A bill of materials generation method and device of software and electronic equipment

Abstract

Embodiments of the present application disclose a software bill of materials generation method and device and electronic equipment, and relate to the technical field of software, which can effectively improve the generation efficiency of the software bill of materials, and generate the bill of materials from the files of the source code package to the target level in a forward direction, so that the information is complete and sufficient. The method comprises the following steps: determining file information of each file in each source code package in the current software and package information of each source code package; establishing a first membership relationship between the package information of each source code package and the file information of each file in the source code package; establishing material information of at least one upper-level material based on the package information of at least one source code package; and generating the bill of materials of the software based on the file information of each file in each source code package, the package information of each source code package, the first membership relationship, and the material information of the at least one upper-level material. The present application is suitable for generating the bill of materials of software.

Description

Technical Field

[0001] This application relates to the field of software technology, and more particularly to a method, apparatus, electronic device, and readable storage medium for generating a bill of materials for software. Background Technology

[0002] In the digital age, software has become an essential element for maintaining normal production and daily life. With the evolution of new technologies and concepts such as containers, middleware, microservices, and DevOps, the software industry has developed rapidly. However, this has also brought about problems such as increasing complexity in software design and development, a more complex software supply chain, decreased overall software transparency, and increasing difficulty in protecting software supply chain security. In recent years, software supply chain security incidents have occurred frequently, making improving software supply chain transparency and mitigating software supply chain security issues a hot topic and a common demand in the industry.

[0003] Software bills of materials (BOMs) were developed to address this issue. A software BOM is a list of the components contained in software, including information about those components and their supply chain relationships, effectively solving the problem of software transparency.

[0004] In the prior art, the relevant information of the software bill of materials is manually filled in to generate the bill of materials for the target software. However, manually filling in the relevant information of the software bill of materials results in low efficiency in generating the software bill of materials, and manually filling in the list is prone to incomplete information. Summary of the Invention

[0005] In view of this, embodiments of this application provide a method, apparatus, electronic device, and readable storage medium for generating a software bill of materials, which can effectively improve the efficiency of generating the software bill of materials, and generate the bill of materials layer by layer from the source code package files to the target level, with complete and sufficient information.

[0006] In a first aspect, embodiments of this application provide a method for generating a bill of materials (BOM) for software, comprising: determining file information of each file in each source code package of the current software and package information of each source code package; establishing a first hierarchical relationship between the package information of each source code package and the file information of each file in the source code package; establishing material information of at least one parent material based on the package information of at least one source code package; and generating the BOM for the software based on the file information of each file in each source code package, the package information of each source code package, the first hierarchical relationship, and the material information of the at least one parent material.

[0007] According to a specific implementation of an embodiment of this application, the current software includes a first source code package and a second source code package; wherein, determining the file information of each file in each source code package and the package information of each source code package in the current software includes: based on the compilation operation of the first source code package in the current software, traversing each file of the first source code package to determine the file information of each file of the first source code package; determining the package information of the first source code package; based on the compilation operation of the second source code package in the current software, traversing each file of the second source code package to determine the file information of each file of the second source code package; determining the package information of the second source code package.

[0008] According to a specific implementation of an embodiment of this application, the step of traversing each file of the first source code package and determining the file information of each file in the first source code package includes: traversing each file in the first source code package and determining the initial file information of the first file in the first source code package; determining whether the initial file information of the first file is missing first preset information; if the first preset information is missing, obtaining the first preset information from the first source code package; adding the first preset information to the corresponding position of the initial file information of the first file to generate the file information of the first file; if the first preset information is not missing, determining the initial file information of the first file as the file information of the first file.

[0009] According to a specific implementation of an embodiment of this application, determining the package information of the first source code package includes: determining the package information of the first source code package based on the compilation operation of the first source code package in the current software.

[0010] According to a specific implementation of an embodiment of this application, determining the package information of the first source code package includes: extracting the package information of the first source code package from the first source code package; and / or, determining the package information of the first source code package based on each file in the first source code package.

[0011] According to a specific implementation of an embodiment of this application, the step of extracting the package information of the first source code package from the first source code package includes: extracting the initial package information of the first source code package from the first source code package; determining whether the initial package information of the first source code package lacks second preset information; if the second preset information is missing, obtaining the second preset information according to a preset method; adding the second preset information to the corresponding position of the initial package information of the first source code package to generate the package information of the first source code package; if the second preset information is not missing, determining the initial package information of the first source code package as the package information of the first source code package.

[0012] According to a specific implementation of an embodiment of this application, the current software includes a first source code package and a second source code package; the package information of the first source code package also includes a dependency relationship between the first source code package and the second source code package; the first dependency relationship is determined according to the following steps: based on the compilation operation of the first source code package, it is determined that the first source code package depends on the second source code package; a dependency relationship between the first source code package and the second source code package is established.

[0013] According to a specific implementation of an embodiment of this application, the step of establishing material information for at least one superior material based on package information of at least one source code package includes: determining the functional category of each source code package; generating functional information of functional-level materials corresponding to the same functional category based on package information of source code packages belonging to the same functional category, and establishing a second membership relationship between the functional information and package information of source code packages belonging to the same functional category; wherein, the step of generating a bill of materials for the software based on file information of each file in each source code package, package information of each source code package, the first membership relationship, and material information of the at least one superior material includes: generating a bill of materials for the software based on file information of each file in each source code package, package information of each source code package, the first membership relationship, functional information of each functional-level material, and the second membership relationship.

[0014] According to a specific implementation of an embodiment of this application, the step of establishing material information for at least one superior material based on package information of at least one source code package includes: determining the functional category of each source code package; generating functional information of functional-level materials corresponding to the same functional category based on package information of source code packages belonging to the same functional category, and establishing a second membership relationship between the functional information and package information of source code packages belonging to the same functional category; aggregating at least two functional-level materials into a module-level material; generating module information of each module-level material, and establishing a third membership relationship between the module information and the functional information of each functional-level material aggregated into a module-level material corresponding to the module information; wherein, the step of generating a bill of materials for the software based on file information of each file in each source code package, package information of each source code package, the first membership relationship, and material information of the at least one superior material includes: generating a bill of materials for the software based on file information of each file in each source code package, package information of each source code package, the first membership relationship, functional information of each functional-level material, the second membership relationship, module information of the module-level material, and the third membership relationship.

[0015] According to a specific implementation of an embodiment of this application, the step of establishing material information for at least one superior material based on package information of at least one source code package includes: determining the functional category of each source code package; generating functional information of functional-level materials corresponding to the same functional category based on package information of source code packages belonging to the same functional category, and establishing a second membership relationship between the functional information and the package information of source code packages belonging to the same functional category; aggregating at least two functional-level materials into a module-level material; generating module information for each module-level material, and establishing a third membership relationship between the module information and the functional information of each functional-level material aggregated into a module-level material corresponding to the module information; aggregating at least two module-level materials into a system-level material; generating... The system information of system-level materials is generated, and a fourth hierarchical relationship is established between the system information and the module information of each module-level material aggregated into the system-level material corresponding to the system information; wherein, the step of generating the bill of materials for the software based on the file information of each file in each source code package, the package information of each source code package, the first hierarchical relationship, and the material information of at least one superior material includes: generating the bill of materials for the software based on the file information of each file in each source code package, the package information of each source code package, the first hierarchical relationship, the functional information of each functional-level material, the second hierarchical relationship, the module information of the module-level material, the third hierarchical relationship, the system information of the system-level material, and the fourth hierarchical relationship.

