[PATCH v2 08/14] tools/sbom: add shared SPDX elements

Luis Augenstein
2026-01-20T11:55:47Z

Implement shared SPDX elements used in all three documents.

Co-developed-by: Maximilian Huber <maximilian.huber@tngtech.com>
Signed-off-by: Maximilian Huber <maximilian.huber@tngtech.com>
Signed-off-by: Luis Augenstein <luis.augenstein@tngtech.com>
---
tools/sbom/sbom/config.py | 25 +++++++++++++++
.../sbom/sbom/spdx_graph/build_spdx_graphs.py | 5 ++-
.../sbom/spdx_graph/shared_spdx_elements.py | 32 +++++++++++++++++++
3 files changed, 61 insertions(+), 1 deletion(-)
create mode 100644 tools/sbom/sbom/spdx_graph/shared_spdx_elements.py

diff --git a/tools/sbom/sbom/config.py b/tools/sbom/sbom/config.py
index 0985457c3cae..9278e2be7cb2 100644
--- a/tools/sbom/sbom/config.py
+++ b/tools/sbom/sbom/config.py
@@ -3,6 +3,7 @@

import argparse
from dataclasses import dataclass
+from datetime import datetime
from enum import Enum
import os
from typing import Any
@@ -52,6 +53,9 @@ class KernelSbomConfig:
write_output_on_error: bool
"""Whether to write output documents even if errors occur."""

+ created: datetime
+ """Datetime to use for the SPDX created property of the CreationInfo element."""
+
spdxId_prefix: str
"""Prefix to use for all SPDX element IDs."""

@@ -150,6 +154,16 @@ def _parse_cli_arguments() -> dict[str, Any]:

# SPDX specific options
spdx_group = parser.add_argument_group("SPDX options", "Options for customizing SPDX document generation")
+ spdx_group.add_argument(
+ "--created",
+ default=None,
+ help=(
+ "The SPDX created property to use for the CreationInfo element in "
+ "ISO format (YYYY-MM-DD [HH:MM:SS]).\n"
+ "If not provided the last modification time of the first root output "
+ "is used. (default: None)"
+ ),
+ )
spdx_group.add_argument(
"--spdxId-prefix",
default="urn:spdx.dev:",
@@ -195,6 +209,16 @@ def get_config() -> KernelSbomConfig:
fail_on_unknown_build_command = not args["do_not_fail_on_unknown_build_command"]
write_output_on_error = args["write_output_on_error"]

+ if args["created"] is None:
+ created = datetime.fromtimestamp(os.path.getmtime(os.path.join(obj_tree, root_paths[0])))
+ else:
+ try:
+ created = datetime.fromisoformat(args["created"])
+ except ValueError:
+ raise argparse.ArgumentTypeError(
+ f"Invalid date format for argument '--created': '{args['created']}'. "
+ "Expected ISO format (YYYY-MM-DD [HH:MM:SS])."
+ )
spdxId_prefix = args["spdxId_prefix"]
prettify_json = args["prettify_json"]

@@ -218,6 +242,7 @@ def get_config() -> KernelSbomConfig:
debug=debug,
fail_on_unknown_build_command=fail_on_unknown_build_command,
write_output_on_error=write_output_on_error,
+ created=created,
spdxId_prefix=spdxId_prefix,
prettify_json=prettify_json,
)
diff --git a/tools/sbom/sbom/spdx_graph/build_spdx_graphs.py b/tools/sbom/sbom/spdx_graph/build_spdx_graphs.py
index bb3db4e423da..9c47258a31c6 100644
--- a/tools/sbom/sbom/spdx_graph/build_spdx_graphs.py
+++ b/tools/sbom/sbom/spdx_graph/build_spdx_graphs.py
@@ -1,18 +1,20 @@
# SPDX-License-Identifier: GPL-2.0-only OR MIT
# Copyright (C) 2025 TNG Technology Consulting GmbH

-
+from datetime import datetime
from typing import Protocol

from sbom.config import KernelSpdxDocumentKind
from sbom.cmd_graph import CmdGraph
from sbom.path_utils import PathStr
from sbom.spdx_graph.spdx_graph_model import SpdxGraph, SpdxIdGeneratorCollection
+from sbom.spdx_graph.shared_spdx_elements import SharedSpdxElements

class SpdxGraphConfig(Protocol):
obj_tree: PathStr
src_tree: PathStr
+ created: datetime

def build_spdx_graphs(
@@ -33,4 +35,5 @@ def build_spdx_graphs(
Returns:
Dictionary of SPDX graphs
"""
+ shared_elements = SharedSpdxElements.create(spdx_id_generators.base, config.created)
return {}
diff --git a/tools/sbom/sbom/spdx_graph/shared_spdx_elements.py b/tools/sbom/sbom/spdx_graph/shared_spdx_elements.py
new file mode 100644
index 000000000000..0c83428f4c70
--- /dev/null
+++ b/tools/sbom/sbom/spdx_graph/shared_spdx_elements.py
@@ -0,0 +1,32 @@
+# SPDX-License-Identifier: GPL-2.0-only OR MIT
+# Copyright (C) 2025 TNG Technology Consulting GmbH
+
+from dataclasses import dataclass
+from datetime import datetime
+from sbom.spdx.core import CreationInfo, SoftwareAgent
+from sbom.spdx.spdxId import SpdxIdGenerator
+
+
+@dataclass(frozen=True)
+class SharedSpdxElements:
+ agent: SoftwareAgent
+ creation_info: CreationInfo
+
+ @classmethod
+ def create(cls, spdx_id_generator: SpdxIdGenerator, created: datetime) -> "SharedSpdxElements":
+ """
+ Creates shared SPDX elements used across multiple documents.
+
+ Args:
+ spdx_id_generator: Generator for creating SPDX IDs.
+ created: SPDX 'created' property used for the creation info.
+
+ Returns:
+ SharedSpdxElements with agent and creation info.
+ """
+ agent = SoftwareAgent(
+ spdxId=spdx_id_generator.generate(),
+ name="KernelSbom",
+ )
+ creation_info = CreationInfo(createdBy=[agent], created=created.strftime("%Y-%m-%dT%H:%M:%SZ"))
+ return SharedSpdxElements(agent=agent, creation_info=creation_info)
--
2.34.1