CMake: Annotate some targets with SBOM information

Task-number: QTBUG-122899
Change-Id: I2eb70ca4d52e30c8e15ca7b350df6965d93732f8
Reviewed-by:  Alexey Edelev <alexey.edelev@qt.io>
(cherry picked from commit 79f9b490e7f6e2746de36542cc4c7442dabe8315)
Reviewed-by: Joerg Bornemann <joerg.bornemann@qt.io>
Reviewed-by:  Alexey Edelev <alexey.edelev@qt.io>

qmake/CMakeLists.txt

@@ -15,6 +15,10 @@ qt_add_library(QtLibraryInfo OBJECT
     propertyprinter.cpp propertyprinter.h
     qmakelibraryinfo.cpp qmakelibraryinfo.h
 )
+qt_internal_add_sbom(QtLibraryInfo
+    TYPE QT_MODULE
+    NO_INSTALL
+)
 
 # Make sure we use same parameters when building QtLibraryInfo and other Qt libraries,
 # otherwise some compilers may have compilation errors, such as clang-cl.

src/3rdparty/CMakeLists.txt

@@ -8,6 +8,8 @@ if(QT_FEATURE_gui AND QT_FEATURE_jpeg AND NOT QT_FEATURE_system_jpeg)
 endif()
 qt_install_3rdparty_library_wrap_config_extra_file(BundledLibjpeg)
 
+# Needed for freetype, because it links against WrapPNG
+qt_find_package(WrapPNG PROVIDED_TARGETS WrapPNG::WrapPNG)
 if(QT_FEATURE_gui AND QT_FEATURE_freetype AND NOT QT_FEATURE_system_freetype)
     add_subdirectory(freetype)
 endif()

src/3rdparty/pcre2/CMakeLists.txt

@@ -45,6 +45,8 @@ qt_internal_add_3rdparty_library(BundledPcre2
         PCRE2_CODE_UNIT_WIDTH=16
     PUBLIC_INCLUDE_DIRECTORIES
         $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/src>
+    CPE_VENDOR "pcre"
+    CPE_PRODUCT "pcre2"
 )
 qt_disable_warnings(BundledPcre2)
 qt_set_symbol_visibility_hidden(BundledPcre2)

src/corelib/CMakeLists.txt

@@ -2,7 +2,17 @@
 # SPDX-License-Identifier: BSD-3-Clause
 
 qt_find_package(WrapPCRE2 PROVIDED_TARGETS WrapPCRE2::WrapPCRE2)
+qt_internal_extend_sbom(WrapPCRE2::WrapPCRE2
+    CPE_VENDOR "pcre"
+    CPE_PRODUCT "pcre2"
+    DOWNLOAD_LOCATION "https://github.com/PCRE2Project/pcre2"
+)
 qt_find_package(WrapZLIB PROVIDED_TARGETS WrapZLIB::WrapZLIB)
+qt_internal_extend_sbom(WrapZLIB::WrapZLIB
+    CPE_VENDOR "zlib"
+    CPE_PRODUCT "zlib"
+    DOWNLOAD_LOCATION "https://github.com/madler/zlib"
+)
 
 if(ANDROID)
     set(corelib_extra_cmake_files
@@ -345,6 +355,16 @@ qt_internal_add_module(Core
     POLICIES
         QTP0002
         QTP0003
+    ATTRIBUTION_FILE_DIR_PATHS
+        text
+        tools
+        ../3rdparty/blake2
+        ../3rdparty/md4
+        ../3rdparty/md5
+        ../3rdparty/sha1
+        ../3rdparty/sha3
+        ../3rdparty/rfc6234
+        ../3rdparty/tinycbor
 )
 _qt_internal_setup_deploy_support()
 
@@ -608,6 +628,8 @@ qt_internal_extend_target(Core CONDITION APPLE
         # This makes sure that the tst_qmakelib passes. For some reason,
         # QtCore ends up returning a corrupted error message in
         # write_file(): fail
+    ATTRIBUTION_FILE_DIR_PATHS
+        kernel
 )
 
 qt_internal_extend_target(Core CONDITION MACOS
@@ -777,6 +799,8 @@ qt_internal_extend_target(Core CONDITION QT_FEATURE_doubleconversion AND NOT QT_
     INCLUDE_DIRECTORIES
         ../3rdparty/double-conversion/double-conversion
         ../3rdparty/double-conversion
+    ATTRIBUTION_FILE_DIR_PATHS
+        ../3rdparty/double-conversion
 )
 
 qt_internal_extend_target(Core CONDITION QT_FEATURE_system_libb2
@@ -788,6 +812,8 @@ qt_internal_extend_target(Core CONDITION QT_FEATURE_easingcurve
     SOURCES
         tools/qeasingcurve.cpp tools/qeasingcurve.h
         tools/qtimeline.cpp tools/qtimeline.h
+    ATTRIBUTION_FILE_DIR_PATHS
+        ../3rdparty/easing
 )
 