[0016] According to a specific implementation of an embodiment of this application, the step of establishing material information for at least one superior material based on package information of at least one source code package includes: determining the functional category of each source code package; generating functional information of functional-level materials corresponding to the same functional category based on package information of source code packages belonging to the same functional category, and establishing a second membership relationship between the functional information and package information of source code packages belonging to the same functional category; wherein, the step of generating a bill of materials for the software based on file information of each file in each source code package, package information of each source code package, the first membership relationship, and material information of the at least one superior material includes: generating a bill of materials for the software based on file information of each file in each source code package, package information of each source code package, the first membership relationship, functional information of each functional-level material, and the second membership relationship.

[0017] According to a specific implementation of an embodiment of this application, the step of establishing material information for at least one superior material based on package information of at least one source code package includes: determining the functional category of each source code package; generating functional information of functional-level materials corresponding to the same functional category based on package information of source code packages belonging to the same functional category, and establishing a second membership relationship between the functional information and the package information of source code packages belonging to the same functional category; aggregating at least two functional-level materials into a module-level material based on a first aggregation rule; generating module information for each module-level material, and establishing a relationship between the module information and the aggregated material. The module information corresponds to the functional information of each functional level material of the module-level material, which is a third hierarchical relationship; wherein, the step of generating the bill of materials for the software based on the file information of each file in each source code package, the package information of each source code package, the first hierarchical relationship, and the material information of at least one superior material includes: generating the bill of materials for the software based on the file information of each file in each source code package, the package information of each source code package, the first hierarchical relationship, the functional information of each functional level material, the second hierarchical relationship, the module information of the module-level material, and the third hierarchical relationship.

[0018] Secondly, embodiments of this application provide a software bill of materials (BOM) generation apparatus, comprising: a determiner, configured to determine file information of each file in each source code package of the current software and package information of each source code package; a first creator, configured to establish a first hierarchical relationship between the package information of each source code package and the file information of each file in the source code package; a second creator, configured to establish material information of at least one parent material based on the package information of at least one source code package; and a generator, configured to generate the software BOM based on the file information of each file in each source code package, the package information of each source code package, the first hierarchical relationship, and the material information of the at least one parent material.

[0019] According to a specific implementation of an embodiment of this application, the current software includes a first source code package and a second source code package; wherein, the determiner includes: a first determining sub-device, used to determine the file information of each file of the first source code package by traversing each file of the first source code package based on the compilation operation of the first source code package in the current software; a second determining sub-device, used to determine the package information of the first source code package; a third determining sub-device, used to determine the file information of each file of the second source code package by traversing each file of the second source code package based on the compilation operation of the second source code package in the current software; and a fourth determining sub-device, used to determine the package information of the second source code package.

[0020] According to a specific implementation of an embodiment of this application, the first determining sub-device is specifically configured to: traverse each file in the first source code package and determine the initial file information of the first file in the first source code package; determine whether the initial file information of the first file is missing first preset information; if the first preset information is missing, obtain the first preset information from the first source code package; add the first preset information to the corresponding position of the initial file information of the first file to generate the file information of the first file; if the first preset information is not missing, determine the initial file information of the first file as the file information of the first file.

[0021] According to a specific implementation of an embodiment of this application, the second determining sub-device includes: a determining unit, configured to determine the package information of the first source code package based on the compilation operation of the first source code package in the current software.

[0022] According to a specific implementation of an embodiment of this application, the determining unit includes: an extraction subunit, configured to extract package information of the first source code package from the first source code package; and / or a determining subunit, configured to determine the package information of the first source code package based on each file in the first source code package.

[0023] According to a specific implementation of an embodiment of this application, the extraction subunit is specifically configured to: extract initial package information of the first source code package from the first source code package; determine whether the initial package information of the first source code package lacks second preset information; if the second preset information is lacking, obtain the second preset information according to a preset method; add the second preset information to the corresponding position of the initial package information of the first source code package to generate package information of the first source code package; if the second preset information is not lacking, determine the initial package information of the first source code package as the package information of the first source code package.

[0024] According to a specific implementation of an embodiment of this application, the current software includes a first source code package and a second source code package; the package information of the first source code package also includes a dependency relationship between the first source code package and the second source code package; the device is further configured to determine the first dependency relationship, specifically configured to: determine that the first source code package depends on the second source code package based on the compilation operation of the first source code package; and establish a dependency relationship between the first source code package and the second source code package.

[0025] According to a specific implementation of an embodiment of this application, the second generator is specifically used for: determining the functional category of each source code package; generating functional information of functional-level materials corresponding to the same functional category based on the package information of source code packages belonging to the same functional category, and establishing a second membership relationship between the functional information and the package information of source code packages belonging to the same functional category; wherein, generating the bill of materials for the software based on the file information of each file in each source code package, the package information of each source code package, the first membership relationship, and the material information of at least one superior material includes: generating the bill of materials for the software based on the file information of each file in each source code package, the package information of each source code package, the first membership relationship, the functional information of each functional-level material, and the second membership relationship.

[0026] According to a specific implementation of an embodiment of this application, the second creator is specifically used for: determining the functional category of each source code package; generating functional information of functional-level materials corresponding to the same functional category based on the package information of source code packages belonging to the same functional category, and establishing a second membership relationship between the functional information and the package information of source code packages belonging to the same functional category; aggregating at least two functional-level materials into a module-level material; generating module information of each module-level material, and establishing a third membership relationship between the module information and the functional information of each functional-level material aggregated into a module-level material corresponding to the module information; wherein, generating the bill of materials for the software based on the file information of each file in each source code package, the package information of each source code package, the first membership relationship, and the material information of the at least one superior material includes: generating the bill of materials for the software based on the file information of each file in each source code package, the package information of each source code package, the first membership relationship, the functional information of each functional-level material, the second membership relationship, the module information of the module-level material, and the third membership relationship.

[0027] According to a specific implementation of an embodiment of this application, the second generator is specifically configured to: determine the functional category of each source code package; based on the package information of source code packages belonging to the same functional category, generate functional information of functional-level materials corresponding to the same functional category, and establish a second membership relationship between the functional information and the package information of source code packages belonging to the same functional category; aggregate at least two functional-level materials into a module-level material; generate module information of each module-level material, and establish a third membership relationship between the module information and the functional information of each functional-level material aggregated into a module-level material corresponding to the module information; aggregate at least two module-level materials into a system-level material; generate system information of the system-level material. The system establishes a fourth hierarchical relationship between system information and module information of each module-level material aggregated into system-level material corresponding to the system information; wherein, generating the bill of materials for the software based on file information of each file in each source code package, package information of each source code package, the first hierarchical relationship, and material information of at least one superior material includes: generating the bill of materials for the software based on file information of each file in each source code package, package information of each source code package, the first hierarchical relationship, functional information of each functional-level material, the second hierarchical relationship, module information of the module-level material, the third hierarchical relationship, system information of the system-level material, and the fourth hierarchical relationship.

[0028] Thirdly, embodiments of this application provide an electronic device, the electronic device comprising: a housing, a processor, a memory, a circuit board, and a power supply circuit, wherein the circuit board is disposed within the space enclosed by the housing, and the processor and the memory are disposed on the circuit board; the power supply circuit is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory is used to store executable program code; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, for executing the bill of materials generation method of the software described in any of the foregoing implementations.

