularies/ProfileIdentifierType/.
+/// </summary>
+[JsonConverter(typeof(JsonStringEnumConverter))]
+[SuppressMessage(
+    "StyleCop.CSharp.NamingRules",
+    "SA1300:Element should begin with upper-case letter",
+    Justification = "These are enum types that are case sensitive and defined by external code.")]
+public enum ProfileIdentifierType
+{
+    ai,
+    build,
+    core,
+    dataset,
+    expandedLicensing,
+    extension,
+    lite,
+    security,
+    simpleLicensing,
+    software
+}