search

hughsie / python-uswid

A tiny tool for embedding CoSWID tags in EFI binaries
Other
21 stars 6 forks source link

Evidence feature issues #53

Closed samueldr closed 1 year ago

samueldr commented 1 year ago

Hi,

Just now looking at generating uSWID for a software project, and hitting some issues with 0.4.4.

Note that I'm using the xml output as a way to check against a different text file format.

First of all, two problems with the README example.

https://github.com/hughsie/python-uswid/blob/6a1e4f145c6c06bf2e69bdff3d88933203803686/README.md#L134-L141

The example doesn't work:

 $ ./result-uswid/bin/uswid --load input.ini --save uswid.xml
Traceback (most recent call last):
  File "/nix/store/aj54z63lvrih5rcjdshf70afwwl4fsb8-python3.10-uswid-0.4.4/bin/.uswid-wrapped", line 9, in <module>
    sys.exit(main())
  File "/nix/store/aj54z63lvrih5rcjdshf70afwwl4fsb8-python3.10-uswid-0.4.4/lib/python3.10/site-packages/uswid/cli.py", line 363, in main
    for identity in base.load(f.read(), path=os.path.dirname(filepath)):
  File "/nix/store/aj54z63lvrih5rcjdshf70afwwl4fsb8-python3.10-uswid-0.4.4/lib/python3.10/site-packages/uswid/format_ini.py", line 58, in load
    self._load_identity(identity, blob, path=path)
  File "/nix/store/aj54z63lvrih5rcjdshf70afwwl4fsb8-python3.10-uswid-0.4.4/lib/python3.10/site-packages/uswid/format_ini.py", line 311, in _load_identity
    self._load_evidence(evidence, config[group])
  File "/nix/store/aj54z63lvrih5rcjdshf70afwwl4fsb8-python3.10-uswid-0.4.4/lib/python3.10/site-packages/uswid/format_ini.py", line 221, in _load_evidence
    evidence.date = datetime.fromisoformat(value)
ValueError: Invalid isoformat string: '2023-09-15T12:34:56Z'

The date format from the example isn't valid (at least according to my packaging).

And then, trying with another date format that passes here:

[uSWID-Evidence]
date = 2023-09-15T12:34:56
device-id = this-local-hostname
$ ./result-uswid/bin/uswid --load input.ini --save uswid.xml
unknown key device-id found in ini file!

It accepts device_id, though, but this will save device_id= in the XML tag name, which should be deviceId. AFAICT there's no way to provide a valid deviceId here.

Finally, while it is listed as optional, I see no way to turn it off entirely. The best I can do is make it output an empty element by using an empty element

[uSWID-Evidence]