[0029] Fourthly, embodiments of this application provide a computer-readable storage medium storing one or more programs, which can be executed by one or more processors to implement the bill of materials generation method of the software described in any of the foregoing implementations.

[0030] The software bill of materials (BOM) generation method, apparatus, electronic device, and readable storage medium of this embodiment determine the file information of each file in each source code package of the current software and the package information of each source code package, establish a first hierarchical relationship between the package information of each source code package and the file information of each file in the source code package, establish the material information of at least one superior material based on the package information of at least one source code package, and generate the software BOM based on the file information of each file in each source code package, the package information of each source code package, the first hierarchical relationship, and the material information of at least one superior material. In this way, the software BOM can be automatically generated, effectively improving the generation efficiency of the software BOM, and the BOM is generated in a forward manner from the file of the source code package to the target level, with complete and sufficient information. Attached Figure Description

[0031] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0032] Figure 1 A flowchart illustrating a method for generating a bill of materials using software provided in an embodiment of this application;

[0033] Figure 2 A flowchart illustrating a method for generating a bill of materials for software provided in a specific embodiment of this application;

[0034] Figure 3 A schematic diagram of the structure of a bill of materials generation apparatus for software provided in an embodiment of this application;

[0035] Figure 4 A schematic diagram of the structure of a bill of materials generation apparatus for software provided in another embodiment of this application;

[0036] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0037] The embodiments of this application will now be described in detail with reference to the accompanying drawings. It should be understood that the described embodiments are merely some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0038] To enable those skilled in the art to better understand the technical concept, implementation scheme and beneficial effects of the embodiments of this application, detailed descriptions are provided below through specific embodiments.

[0039] An embodiment of this application provides a method for generating a software bill of materials, which can effectively improve the efficiency of generating the software bill of materials, and generates the bill of materials layer by layer from the source code package files to the target level, with complete and sufficient information.

[0040] Figure 1 A flowchart illustrating a method for generating a bill of materials using software provided in an embodiment of this application is shown below. Figure 1 As shown, the bill of materials generation method of the software in this embodiment may include:

[0041] S101. Determine the file information of each file in each source code package in the current software, as well as the package information of each source code package.

[0042] Source code can refer to the current software's source code, i.e., the uncompiled code. Compiling the source code package yields modules with corresponding functionalities.

[0043] The software in this embodiment can be operating system software or application software installed on the operating system.

[0044] For ease of explanation, the current software in this embodiment is described using operating system software as an example. The source code packages of the operating system software may include kernel source code packages, application source code packages, graphics display source code packages, etc.; compiling the source code packages of the operating system software yields corresponding executable files and / or databases.

[0045] Each source package includes at least one file.

[0046] For operating system software, in some cases, the files in the source package may be arena.c, dynarray.h, crypt.c, crypt.h, etc.

[0047] Compiling the source code package can yield executable files or databases.

[0048] For each file in each source package, the generated file information can include the file information of the source file, or it can include the information of the compilation result obtained by compiling the source file, such as executable files, library files, or folders.

[0049] File information includes the file name, the MD5 hash of the file content, the copyright ownership of the file, the applicable agreement and / or license certificate. The MD5 hash of the file content is a hash function used to protect the integrity of the file content. Taking the file content as input, a hash algorithm is used to calculate a fixed-length piece of information, which is the MD5 hash of the file content.

[0050] The package information includes the package name, the MD5 hash of the package content, the copyright ownership of the package, the protocol and / or the package license certificate. The MD5 hash of the package content is a hash function used to protect the integrity of the package content.

[0051] In some examples, the package information for each source code package may include the package name, the MD5 hash of the package content, the copyright of the package, the protocol and / or the package license certificate that the package complies with, and the MD5 hash of the package content can be determined based on the file information of each file in the source code package.

[0052] The MD5 hash of the packet content can be determined from each file. Specifically, each file can be taken as a large file as input, and a hash algorithm can be used to calculate a fixed-length piece of information, which is the MD5 hash of the packet content.

[0053] S102. Establish the first hierarchical relationship between the package information of each source code package and the file information of each file in the source code package.

[0054] If source code package 1 includes file 1, file 2 and file 3, then establish the hierarchical relationship between package information 1 of source code package 1 and file information 1 of file 1, file information 2 of file 2 and file information 3 of file 3, that is, file information 1, file information 2 and file information 3 belong to package information 1.

[0055] The process of determining the affiliation between package information and file information in other source code packages is the same as the above process.

[0056] S103. Based on the package information of at least one source code package, establish the material information of at least one superior material.

[0057] In this embodiment, the material information of at least one parent material can be the material information of the parent material of the source code package. Here, material refers to the element that constitutes the software bill of materials. In some examples, the parent material of the source code package includes functional materials, module-level materials and / or system-level materials.

[0058] Material information can be descriptive information about the material.

[0059] S104. Based on the file information of each file in each source code package, the package information of each source code package, the first membership relationship, and the material information of at least one parent material, generate the software's bill of materials.

[0060] The file information of each file in each source code package, the package information of each source code package, the first hierarchy, and the material information of at least one parent material can be written into a file such as Excel to form a bill of materials. A graphical user interface can also be created using the file information of each file in each source code package, the package information of each source code package, the first hierarchy, and the material information of at least one parent material, and the information can be expanded or collapsed.

[0061] In this embodiment, by determining the file information of each file in each source code package of the current software and the package information of each source code package, a first hierarchical relationship is established between the package information of each source code package and the file information of each file in that source code package. Based on the package information of at least one source code package, the material information of at least one superior material is established. Based on the file information of each file in each source code package, the package information of each source code package, the first hierarchical relationship, and the material information of at least one superior material, the software's bill of materials is generated. In this way, the software bill of materials can be automatically generated, effectively improving the generation efficiency of the software bill of materials and avoiding the problem of low generation efficiency caused by manually filling in the relevant information of the software bill of materials in the prior art. In addition, in this embodiment, information is obtained from the files in the source code package to the source code package and then to at least one superior material, and the software bill of materials is generated in a progressive and forward manner, resulting in accurate, complete, and sufficient information.

[0062] In some examples, the current software includes a first source code package and a second source code package; to save computing resources, the process of determining the file information of each file in each source code package and the package information of each source code package in this embodiment (S101) includes:

[0063] S101a. Based on the compilation operation of the first source code package in the current software, traverse each file of the first source code package to determine the file information of each file in the first source code package.

[0064] By compiling the first source code package, a binary file that can be recognized by a computer can be generated.

[0065] During the compilation of the first source code package, each file in the package is traversed and compiled. In this embodiment, the file information of each file in the first source code package is determined during the compilation process, while traversing each file. That is, the determination of the file information of each file in the first source code package is performed simultaneously with the compilation operation, which saves computing resources.

[0066] When compiling source code, the compilation script and makefile will enter the root directory of each source package (tool), and then recursively enter its subdirectories, including every file at the lowest level, and start the compilation.

[0067] When compiling the current software, a compilation script is used to navigate to each source package, and then a Makefile is used to navigate to the root directory of the source package, thereby compiling the files in the root directory. A project, application software, or operating system software includes many source files, which can be placed in several directories according to type, function, and module. The Makefile defines a series of rules to specify which files need to be compiled first, which files need to be compiled later, which files need to be recompiled, and can also perform more complex functional operations.

[0068] In some examples, following the Makefile used during the compilation of the first source package, we can enter the root directory of the first source package of the current software, traverse the files under the root directory of the first source package, and further determine the file information of each file in the first source package. In some examples, the file information of each file can also be added to the database.

