1) Use output file path of installed files in build system since there is no PRODUCT_OUT in Bazel
2) Use CONTAINS to describe the relationship between a APEX and files it contains
3) Generate SBOM of APEXs, which is similar to SBOM of products
Bug: 275472038
Test: CIs
(cherry picked from https://android-review.googlesource.com/q/commit:fd7e6517d345d3b8d4af12dae345434d968b83b9)
Merged-In: I41622366e5e6ed9dc78cca7bc7bb69a1f8f9bd9f
Change-Id: I41622366e5e6ed9dc78cca7bc7bb69a1f8f9bd9f
1) PackageSupplier should be NOASSERTION if there is no homepage
information in METADATA file of source packages
2) PackageDownloadLocation of upstream packages should be NOASSERTION if
there is no code repository URL in METADATA file of source packages
Test: CIs
Test: atest --host sbom_writers_test
Change-Id: I8a0298b7bacc2f96555f9d7dde0d21ada8c6b564
1) writer classes of generating SBOM in different SPDX formats
2) data classes to model the SBOM structure in SPDX
Bug: 272358880
Test: CIs
Test: build/soong/tests/sbom_test.sh
Test: atest --host sbom_writers_test
Change-Id: I1175cf0d99864bc4304559a59484ef0ba401cd64