 qt_internal_extend_target(Core CONDITION UNIX AND NOT HAIKU AND NOT INTEGRITY AND NOT VXWORKS AND NOT WASM AND NOT MACOS
@@ -1003,6 +1029,8 @@ qt_internal_extend_target(Core CONDITION QT_FEATURE_process AND UNIX
         io/forkfd_qt.c
     INCLUDE_DIRECTORIES
         ../3rdparty/forkfd
+    ATTRIBUTION_FILE_DIR_PATHS
+        ../3rdparty/forkfd
 )
 
 qt_internal_extend_target(Core CONDITION APPLE AND QT_FEATURE_processenvironment

src/corelib/configure.cmake

@@ -26,6 +26,9 @@ qt_find_package(WrapSystemDoubleConversion
                 PROVIDED_TARGETS WrapSystemDoubleConversion::WrapSystemDoubleConversion
                 MODULE_NAME core QMAKE_LIB doubleconversion)
 qt_find_package(GLIB2 PROVIDED_TARGETS GLIB2::GLIB2 MODULE_NAME core QMAKE_LIB glib)
+qt_find_package_extend_sbom(TARGETS GLIB2::GLIB2
+    LICENSE_EXPRESSION "LGPL-2.1-or-later"
+)
 qt_find_package(ICU 50.1 COMPONENTS i18n uc data PROVIDED_TARGETS ICU::i18n ICU::uc ICU::data
     MODULE_NAME core QMAKE_LIB icu)
 
@@ -35,6 +38,9 @@ endif()
 qt_find_package(Libsystemd PROVIDED_TARGETS PkgConfig::Libsystemd MODULE_NAME core QMAKE_LIB journald)
 qt_find_package(WrapAtomic PROVIDED_TARGETS WrapAtomic::WrapAtomic MODULE_NAME core QMAKE_LIB libatomic)
 qt_find_package(Libb2 PROVIDED_TARGETS Libb2::Libb2 MODULE_NAME core QMAKE_LIB libb2)
+qt_find_package_extend_sbom(TARGETS Libb2::Libb2
+    LICENSE_EXPRESSION "CC0-1.0"
+)
 qt_find_package(WrapRt PROVIDED_TARGETS WrapRt::WrapRt MODULE_NAME core QMAKE_LIB librt)
 qt_find_package(WrapSystemPCRE2 10.20 PROVIDED_TARGETS WrapSystemPCRE2::WrapSystemPCRE2 MODULE_NAME core QMAKE_LIB pcre2)
 set_package_properties(WrapPCRE2 PROPERTIES TYPE REQUIRED)

src/gui/CMakeLists.txt

@@ -294,6 +294,12 @@ qt_internal_add_module(Gui
         "(^|/)qplatform.+\\.h$|(^|/)qwindowsystem.+\\.h$"
     RHI_HEADER_FILTERS
         "(^|/)qrhi\\.h$|(^|/)qrhi_platform\\.h$|(^|/)qshader\\.h$|(^|/)qshaderdescription\\.h$"
+    ATTRIBUTION_FILE_DIR_PATHS
+        rhi
+        opengl
+        painting
+        text
+        ../3rdparty/VulkanMemoryAllocator
 )
 
 # Resources:
@@ -305,6 +311,15 @@ if(QT_FEATURE_pdf)
         "../3rdparty/icc/sRGB2014.icc"
         "painting/qpdfa_metadata.xml"
     )
+    qt_internal_extend_target(Gui
+        ATTRIBUTION_FILE_DIR_PATHS
+            ../3rdparty/icc
+    )
+    qt_internal_sbom_add_license(
+        LICENSE_ID "ICC-License"
+        LICENSE_PATH "${CMAKE_CURRENT_SOURCE_DIR}/../3rdparty/icc/LICENSE.txt"
+    )
+
     qt_internal_add_resource(Gui "qpdf"
        PREFIX
            "/qpdf/"
@@ -463,6 +478,8 @@ qt_internal_extend_target(Gui CONDITION WIN32
         dxgi
         dxguid
         d3d12
+    ATTRIBUTION_FILE_DIR_PATHS
+        ../3rdparty/D3D12MemoryAllocator
 )
 
 if(QT_FEATURE_graphicsframecapture)
@@ -719,6 +736,8 @@ qt_internal_extend_target(Gui CONDITION QT_FEATURE_textmarkdownreader AND NOT QT
         MD4C_USE_UTF8
     INCLUDE_DIRECTORIES
         ../3rdparty/md4c
+    ATTRIBUTION_FILE_DIR_PATHS
+        ../3rdparty/md4c
 )
 