[0069] S101b, Determine the package information of the first source code package.

[0070] In some cases, the packet information is added to the packet information table in the database.

[0071] S101c: Based on the compilation operation of the second source code package in the current software, traverse each file of the second source code package to determine the file information of each file in the second source code package.

[0072] After compiling the first source code package, the directories and files of other packages or tools are traversed sequentially following the Makefile. In this embodiment, the process of traversing each file of the second source code package and determining the file information of each file of the second source code package based on the compilation operation of the second source code package in the current software is the same as the process of determining the file information of each file of the first source code package, and will not be described again here.

[0073] In some examples, the file information of each file in the determined second source package is added to the database along with the file information of each file in the first source package.

[0074] S101d: Determine the package information of the second source code package.

[0075] After compiling all the files in the second source package, return to the parent directory of the lowest-level file and generate package information for this directory. In some examples, the package information is added to the package information table in the database.

[0076] To facilitate the generation of a more complete software bill of materials, in some examples, the files in the first source code package are traversed to determine the file information of each file in the first source code package, including:

[0077] A1. Traverse each file in the first source code package to determine the initial file information of the first file in the first source code package.

[0078] The first file in this embodiment can be a file in the first source code package.

[0079] In some cases, initial file information may include the file name, the MD5 hash of the file content, the copyright ownership of the file, the agreement the file complies with, and / or the file license certificate.

[0080] A2. Determine whether the initial file information of the first file is missing the first preset information.

[0081] In some examples, the first preset information may include the file name, the copyright of the file, the agreement the file complies with, and / or the file license certificate.

[0082] For example, if the initial file information of the first file includes the file name, the MD5 hash of the file content, and the copyright ownership of the file, while the file information of the first file is required to include the file name, the MD5 hash of the file content, the copyright ownership of the file, and the license that the file conforms to, then it is determined that the initial file information of the first file in the first source code package is missing the license that the file conforms to.

[0083] A3. If the first preset information is missing, then obtain the first preset information from the first source code package.

[0084] If the initial file information of the first file in the first source code package is missing the first preset information, then the first preset information is obtained from the first source code package. It can be understood that the first source code package includes the first preset information.

[0085] Typically, among the multiple files included in the first source code package, some files include the first preset information, while others do not. The first source code package includes the first preset information upon which these files are based. Therefore, if a file lacks the first preset information, it can be obtained from the first source code package.

[0086] A4. Add the first preset information to the corresponding position in the initial file information of the first file to generate the file information of the first file.

[0087] After obtaining the first preset information from the first source code package, the first preset information can be added to the corresponding position of the initial file information of the first file, thereby generating the file information of the first file.

[0088] A5. If the first preset information is not missing, then the initial file information of the first file is determined as the file information of the first file.

[0089] In this embodiment, each file in the first source code package is traversed to determine the initial file information of the first file in the first source code package. It is then determined whether the initial file information of the first file is missing first preset information. If the first preset information is missing, the first preset information is obtained from the first source code package and added to the corresponding position of the initial file information of the first file to generate the file information of the first file. If the first preset information is not missing, it means that the initial file information of the first file is the complete file information of the first file. In this way, a relatively complete file information of the first file can be obtained, which further facilitates the obtaining of a relatively complete software bill of materials.

[0090] If the first preset information is not missing, then the initial file information of the first file is determined as the file information of the first file.

[0091] In some examples, determining the package information of the first source package (S101b) includes:

[0092] B1. Based on the compilation operation of the first source code package in the current software, determine the package information of the first source code package.

[0093] In this embodiment, after compiling each file in the first source code package, the compilation process returns to the parent directory of the lowest-level file and generates the package information of the first source code package for this directory.

[0094] In some examples, determining the package information (B1) of the first source package includes:

[0095] B11. Extract the package information of the first source code package from the first source code package.

[0096] The package information is the package name, copyright ownership, protocol and / or license certificate of the first source code package extracted from the first source code package.

[0097] B12. Determine the package information of the first source code package based on the files in the first source code package.

[0098] Determine the MD5 hash of the first source code package based on the files in the first source code package.

[0099] To facilitate the generation of a more complete software bill of materials, in some examples, the package information (B11) of the first source code package is extracted, including:

[0100] B11a. Extract the initial package information of the first source package from the first source package.

[0101] The initial package information extracted from the first source package includes the package name, the copyright of the package, the protocol and / or the package license certificate that the package conforms to.

[0102] B11b. Determine whether the initial package information of the first source code package is missing the second preset information.

[0103] In some examples, the second preset information may include the package name, the copyright of the package, the agreement the package complies with, and / or the package license certificate.

[0104] For example, if the initial package information of the first source package includes the package name and the copyright of the package, but the package information of the first source package is required to include the package name, the copyright of the package, and the license that the package conforms to, then it is determined that the initial package information of the first source package is missing the license that the package conforms to.

[0105] B11c. If the second preset information is missing, the second preset information shall be obtained according to the preset method.

[0106] In this embodiment, the preset method can be to download the first preset information from the download address.

[0107] In some cases, the download address of the first source code package is determined based on the correspondence between the source code package and the download address.

[0108] If the initial package information of the first source code package lacks the second preset information, the download address of the first source code package is determined according to the correspondence between the source code package and the download address. The download address of the first source code package is the address from which the first source code package is downloaded.

[0109] Obtain the second preset information based on the download address of the first source code package.

[0110] B11d. Add the second preset information to the corresponding position in the initial package information of the first source code package to generate the package information of the first source code package.

[0111] After obtaining the second preset information, the second preset information can be added to the corresponding position of the initial package information of the first source code package to form the package information of the first source code package.

[0112] B11e If the second preset information is not missing, the initial package information of the first source code package is determined as the package information of the first source code package.

[0113] In this embodiment, by extracting the initial package information of the first source code package from the first source code package, it is determined whether the initial package information of the first source code package is missing second preset information. If the second preset information is missing, the second preset information is obtained according to a preset method and added to the corresponding position of the initial package information of the first source code package to generate the package information of the first source code package. If the second preset information is not missing, the initial package information of the first source code package is determined as the package information of the first source code package. In this way, when the initial package information of the first source code package is incomplete, the second preset information can be obtained according to a preset method to obtain a more complete package information of the first source code package. If the second preset information is not missing, it means that the initial package information of the first source code package is relatively complete information, which facilitates obtaining a more complete software bill of materials.

[0114] To facilitate the generation of a more complete software bill of materials, in some examples, the current software includes a first source code package and a second source code package; the package information of the first source code package also includes the dependency relationship between the first source code package and the second source code package; the first dependency relationship is determined according to the following steps:

[0115] C1. Based on the compilation operation of the first source code package, it is determined that the first source code package depends on the second source code package.

[0116] In some cases, during the compilation of the first source package in the current software, it can be determined that the first source package includes the second source package, that is, the first source package depends on the second source package.

[0117] C2. Establish the dependency relationship between the first source code package and the second source code package.

[0118] After determining that the first source package depends on the second source package, establish the dependency relationship between the first source package and the second source package.

[0119] Current software source files can be divided hierarchically by function, module, and system. When creating a software bill of materials (BOM) that includes files, source code packages, and functions, to ensure the completeness of the BOM information, in some examples, based on the package information of at least one source code package, material information for at least one parent material is created, including:

[0120] D1. Determine the functional category of each source code package.

