INNER CODE UNIT · Python

load_spdx_gitoids

wolfSSL/wolfssl · scripts/bomsh_verify.py:63

def load_spdx_gitoids(spdx_path):
    """Return [(package_name, gitoid_hex), ...] for every externalRef
    of referenceType 'gitoid' in the SPDX document at spdx_path.

    Raises ValueError on a malformed locator (anything that isn't
    `gitoid:blob:sha1:<hex>`).  An sha256 locator would land here too
    if bomsh ever switches; the failure is the right behaviour, since
    a maintainer must update the verifier in lockstep."""
    with open(spdx_path) as f:
        spdx = json.load(f)
    gitoids = []
    for pkg in spdx.get('packages', []):
        for ref in pkg.get('externalRefs', []):
            if ref.get('referenceType') != 'gitoid':
                continue
            loc = ref.get('referenceLocator', '')
            if not loc.startswith(GITOID_LOCATOR_PREFIX):
                raise ValueError(

View source record →