 qt_internal_extend_target(Gui CONDITION QT_FEATURE_textmarkdownwriter
@@ -798,7 +817,12 @@ qt_internal_extend_target(Gui CONDITION MINGW AND WIN32
 # Note: These helpers are only used for 16-bit surfaces, so excluding them does not generally
 # exclude neon-drawhelpers on these platforms.
 if(UNIX AND NOT ANDROID AND NOT INTEGRITY AND NOT (TEST_architecture_arch STREQUAL "arm64") AND NOT UIKIT AND NOT QT_IS_MACOS_UNIVERSAL)
-    qt_internal_extend_target(Gui DEFINES ENABLE_PIXMAN_DRAWHELPERS)
+    qt_internal_extend_target(Gui
+        DEFINES
+            ENABLE_PIXMAN_DRAWHELPERS
+        ATTRIBUTION_FILE_DIR_PATHS
+            ../3rdparty/pixman
+    )
     qt_internal_add_simd_part(Gui SIMD neon
         SOURCES
             ../3rdparty/pixman/pixman-arm-neon-asm.S
@@ -823,6 +847,8 @@ qt_internal_extend_target(Gui CONDITION QT_FEATURE_system_zlib
 qt_internal_extend_target(Gui CONDITION NOT QT_FEATURE_system_zlib
     INCLUDE_DIRECTORIES
         ../3rdparty/zlib/src
+    ATTRIBUTION_FILE_DIR_PATHS
+        ../3rdparty/zlib
 )
 
 qt_internal_extend_target(Gui CONDITION NOT QT_FEATURE_system_zlib AND NOT no_core_dep
@@ -888,6 +914,8 @@ qt_internal_extend_target(Gui CONDITION QT_FEATURE_vulkan
         vulkan/qvulkanfunctions.cpp
         vulkan/qvulkaninstance.cpp vulkan/qvulkaninstance.h vulkan/qvulkaninstance_p.h
         vulkan/qvulkanwindow.cpp vulkan/qvulkanwindow.h vulkan/qvulkanwindow_p.h
+    ATTRIBUTION_FILE_DIR_PATHS
+        vulkan
 )
 if(QT_FEATURE_vulkan)
     qt_internal_add_target_include_dirs_and_optionally_propagate(

src/gui/configure.cmake

@@ -48,6 +48,16 @@ qt_add_qmake_lib_dependency(fontconfig freetype)
 qt_find_package(gbm PROVIDED_TARGETS gbm::gbm MODULE_NAME gui QMAKE_LIB gbm)
 qt_find_package(WrapSystemHarfbuzz 2.6.0 PROVIDED_TARGETS WrapSystemHarfbuzz::WrapSystemHarfbuzz MODULE_NAME gui QMAKE_LIB harfbuzz)
 qt_find_package(Libinput PROVIDED_TARGETS Libinput::Libinput MODULE_NAME gui QMAKE_LIB libinput)
+qt_find_package_extend_sbom(TARGETS Libinput::Libinput
+    COPYRIGHTS
+        "Copyright © 2006-2009 Simon Thum"
+        "Copyright © 2008-2012 Kristian Høgsberg"
+        "Copyright © 2010-2012 Intel Corporation"
+        "Copyright © 2010-2011 Benjamin Franzke"
+        "Copyright © 2011-2012 Collabora, Ltd."
+        "Copyright © 2013-2014 Jonas Ådahl"
+        "Copyright © 2013-2015 Red Hat, Inc."
+)
 qt_find_package(WrapSystemJpeg PROVIDED_TARGETS WrapSystemJpeg::WrapSystemJpeg MODULE_NAME gui QMAKE_LIB libjpeg)
 qt_find_package(WrapSystemMd4c PROVIDED_TARGETS WrapSystemMd4c::WrapSystemMd4c MODULE_NAME gui QMAKE_LIB libmd4c)
 qt_find_package(WrapSystemPNG PROVIDED_TARGETS WrapSystemPNG::WrapSystemPNG MODULE_NAME gui QMAKE_LIB libpng)

src/network/CMakeLists.txt

@@ -166,6 +166,8 @@ qt_internal_extend_target(Network CONDITION QT_FEATURE_system_zlib
 qt_internal_extend_target(Network CONDITION NOT QT_FEATURE_system_zlib
     INCLUDE_DIRECTORIES
         ../3rdparty/zlib/src
+    ATTRIBUTION_FILE_DIR_PATHS
+        ../3rdparty/zlib
 )
 
 qt_internal_extend_target(Network CONDITION NOT QT_FEATURE_system_zlib AND NOT no_core_dep
@@ -179,6 +181,8 @@ qt_internal_extend_target(Network CONDITION QT_FEATURE_topleveldomain
         ../3rdparty/libpsl/src/lookup_string_in_fixed_set.c
     INCLUDE_DIRECTORIES
         ../3rdparty/libpsl
+    ATTRIBUTION_FILE_DIR_PATHS
+        ../3rdparty/libpsl
 )
 
 qt_internal_extend_target(Network CONDITION QT_FEATURE_dnslookup

src/plugins/platforms/wasm/CMakeLists.txt

@@ -44,6 +44,8 @@ qt_internal_add_plugin(QWasmIntegrationPlugin
         Qt::CorePrivate
         Qt::Gui
         Qt::GuiPrivate
+    ATTRIBUTION_FILE_DIR_PATHS
+        ../../../3rdparty/wasm
 )
 