[0121] The functional categories of the source code packages in the corresponding operating system software can be divided into categories such as office software, games, and web browsing software.

[0122] For each source code package in an application software installed on an operating system, the functional category of each source code package can be determined according to the specific functions of the application software.

[0123] D2. Based on the package information of source code packages belonging to the same functional category, generate functional information of functional-level materials corresponding to the same functional category, and establish a second membership relationship between the functional information and the package information of source code packages belonging to the same functional category.

[0124] The package information of source code packages belonging to the same category can be used to generate functional information of a functional-level material corresponding to that functional category. The functional information can be descriptive information of the functional-level material, such as the name of the functional-level material, the MD5 hash of the content of the functional-level material, the copyright of the functional-level material, the agreement that the functional-level material complies with, and / or the license certificate of the functional-level material.

[0125] Establish a second affiliation relationship between the package information of source code packages belonging to the same functional category and the functional information of that functional category, that is, the package information of source code packages belonging to the same functional category belongs to the functional information of that functional category.

[0126] In this embodiment, the software bill of materials (S104) is generated based on the file information of each file in each source code package, the package information of each source code package, the first membership relationship, and the material information of at least one parent material. This may include:

[0127] S104a. Based on the file information of each file in each source code package, the package information of each source code package, the first membership relationship, and the functional information and second membership relationship of each functional material, generate the bill of materials for the software.

[0128] In this embodiment, the software bill of materials is generated based on the file information of each file in each source code package, the package information of each source code package, the first membership relationship, and the functional information and second membership relationship of each functional-level material. Thus, the software bill of materials not only includes the file information of each file, the package information of each source code package, and the first membership relationship, but also the functional information of each functional-level material, as well as the second membership relationship between the functional information and the package information of the source code package belonging to the same functional category. Therefore, the software physical list information generated for the current software is more complete.

[0129] When the current software includes a bill of materials (BOM) structured at levels such as files, source code packages, functions, and modules, to ensure the completeness of the BOM information, in some examples, based on the package information of at least one source code package, the BOM information of at least one parent material is established. This may include:

[0130] E1. Determine the functional category of each source code package.

[0131] This step has the same technical features as the above embodiment D1, and you can refer to the discussion in D1 for details.

[0132] E2. Based on the package information of source code packages belonging to the same functional category, generate functional information of functional-level materials corresponding to the same functional category, and establish a second membership relationship between the functional information and the package information of source code packages belonging to the same functional category.

[0133] This step has the same technical features as embodiment D2 above, and you can refer to the discussion in D2 for details.

[0134] E3. Aggregate at least two functional-level materials into a module-level material.

[0135] In some cases, the current software is an operating system, under which functional-level materials can be aggregated into a module-level material according to their purpose.

[0136] E4. Generate module information for each module-level material, and establish a third hierarchical relationship between the module information and the functional information of each functional-level material aggregated into the module-level material corresponding to that module information.

[0137] Module information describes the materials at the module level.

[0138] Establish a third membership relationship between the module information of a module-level material and the functional information of each functional-level material belonging to the same module-level material.

[0139] In this embodiment, the software bill of materials (S104) is generated based on the file information of each file in each source code package, the package information of each source code package, the first hierarchical relationship, and the material information of the at least one superior material. This may include:

[0140] S104b: Based on the file information of each file in each source code package, the package information of each source code package, the first membership relationship, the functional information of each functional-level material, the second membership relationship, the module information of the module-level material, and the third membership relationship, generate the software's bill of materials.

[0141] In this embodiment, the software's bill of materials (BOM) is generated based on the file information of each file in each source code package, the package information of each source code package, the first hierarchical relationship, and the material information of at least one superior material. Thus, the software's BOM includes not only the file information of each file, the package information of each source code package, and the first hierarchical relationship, but also the functional information of each functional-level material, the second hierarchical relationship between the functional information and the package information of the source code package belonging to the same functional category, and the third hierarchical relationship between the module information and the functional information of each functional-level material aggregated into a module-level material corresponding to the module information. Therefore, the software physical inventory information generated for the current software is more complete.

[0142] When the current software includes a bill of materials (BOM) structured at levels such as files, source code packages, functions, modules, and systems, to ensure the completeness of the BOM information, in some examples, based on the package information of at least one source code package, the BOM information of at least one parent material is established. This may include:

[0143] F1. Determine the functional category of each source code package.

[0144] This step has the same technical features as the above embodiments D1 or E1, and you can refer to the discussion in D1 or E1 for details.

[0145] F2. Based on the package information of source code packages belonging to the same functional category, generate functional information of functional-level materials corresponding to the same functional category, and establish a second membership relationship between the functional information and the package information of source code packages belonging to the same functional category.

[0146] This step has the same technical features as the above embodiments D2 or E2, and you can refer to the discussion in D2 or E2 for details.

[0147] F3. Aggregate at least two functional-level materials into a module-level material.

[0148] This step has the same technical features as the above embodiment E3, and you can refer to the discussion in E3 for details.

[0149] F4. Generate module information for each module-level material, and establish a third hierarchical relationship between the module information and the functional information of each functional-level material aggregated into the module-level material corresponding to that module information.

[0150] This step has the same technical features as the above embodiment E4, and you can refer to the discussion in E4 for details.

[0151] F5. Aggregate at least two module-level materials into a system-level material.

[0152] In this embodiment, the system level can be the highest level in the current software architecture.

[0153] In this embodiment, at least two module-level materials can be aggregated into a system-level material.

[0154] F6. Generate system information for system-level materials and establish a fourth membership relationship between the system information and the module information of each module-level material aggregated into the system-level material corresponding to this system information.

[0155] System information can be information describing system-level materials.

[0156] Establish a fourth membership relationship between the system information of system-level materials and the module information of each module-level material belonging to that system-level material.

[0157] In this embodiment, the software bill of materials (S104) is generated based on the file information of each file in each source code package, the package information of each source code package, the first membership relationship, and the material information of at least one parent material. This may include:

[0158] 104c. Based on the file information of each file in each source code package, the package information of each source code package, the first membership relationship, the functional information of each functional-level material, the second membership relationship, the module information of the module-level material, the third membership relationship, the system information of the system-level material, and the fourth membership relationship, generate the software's bill of materials.

[0159] In this embodiment, the software's bill of materials (BOM) is generated based on the file information of each file in each source code package, the package information of each source code package, the first hierarchical relationship, the functional information of each functional-level material, the second hierarchical relationship, the module information of the module-level material, the third hierarchical relationship, the system information of the system-level material, and the fourth hierarchical relationship. Thus, the software's BOM includes not only the file information of each file, the package information of each source code package, the first hierarchical relationship, the functional information of each functional-level material, and the second hierarchical relationship between the functional information and the package information of the source code package belonging to the same functional category, but also module information and the functional information of each functional-level material aggregated into module-level materials corresponding to that module information. The third hierarchical relationship between information, and the fourth hierarchical relationship between system information of system-level materials and module information of each module-level material aggregated into system-level material corresponding to the system information, make the software physical bill of materials information generated by the current software more complete. In addition, the bill of materials generated by this embodiment includes information at all levels such as file information, source code package information, functional material information, module-level material information and system-level information, as well as the hierarchical relationships between each level. The generated software bill of materials has finer granularity, clearer hierarchical structure and better user experience, avoiding the problem of coarse granularity and poor user experience caused by the bill of materials generated in the prior art that only has file information, package information and system-level information.

