openscap/libswid

Library for interfacing with SWID tags

libswid

Library for interfacing with SWID tags

Build

You will need:

• C++ toolchain.
• Xerces XML parsing library.
• TinyXML XML parsing library.
• lcov for coverage reports.

$ mkdir -p build && cd build && rm -rf *
$ cmake .. && make && make test
$ make lcov && xdg-open lcov/html/all_targets/index.html

If you have downloaded the SWID validator, extract it and pass the path to the validator .jar to Cmake like this:

cmake -DSWID_VALIDATOR=/path/to/validator/swid/swidval-0.5.0.jar ..

Then, the test suite will use it in some of the tests.

libswid's Issues

pointer and ref are middle aligned

It's a personal preference but I will go ahead and complain about it anyway :-P

Consider this:
a * b - at first glance you are not sure if it's a multiplied by b or a pointer to a stored in b.
a & b - bitwise and or ref?
const a & b

IMO stick to industry standards, nobody cares if it's a *b or a* b but a * b is super rare and weird... I personally prefer a* b but as long as it's not in the middle I am fine and can read it quickly.

Configuration works without tinyxml but it doesn't build without it

mpreisle@t450s ~/d/libswid/build $ make -j 4
Scanning dependencies of target gen_swid_swidPYTHON_wrap
Scanning dependencies of target unit_tests
Scanning dependencies of target resaver
[  3%] Swig source
[  6%] Building CXX object CMakeFiles/swid.dir/src/Translator.cpp.o
[  9%] Building CXX object CMakeFiles/resaver.dir/src/SWIDStruct.cpp.o
[ 12%] Building CXX object CMakeFiles/unit_tests.dir/test/unit/test-main.cpp.o
[ 15%] Building CXX object CMakeFiles/resaver.dir/src/Translator.cpp.o
/home/mpreisle/d/libswid/src/SWIDStruct.h:57: Warning 503: Can't wrap 'operator |' unless renamed to a valid identifier.
/home/mpreisle/d/libswid/src/SWIDStruct.h:58: Warning 503: Can't wrap 'operator &' unless renamed to a valid identifier.
[ 15%] Built target gen_swid_swidPYTHON_wrap
[ 18%] Building CXX object CMakeFiles/unit_tests.dir/test/unit/test.cpp.o
In file included from /home/mpreisle/d/libswid/test/unit/test.cpp:6:0:
/home/mpreisle/d/libswid/src/loader-tinyxml.h:26:10: fatal error: tinyxml.h: No such file or directory
 #include <tinyxml.h>
          ^~~~~~~~~~~
compilation terminated.
make[2]: *** [CMakeFiles/unit_tests.dir/build.make:76: CMakeFiles/unit_tests.dir/test/unit/test.cpp.o] Error 1
make[2]: *** Waiting for unfinished jobs....
[ 21%] Building CXX object CMakeFiles/resaver.dir/src/lib.cpp.o
In file included from /home/mpreisle/d/libswid/src/lib.cpp:28:0:
/home/mpreisle/d/libswid/src/loader-tinyxml.h:26:10: fatal error: tinyxml.h: No such file or directory
 #include <tinyxml.h>
          ^~~~~~~~~~~
compilation terminated.
make[2]: *** [CMakeFiles/resaver.dir/build.make:89: CMakeFiles/resaver.dir/src/lib.cpp.o] Error 1
make[2]: *** Waiting for unfinished jobs....
[ 25%] Building CXX object CMakeFiles/swid.dir/src/lib.cpp.o
In file included from /home/mpreisle/d/libswid/src/lib.cpp:28:0:
/home/mpreisle/d/libswid/src/loader-tinyxml.h:26:10: fatal error: tinyxml.h: No such file or directory
 #include <tinyxml.h>
          ^~~~~~~~~~~
compilation terminated.

mpreisle@t450s ~/d/libswid/build $ cmake ../                      
-- Found XercesC: /usr/lib64/libxerces-c.so (found version "3.1.4") 
-- Could NOT find TinyXML (missing: TinyXML_LIBRARY TinyXML_INCLUDE_DIR) 
-- Configuring done
-- Generating done
-- Build files have been written to: /home/mpreisle/d/libswid/build

using article in API function

I have noticed that in https://github.com/OpenSCAP/libswid/blob/master/src/lib.cpp there is function defined

SWIDTagIO * get_a_swidtagio(const char * type)

Having article there adds nothing in my opinion, it just makes function name longer.

bundled header

test/unit/catch.hpp is a boost header, please consider including the header from boost instead of including it in your project. Bundling is a big red flag for downstream distribution, Fedora, Debian, RHEL and others all have rules against it.

CPack will create testing non-production packages with vendor set to Red Hat

That might be misleading to users, these packages are not supported. They are not even the packages that are shipped by Red Hat. IMO set it to something like libswid upstream.

No way to build python2 AND python3 bindings

It will always build just one of them.