 # Resources:

src/plugins/platforms/windows/CMakeLists.txt

@@ -131,6 +131,8 @@ qt_internal_extend_target(QWindowsIntegrationPlugin CONDITION QT_FEATURE_tablete
         qwindowstabletsupport.cpp qwindowstabletsupport.h
     INCLUDE_DIRECTORIES
         ${QtBase_SOURCE_DIR}/src/3rdparty/wintab
+    ATTRIBUTION_FILE_DIR_PATHS
+        ../../../3rdparty/wintab
 )
 
 qt_internal_extend_target(QWindowsIntegrationPlugin CONDITION QT_FEATURE_sessionmanager

src/plugins/platforms/xcb/CMakeLists.txt

@@ -146,6 +146,10 @@ qt_internal_extend_target(XcbQpaPrivate CONDITION QT_FEATURE_fontconfig AND QT_F
 if(QT_FEATURE_system_xcb_xinput)
     qt_internal_extend_target(XcbQpaPrivate LIBRARIES XCB::XINPUT)
 else()
+    qt_internal_extend_target(XcbQpaPrivate
+        ATTRIBUTION_FILE_DIR_PATHS
+            ../../../3rdparty/xcb
+    )
     set(xinput_source "${PROJECT_SOURCE_DIR}/src/3rdparty/xcb/libxcb/xinput.c")
     set_source_files_properties(
         "${xinput_source}"

src/plugins/sqldrivers/sqlite/CMakeLists.txt

@@ -60,6 +60,8 @@ qt_internal_extend_target(QSQLiteDriverPlugin CONDITION NOT QT_FEATURE_system_sq
         SQLITE_OMIT_COMPLETE
     INCLUDE_DIRECTORIES
         ../../../3rdparty/sqlite
+    ATTRIBUTION_FILE_DIR_PATHS
+        ../../../3rdparty/sqlite
 )
 
 qt_internal_extend_target(QSQLiteDriverPlugin CONDITION CMAKE_BUILD_TYPE STREQUAL Release AND NOT QT_FEATURE_system_sqlite

src/testlib/CMakeLists.txt

@@ -78,6 +78,8 @@ qt_internal_add_module(Test
         Qt::Core
     PRIVATE_MODULE_INTERFACE
         Qt::CorePrivate
+    ATTRIBUTION_FILE_DIR_PATHS
+        3rdparty
 )
 
 if(TARGET Gui)

src/tools/bootstrap/CMakeLists.txt

@@ -8,6 +8,10 @@
 # The bootstrap library has a few manual tweaks compared to other
 # libraries.
 qt_add_library(Bootstrap STATIC)
+qt_internal_add_sbom(Bootstrap
+    TYPE QT_MODULE
+    NO_INSTALL
+)
 
 qt_internal_add_sync_header_dependencies(Bootstrap Core)
 
@@ -199,6 +203,8 @@ qt_internal_extend_target(Bootstrap CONDITION CMAKE_CROSSCOMPILING OR NOT QT_FEA
         PCRE2_DISABLE_JIT
     PUBLIC_INCLUDE_DIRECTORIES
         $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/../../3rdparty/pcre2/src>
+    ATTRIBUTION_FILE_DIR_PATHS
+        ../../3rdparty/pcre2
 )
 
 qt_internal_extend_target(Bootstrap

src/tools/moc/CMakeLists.txt

@@ -38,6 +38,16 @@ qt_internal_add_tool(${target_name}
 )
 qt_internal_return_unless_building_tools()
 
+qt_internal_extend_sbom(${target_name}
+    COPYRIGHTS
+        "Copyright (C) 2013 Olivier Goffart <ogoffart@woboq.com>"
+        "Copyright (C) 2014 Olivier Goffart <ogoffart@woboq.org>"
+        "Copyright (C) 2016 Intel Corporation."
+        "Copyright (C) 2018 Intel Corporation."
+        "Copyright (C) 2018 The Qt Company Ltd."
+        "Copyright (C) 2019 Olivier Goffart <ogoffart@woboq.com>"
+)
+
 ## Scopes:
 #####################################################################