[0160] After generating the material information for the software, in order to flexibly meet user needs and improve user experience, in some examples, the method for generating the bill of materials for the software may further include:

[0161] In response to the bill of materials display command, display the software's bill of materials.

[0162] In response to the bill of materials display command, it can be displayed to the user in different styles such as tree structure diagrams, bar charts, etc.

[0163] The generated software bill of materials can be stored in different formats.

[0164] Users can manipulate the displayed list of materials according to their own needs, such as choosing to display or collapse a certain level of content.

[0165] The following section uses the current software as an operating system to provide a detailed explanation of the solution proposed in this application.

[0166] An operating system may include at least one subsystem (module), each subsystem includes at least one function, each function includes at least one source code package, and each source code package includes at least one file.

[0167] When compiling source code, the compilation script and makefile will enter the root directory of each source package or tool, and then recursively enter its subdirectories, including every file at the lowest level, and start the compilation.

[0168] See Figure 2 The physical inventory generation method for software in this embodiment may include:

[0169] (1) Follow the makefile to traverse all files under the source code package glibc, such as arena.c, dynarray.h, etc., and generate a corresponding file information table. This information table includes the file name, MD5 hash of the file content, copyright of the file, and the agreement and / or license certificate that the file conforms to.

[0170] (2) Generate package information for the source package glibc, and establish the membership relationship information between the files in the source package and the source package, and store them in the file table, package table and relationship table of the database in sequence.

[0171] (3) Follow the makefile to enter all files under the source package gzip, such as crypt.c, crypt.h, etc., and generate a corresponding file information table. This information table includes the file name of each file, the MD5 hash of the file content, the copyright of the file, the agreement and / or the license certificate that the file complies with.

[0172] (4) Generate package information for the source package using gzip and establish the relationship information between the files in the source package and the source package, and store them in the file table, package table and relationship table of the database in sequence.

[0173] (5) Follow the makefile to enter the root directory of other source packages or tools in turn, obtain file information, source package information, and the relationship between file information and source package information, and store them in the database.

[0174] (6) Once all source code packages are completed, functional information for functional-level materials is generated according to the category of the source code packages and stored in the functional information table; and the functional information of functional-level materials and their affiliation with the source code packages are generated and stored in the relationship table. For example, source code packages glibc, gzip, and other source code packages belong to the functional-level CLIO, while other source code packages belong to the functional-level GUI, and other source code packages are correspondingly classified into other functional levels.

[0175] Specifically, the correspondence between source code packages and categories can be used to determine which category a source code package belongs to, and thus which functional level it belongs to.

[0176] (7) Based on the functional information table, construct the module-level information table of the subsystem (module) level materials and store it in the software information table.

[0177] For example, the functional level CLIO, functional level GUI, and other functional levels belong to the module level PPS, while other functional levels belong to the module level CCA, and other functional packages are correspondingly classified into other module levels.

[0178] In one example, the operating system includes a low-level subsystem 1, an application-related subsystem 2, and a cloud-related subsystem 3.

[0179] Based on the information of the functional-level material, it can be determined which subsystem (subsystem 1, subsystem 2, or subsystem 3) the functional-level material belongs to. After determination, the affiliation relationship between the functional-level material information and the subsystem information can be constructed.

[0180] (8) Generate a system-level information table for the functional information table of subsystem-level materials and store it in the list information table of the database.

[0181] Each subsystem (module) belongs to the system level.

[0182] For example, module-level PPS, module-level CCA, and other module-level modules belong to the system level.

[0183] (9) Generate the final Software Bill of Materials (SBOM) based on all the above information tables.

[0184] In this embodiment, during the source code compilation stage, the process proceeds layer by layer from the source code files in the source code package to the target, generating the SBOM from the bottom up for each file, from the file to the package, from the package to the functional block, from the functional block to the subsystem, and from the subsystem to the complete system. This completely forward process ensures the integrity and accuracy of the information, and the hierarchical structure is clear. The forward generation of the SBOM results in accurate, complete, and sufficient information, avoiding the problems of incomplete information extraction and potential loss of much key information that occur in existing technologies where the information listed in the package management tool is parsed and relevant content is filled in to generate the SBOM through software.

[0185] The software bill of materials generation apparatus provided in one embodiment of this application effectively improves the generation efficiency of the software bill of materials, and generates the bill of materials layer by layer from the source code package files to the target level, with complete and sufficient information.

[0186] Figure 3 A schematic diagram of the structure of a bill of materials generation apparatus for software provided in an embodiment of this application is shown below. Figure 3 As shown, the software bill of materials generation apparatus of this embodiment includes: a determiner 11, used to determine the file information of each file in each source code package of the current software and the package information of each source code package; a first creator 12, used to establish a first hierarchical relationship between the package information of each source code package and the file information of each file in the source code package; a second creator 13, used to establish the material information of at least one superior material based on the package information of at least one source code package; and a generator 14, used to generate the bill of materials of the software based on the file information of each file in each source code package, the package information of each source code package, the first hierarchical relationship, and the material information of the at least one superior material.

[0187] The apparatus of this embodiment can be used to perform Figure 1 The technical solutions of the method embodiments shown are similar in principle and in effect, and will not be described again here.

[0188] The apparatus of this embodiment determines the file information of each file in each source code package of the current software and the package information of each source code package, establishes a first hierarchical relationship between the package information of each source code package and the file information of each file in the source code package, establishes the material information of at least one superior material based on the package information of at least one source code package, and generates a software bill of materials based on the file information of each file in each source code package, the package information of each source code package, the first hierarchical relationship, and the material information of at least one superior material. In this way, the software bill of materials can be automatically generated, effectively improving the generation efficiency of the software bill of materials and avoiding the problem of low generation efficiency caused by manually filling in the relevant information of the software bill of materials in the prior art. In addition, in this embodiment, information is obtained from the files in the source code package to the source code package and then to the at least one superior material, and the software bill of materials is generated in a progressive and forward manner, so that the generated information is accurate, complete and sufficient.

[0189] As an optional implementation, the current software includes a first source code package and a second source code package; wherein, the determiner includes: a first determining sub-unit, used to traverse each file of the first source code package based on the compilation operation of the first source code package in the current software, and determine the file information of each file of the first source code package; a second determining sub-unit, used to determine the package information of the first source code package; a third determining sub-unit, used to traverse each file of the second source code package based on the compilation operation of the second source code package in the current software, and determine the file information of each file of the second source code package; and a fourth determining sub-unit, used to determine the package information of the second source code package.

[0190] As an optional implementation, the first determining sub-device is specifically configured to: traverse each file in the first source code package and determine the initial file information of the first file in the first source code package; determine whether the initial file information of the first file is missing first preset information; if the first preset information is missing, obtain the first preset information from the first source code package; add the first preset information to the corresponding position of the initial file information of the first file to generate the file information of the first file; if the first preset information is not missing, determine the initial file information of the first file as the file information of the first file.

[0191] As an optional implementation, the second determining sub-device includes: a determining unit, configured to determine package information of the first source code package based on the compilation operation of the first source code package in the current software.

[0192] As an optional implementation, the determining unit includes: an extraction subunit, configured to extract package information of the first source code package from the first source code package; and / or a determining subunit, configured to determine the package information of the first source code package based on each file in the first source code package.

