Git-overridden score_* modules get versionInfo: "unknown" and a wrong downloadLocation in the generated SBOM #21

Description

Modules pinned through git_override without a version in their own module() call appear in the SBOM with versionInfo: "unknown", a unknown PURL, and a downloadLocation guessed from the module name.

This affects score_time, score_baselibs, score_communication, score_persistency and score_test_scenarios in reference_integration. score_kyron and score_logging show 0.0.0, which comes from their upstream module() and doesn't identify a revision either.

Example from bazel build //:sbom in reference_integration:

{
  "name": "score_time",
  "versionInfo": "unknown",
  "downloadLocation": "https://github.com/eclipse-score/score_time",
  "externalRefs": [{ "referenceType": "purl",
                     "referenceLocator": "pkg:github/eclipse-score/score_time@unknown" }]
}

The module is actually pinned as:

bazel_dep(name = "score_time")
git_override(
    module_name = "score_time",
    commit = "3723ce687e4abc7d6cb4c0efdbbd30455ed7c303",
    remote = "https://github.com/eclipse-score/time.git",
    patches = ["//patches/time:003-disable-broken-qnx-ifs-target.patch"],
)

Analysis results

• extensions.bzl records a module only when mod.version is non-empty. Git-overwritten modules without a module(version=…) have an empty version.
• Overrides aren't visible through module_ctx, and git-overridden modules have no registryFileHashes entry in MODULE.bazel.lock, so lockfile inference finds nothing.
• internal/generator/sbom_generator.py then falls back to "version": "unknown", pkg:github/eclipse-score/@unknown and https://github.com/eclipse-score/. That URL is wrong whenever the repo name differs from the module name (score_time lives in eclipse-score/time).

Solution

Just a proposal:

1. Extract git_override entries (module_name, commit, tag, remote, patches) automatically from the root MODULE.bazel and its included files. Use them to resolve version, PURL and downloadLocation for modules that don't declare a version.
2. Use the full 40-character SHA everywhere, and stop truncating to 12 characters in extensions.bzl:247 (git_repository path). Prefer tag over commit only when a tag is given.
3. Prefer the commit SHA over commit_date as the version (sbom_generator.py), because a date doesn't identify a revision.
4. (maybe)When no version can be determined, omit versionInfo and the PURL instead of emitting the literal "unknown" / @unknown.
5. (maybe, complicated)When patches are applied, record that in the package sourceInfo or comment, because the built artifact differs from the upstream commit.
6. Build the URL from the override remote instead of https://github.com/eclipse-score/<module_name>.

Error Occurrence Rate

Reproducible

How to reproduce

bazel build //:sbom in reference_integration repo and look at score_time in bazel_common\score_modules_target_sw.MODULE.bazel and in sbom.spdx.json.

Supporting Information

No response

Classification

Major

First Affected Release

not released (main)

Last Affected Release

not released (main)

Expected Fixed Release

before release (main)

Category

• Safety Relevant
• Security Relevant