Skip to content

ENH: Generate SPDX 2.3 Software Bill of Materials at configure time #5817

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hjmjohnson merged 6 commits into from
Apr 22, 2026
Merged

ENH: Generate SPDX 2.3 Software Bill of Materials at configure time #5817

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
3083f1c
ENH: Add SPDX 2.3 SBOM generator at configure time
hjmjohnson Apr 19, 2026
3cd4719
ENH: Distribute SBOM metadata into per-module itk-module.cmake
hjmjohnson Apr 19, 2026
7c64e63
ENH: Add SBOM validation CTest suite
hjmjohnson Apr 19, 2026
3d3d095
ENH: Add REUSE 3.x compliance metadata
hjmjohnson Apr 19, 2026
7a3a26f
ENH: Add SPDX file-header tool and pre-commit enforcement
hjmjohnson Apr 19, 2026
092e1c4
DOC: Document SBOM and SPDX tooling under Utilities/SPDX/
hjmjohnson Apr 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions .pre-commit-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,6 +97,13 @@ repos:
| \.c$ # Exclude .c files
- repo: local
hooks:
- id: check-spdx-headers
name: 'check SPDX license headers'
entry: 'python3 Utilities/SPDX/add_headers.py --check --files'
language: system
files: '\.(h|hxx|cxx|txx|py|cmake)$|CMakeLists\.txt$'
exclude: "\\/ThirdParty\\/|\\/.pixi\\/|\\/Data\\/|\\/cmake-build.*\\/"
stages: [pre-commit]
- id: local-prepare-commit-msg
name: 'local prepare-commit-msg'
entry: 'Utilities/Hooks/prepare-commit-msg'
Expand Down
47 changes: 46 additions & 1 deletion CMake/ITKModuleMacros.cmake
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,10 @@ include(GenerateExportHeader)
# EXCLUDE_FROM_DEFAULT = Exclude this module from the build default modules flag
# EXCLUDE_FROM_ALL = (depreciated) Exclude this module from the build all modules flag
# ENABLE_SHARED = Build this module as a shared library if the build shared libraries flag is set
# SPDX_OPT_OUT = Exclude this module from the generated SBOM. Intended for
# pure build-time helpers (e.g. pygccxml) that are not linked
# into the runtime and therefore are not a redistribution or
# supply-chain concern for downstream consumers.
#
# This macro will ensure the module name is compliant, and set the appropriate
# module variables as declared in the itk-module.cmake file.
Expand Down Expand Up @@ -69,12 +73,29 @@ macro(itk_module _name)
set(ITK_MODULE_${itk-module}_DESCRIPTION "description")
set(ITK_MODULE_${itk-module}_EXCLUDE_FROM_DEFAULT 0)
set(ITK_MODULE_${itk-module}_ENABLE_SHARED 0)
set(ITK_MODULE_${itk-module}_SPDX_LICENSE "")
set(ITK_MODULE_${itk-module}_SPDX_VERSION "")
set(ITK_MODULE_${itk-module}_SPDX_DOWNLOAD_LOCATION "")
set(ITK_MODULE_${itk-module}_SPDX_COPYRIGHT "")
set(ITK_MODULE_${itk-module}_SPDX_CUSTOM_LICENSE_TEXT "")
set(ITK_MODULE_${itk-module}_SPDX_CUSTOM_LICENSE_NAME "")
set(ITK_MODULE_${itk-module}_SPDX_PURL "")
set(ITK_MODULE_${itk-module}_SPDX_OPT_OUT 0)
# Detect third-party modules by source path. The child-scope
# set(${itk-module}_THIRD_PARTY 1) in Modules/ThirdParty/*/CMakeLists.txt
# does not propagate to where SBOM generation runs; use the source location
# as an authoritative, parent-scope-visible signal instead.
if("${CMAKE_CURRENT_SOURCE_DIR}" MATCHES "/Modules/ThirdParty/")
set(ITK_MODULE_${itk-module}_IS_THIRD_PARTY 1)
else()
set(ITK_MODULE_${itk-module}_IS_THIRD_PARTY 0)
endif()
foreach(arg ${ARGN})
### Parse itk_module named options
if(
"${arg}"
MATCHES
"^((|COMPILE_|PRIVATE_|TEST_|)DEPENDS|DESCRIPTION|DEFAULT|FACTORY_NAMES)$"
"^((|COMPILE_|PRIVATE_|TEST_|)DEPENDS|DESCRIPTION|DEFAULT|FACTORY_NAMES|SPDX_LICENSE|SPDX_VERSION|SPDX_DOWNLOAD_LOCATION|SPDX_COPYRIGHT|SPDX_CUSTOM_LICENSE_TEXT|SPDX_CUSTOM_LICENSE_NAME|SPDX_PURL)$"
)
set(_doing "${arg}")
elseif("${arg}" MATCHES "^EXCLUDE_FROM_DEFAULT$")
Expand All @@ -90,6 +111,9 @@ macro(itk_module _name)
elseif("${arg}" MATCHES "^ENABLE_SHARED$")
set(_doing "")
set(ITK_MODULE_${itk-module}_ENABLE_SHARED 1)
elseif("${arg}" MATCHES "^SPDX_OPT_OUT$")
set(_doing "")
set(ITK_MODULE_${itk-module}_SPDX_OPT_OUT 1)
### Parse named option parameters
elseif("${_doing}" MATCHES "^DEPENDS$")
list(APPEND ITK_MODULE_${itk-module}_DEPENDS "${arg}")
Expand All @@ -104,6 +128,27 @@ macro(itk_module _name)
elseif("${_doing}" MATCHES "^DESCRIPTION$")
set(_doing "")
set(ITK_MODULE_${itk-module}_DESCRIPTION "${arg}")
elseif("${_doing}" MATCHES "^SPDX_LICENSE$")
set(_doing "")
set(ITK_MODULE_${itk-module}_SPDX_LICENSE "${arg}")
elseif("${_doing}" MATCHES "^SPDX_VERSION$")
set(_doing "")
set(ITK_MODULE_${itk-module}_SPDX_VERSION "${arg}")
elseif("${_doing}" MATCHES "^SPDX_DOWNLOAD_LOCATION$")
set(_doing "")
set(ITK_MODULE_${itk-module}_SPDX_DOWNLOAD_LOCATION "${arg}")
elseif("${_doing}" MATCHES "^SPDX_COPYRIGHT$")
set(_doing "")
set(ITK_MODULE_${itk-module}_SPDX_COPYRIGHT "${arg}")
elseif("${_doing}" MATCHES "^SPDX_CUSTOM_LICENSE_TEXT$")
set(_doing "")
set(ITK_MODULE_${itk-module}_SPDX_CUSTOM_LICENSE_TEXT "${arg}")
elseif("${_doing}" MATCHES "^SPDX_CUSTOM_LICENSE_NAME$")
set(_doing "")
set(ITK_MODULE_${itk-module}_SPDX_CUSTOM_LICENSE_NAME "${arg}")
elseif("${_doing}" MATCHES "^SPDX_PURL$")
set(_doing "")
set(ITK_MODULE_${itk-module}_SPDX_PURL "${arg}")
elseif("${_doing}" MATCHES "^DEFAULT")
message(FATAL_ERROR "Invalid argument [DEFAULT]")
else()
Expand Down
Loading
Loading