[0193] As an optional implementation, the extraction subunit is specifically used for: extracting the initial package information of the first source code package from the first source code package; determining whether the initial package information of the first source code package lacks second preset information; if the second preset information is lacking, obtaining the second preset information according to a preset method; adding the second preset information to the corresponding position of the initial package information of the first source code package to generate the package information of the first source code package; if the second preset information is not lacking, determining the initial package information of the first source code package as the package information of the first source code package.

[0194] As an optional implementation, the current software includes a first source code package and a second source code package; the package information of the first source code package also includes a dependency relationship between the first source code package and the second source code package; the device is further configured to determine the first dependency relationship, specifically configured to: determine that the first source code package depends on the second source code package based on the compilation operation of the first source code package; and establish a dependency relationship between the first source code package and the second source code package.

[0195] As an optional implementation, the second creator is specifically used for: determining the functional category of each source code package; generating functional information of functional-level materials corresponding to the same functional category based on the package information of source code packages belonging to the same functional category, and establishing a second membership relationship between the functional information and the package information of source code packages belonging to the same functional category; wherein, generating the bill of materials for the software based on the file information of each file in each source code package, the package information of each source code package, the first membership relationship, and the material information of the at least one superior material includes: generating the bill of materials for the software based on the file information of each file in each source code package, the package information of each source code package, the first membership relationship, and the functional information and the second membership relationship of each functional-level material.

[0196] As an optional implementation, the second creator is specifically used for: determining the functional category of each source code package; generating functional information of functional-level materials corresponding to the same functional category based on the package information of source code packages belonging to the same functional category, and establishing a second membership relationship between the functional information and the package information of source code packages belonging to the same functional category; aggregating at least two functional-level materials into a module-level material; generating module information of each module-level material, and establishing a third membership relationship between the module information and the functional information of each functional-level material aggregated into a module-level material corresponding to the module information; wherein, generating the bill of materials for the software based on the file information of each file in each source code package, the package information of each source code package, the first membership relationship, and the material information of the at least one superior material includes: generating the bill of materials for the software based on the file information of each file in each source code package, the package information of each source code package, the first membership relationship, the functional information of each functional-level material, the second membership relationship, the module information of the module-level material, and the third membership relationship.

[0197] As an optional implementation, the second generator is specifically configured to: determine the functional category of each source code package; based on the package information of source code packages belonging to the same functional category, generate functional information of functional-level materials corresponding to the same functional category, and establish a second membership relationship between the functional information and the package information of source code packages belonging to the same functional category; aggregate at least two functional-level materials into a module-level material; generate module information of each module-level material, and establish a third membership relationship between the module information and the functional information of each functional-level material aggregated into a module-level material corresponding to the module information; aggregate at least two module-level materials into a system-level material; generate system information of the system-level material, and establish... The system information is aggregated into a fourth hierarchical relationship between the module information of each module-level material corresponding to the system-level material; wherein, the step of generating the bill of materials for the software based on the file information of each file in each source code package, the package information of each source code package, the first hierarchical relationship, and the material information of the at least one superior material includes: generating the bill of materials for the software based on the file information of each file in each source code package, the package information of each source code package, the first hierarchical relationship, the functional information of each functional-level material, the second hierarchical relationship, the module information of the module-level material, the third hierarchical relationship, the system information of the system-level material, and the fourth hierarchical relationship.

[0198] As an optional implementation, the apparatus further includes a displayer for displaying the bill of materials of the software in response to a bill of materials display instruction.

[0199] The apparatus described in the above embodiments can be used to execute the technical solutions of the above method embodiments. The implementation principle and technical effects are similar, and will not be repeated here.

[0200] The following describes the solution of this application in detail using a specific implementation method as an example.

[0201] See Figure 4 The physical inventory generation device for the software in this embodiment may include:

[0202] Information Extractor 21: Extracts the SBOM information of the source code package and each file contained therein.

[0203] Integrity Detector 22: Checks whether the information required by the file SBOM and the source package SBOM is present.

[0204] Information Completer 23: Automatically completes missing information if any is missing.

[0205] Missing information can be completed through methods such as searching the external network or the internal network. Specifically, the missing information can be determined from the source code package corresponding to the file. For files missing from the source code package, the missing information can be determined based on the download address.

[0206] Low-level generator 24: Generates database information corresponding to file-level and package-level SBOMs.

[0207] Function Classifier 25: categorizes each source code package into its corresponding function, such as: compiler, tool, application, etc. Generates the database information corresponding to the function-level SBOM.

[0208] Function Aggregator 26: Aggregates various functions into corresponding modules, such as PPS, CCA, ODC, or SDS. Generates the database information corresponding to the module-level SBOM.

[0209] Module Aggregator 27: Unifies and aggregates various modules into the system. Generates the database information corresponding to the system-level SBOM.

[0210] Summary Generator 28: Summarizes SBOM information at various levels and layers, and generates the final SBOM file according to the display format required by the user.

[0211] Although the names of the specific components included in the physical inventory generation device of the software in this embodiment are different from the names of the components in the device of the previous embodiment, it is understood that the principle of the overall technical solution of this embodiment is the same as the principle of the overall technical solution of the previous embodiment.

[0212] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application, as shown below. Figure 5 As shown, the device may include: a housing 61, a processor 62, a memory 63, a circuit board 64, and a power supply circuit 65. The circuit board 64 is disposed inside the space enclosed by the housing 61, and the processor 62 and the memory 63 are disposed on the circuit board 64. The power supply circuit 65 is used to supply power to the various circuits or devices of the above-mentioned electronic device. The memory 63 is used to store executable program code. The processor 62 runs the program corresponding to the executable program code by reading the executable program code stored in the memory 63, and is used to execute the bill of materials generation method of any of the software provided in the foregoing embodiments. Therefore, it can also achieve the corresponding beneficial technical effects, which have been described in detail above and will not be repeated here.

[0213] The aforementioned electronic devices exist in various forms, including but not limited to:

[0214] (1) Mobile communication devices: These devices are characterized by their mobile communication capabilities and primarily aim to provide voice and data communication. These terminals include: smartphones (e.g., iPhones), multimedia phones, feature phones, and low-end phones, etc.

[0215] (2) Ultra-mobile personal computer devices: These devices fall under the category of personal computers, possessing computing and processing capabilities, and generally also have mobile internet access features. These terminals include PDAs, MIDs, and UMPCs, such as the iPad.

[0216] (3) Portable entertainment devices: These devices can display and play multimedia content. This category includes: audio and video players (such as iPods), handheld game consoles, e-books, as well as smart toys and portable car navigation devices.

[0217] (4) Server: A device that provides computing services. The components of a server include a processor, hard disk, memory, system bus, etc. Servers are similar to general computer architectures, but because they need to provide highly reliable services, they have higher requirements in terms of processing power, stability, reliability, security, scalability, and manageability.

[0218] (5) Other electronic devices with data interaction functions.

[0219] Accordingly, embodiments of this application also provide a computer-readable storage medium storing one or more programs, which can be executed by one or more processors to implement the bill of materials generation method of any of the software provided in the foregoing embodiments, thus achieving the corresponding technical effects. This has been described in detail above and will not be repeated here.

[0220] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0221] The various embodiments in this specification are described in a related manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

[0222] In particular, the device embodiment is basically similar to the method embodiment, so the description is relatively simple. For relevant details, please refer to the description of the method embodiment.

[0223] For ease of description, the above apparatus is described by dividing it into various functional units / modules. Of course, in implementing this application, the functions of each unit / module can be implemented in one or more software and / or hardware.

[0224] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0225] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for generating a bill of materials using software, characterized in that, include: Determine the file information of each file in each source code package in the current software, as well as the package information of each source code package; Establish the first hierarchical relationship between the package information of each source code package and the file information of each file in the source code package; Based on the package information of at least one source code package, establish the material information of at least one superior material; wherein, the material information of the superior material is the material information of the material above the source code package, and the material above the source code package includes functional-level materials, module-level materials and / or system-level materials. Based on the file information of each file in each source code package, the package information of each source code package, the first membership relationship, and the material information of the at least one superior material, the bill of materials for the software is generated. The current software includes a first source code package and a second source code package; the package information of the first source code package also includes the dependency relationship between the first source code package and the second source code package; the dependency relationship is determined according to the following steps: based on the compilation operation of the first source code package, it is determined that the first source code package depends on the second source code package; the dependency relationship between the first source code package and the second source code package is established; The step of determining the file information of each file in each source code package in the current software and the package information of each source code package includes: based on the compilation operation of the first source code package in the current software, traversing each file of the first source code package to determine the file information of each file of the first source code package; determining the package information of the first source code package; based on the compilation operation of the second source code package in the current software, traversing each file of the second source code package to determine the file information of each file of the second source code package; determining the package information of the second source code package. The step of traversing each file in the first source code package and determining the file information of each file in the first source code package includes: traversing each file in the first source code package and determining the initial file information of the first file in the first source code package; determining whether the initial file information of the first file is missing first preset information; if the first preset information is missing, obtaining the first preset information from the first source code package; adding the first preset information to the corresponding position of the initial file information of the first file to generate the file information of the first file; if the first preset information is not missing, determining the initial file information of the first file as the file information of the first file.

2. The method according to claim 1, characterized in that, Determining the package information of the first source code package includes: Based on the compilation operation of the first source code package in the current software, the package information of the first source code package is determined.

3. The method according to claim 2, characterized in that, Determining the package information of the first source code package includes: Extract the package information of the first source code package from the first source code package; and / or, Based on the files in the first source code package, determine the package information of the first source code package.

4. The method according to claim 3, characterized in that, The step of extracting the package information of the first source code package from the first source code package includes: Extract the initial package information of the first source code package from the first source code package; Determine whether the initial package information of the first source code package is missing the second preset information; If the second preset information is missing, then the second preset information is obtained according to the preset method; Add the second preset information to the corresponding position in the initial package information of the first source code package to generate the package information of the first source code package; If the second preset information is not missing, then the initial package information of the first source code package is determined as the package information of the first source code package.

5. The method according to claim 1, characterized in that, The process of establishing material information for at least one parent material based on package information from at least one source code package includes: Determine the functional category of each source code package; Based on the package information of source code packages belonging to the same functional category, generate functional information of functional-level materials corresponding to the same functional category, and establish a second membership relationship between the functional information and the package information of source code packages belonging to the same functional category. The step of generating the software's bill of materials based on the file information of each file in each source code package, the package information of each source code package, the first hierarchical relationship, and the material information of at least one parent material includes: Based on the file information of each file in each source code package, the package information of each source code package, the first membership relationship, and the functional information and second membership relationship of each functional-level material, the bill of materials for the software is generated.

6. The method according to claim 1, characterized in that, The process of establishing material information for at least one parent material based on package information from at least one source code package includes: Determine the functional category of each source code package; Based on the package information of source code packages belonging to the same functional category, generate functional information of functional-level materials corresponding to the same functional category, and establish a second membership relationship between the functional information and the package information of source code packages belonging to the same functional category. Aggregate at least two functional-level materials into a module-level material; Generate module information for each module-level material, and establish a third membership relationship between the module information and the functional information of each functional-level material aggregated into the module-level material corresponding to that module information; The step of generating the software's bill of materials based on the file information of each file in each source code package, the package information of each source code package, the first hierarchical relationship, and the material information of at least one parent material includes: Based on the file information of each file in each source code package, the package information of each source code package, the first membership relationship, the functional information of each functional-level material, the second membership relationship, the module information of the module-level material, and the third membership relationship, the bill of materials for the software is generated.

7. The method according to claim 1, characterized in that, The process of establishing material information for at least one parent material based on package information from at least one source code package includes: Determine the functional category of each source code package; Based on the package information of source code packages belonging to the same functional category, generate functional information of functional-level materials corresponding to the same functional category, and establish a second membership relationship between the functional information and the package information of source code packages belonging to the same functional category. Aggregate at least two functional-level materials into a module-level material; Generate module information for each module-level material, and establish a third membership relationship between the module information and the functional information of each functional-level material aggregated into the module-level material corresponding to that module information; Aggregate at least two module-level materials into a system-level material; Generate system information for system-level materials and establish a fourth membership relationship between system information and module information of each module-level material aggregated into a system-level material corresponding to this system information; The step of generating the software's bill of materials based on the file information of each file in each source code package, the package information of each source code package, the first hierarchical relationship, and the material information of at least one parent material includes: Based on the file information of each file in each source code package, the package information of each source code package, the first membership relationship, the functional information of each functional-level material, the second membership relationship, the module information of the module-level material, the third membership relationship, the system information of the system-level material, and the fourth membership relationship, the bill of materials for the software is generated.

8. A software-based bill of materials generation device, characterized in that, include: The determiner is used to determine the file information of each file in each source code package in the current software, as well as the package information of each source code package; The first builder is used to establish the first membership relationship between the package information of each source package and the file information of each file in the source package; The second creator is used to create material information of at least one superior material based on the package information of at least one source code package; wherein, the material information of the superior material is the material information of the material above the source code package, and the material above the source code package includes functional material, module material and / or system material. A generator is used to generate a bill of materials for the software based on the file information of each file in each source code package, the package information of each source code package, the first membership relationship, and the material information of the at least one parent material. The current software includes a first source code package and a second source code package; the package information of the first source code package also includes the dependency relationship between the first source code package and the second source code package; the device is further configured to determine the dependency relationship, specifically configured to: determine that the first source code package depends on the second source code package based on the compilation operation of the first source code package; and establish the dependency relationship between the first source code package and the second source code package; The determiner includes: a first determiner sub-unit, configured to determine the file information of each file in the first source code package by traversing each file in the first source code package based on the compilation operation of the first source code package in the current software; a second determiner sub-unit, configured to determine the package information of the first source code package; a third determiner sub-unit, configured to determine the file information of each file in the second source code package by traversing each file in the second source code package based on the compilation operation of the second source code package in the current software; and a fourth determiner sub-unit, configured to determine the package information of the second source code package. The first determining sub-process is specifically configured to: traverse each file in the first source code package and determine the initial file information of the first file in the first source code package; determine whether the initial file information of the first file is missing first preset information; if the first preset information is missing, obtain the first preset information from the first source code package; add the first preset information to the corresponding position of the initial file information of the first file to generate the file information of the first file; if the first preset information is not missing, determine the initial file information of the first file as the file information of the first file.

9. An electronic device, characterized in that, The electronic device includes: a housing, a processor, a memory, a circuit board, and a power supply circuit, wherein the circuit board is disposed inside the space enclosed by the housing, and the processor and the memory are disposed on the circuit board; the power supply circuit is used to supply power to various circuits or devices of the electronic device; the memory is used to store executable program code; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, for executing the bill of materials generation method of the software according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores one or more programs, which can be executed by one or more processors to implement the bill of materials generation method of the software according to any one of claims 1-7.

Images