From 435c746b90e9931b50e54cb63ae805f8f55d765d Mon Sep 17 00:00:00 2001
From: Marc Prud'hommeaux <mwp1@cornell.edu>
Date: Thu, 21 Aug 2025 20:30:34 -0400
Subject: [PATCH 1/4] Address nits

---
 swift-ci/sdks/android/scripts/fetch-source.sh  | 1 -
 swift-ci/sdks/android/scripts/install-swift.sh | 1 -
 2 files changed, 2 deletions(-)

diff --git a/swift-ci/sdks/android/scripts/fetch-source.sh b/swift-ci/sdks/android/scripts/fetch-source.sh
index d07cb68b..afc676d8 100755
--- a/swift-ci/sdks/android/scripts/fetch-source.sh
+++ b/swift-ci/sdks/android/scripts/fetch-source.sh
@@ -149,4 +149,3 @@ pushd boringssl >/dev/null 2>&1
 git checkout ${BORINGSSL_VERSION}
 popd >/dev/null 2>&1
 groupend
-
diff --git a/swift-ci/sdks/android/scripts/install-swift.sh b/swift-ci/sdks/android/scripts/install-swift.sh
index 0acd9e02..bfe96b02 100755
--- a/swift-ci/sdks/android/scripts/install-swift.sh
+++ b/swift-ci/sdks/android/scripts/install-swift.sh
@@ -51,4 +51,3 @@ tar -xzf toolchain.tar.gz --directory ${destination} --strip-components=2
 chmod -R o+r ${destination}/lib/swift
 
 popd >/dev/null
-

From 7bcf3a211af882a20be97adebe725274d1368e0e Mon Sep 17 00:00:00 2001
From: Marc Prud'hommeaux <mwp1@cornell.edu>
Date: Thu, 21 Aug 2025 20:47:27 -0400
Subject: [PATCH 2/4] Eliminate unnecessaryt pushds and use run cmake install
 instead of ninja

---
 swift-ci/sdks/android/scripts/build.sh | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/swift-ci/sdks/android/scripts/build.sh b/swift-ci/sdks/android/scripts/build.sh
index db92f02c..8cc05ec7 100755
--- a/swift-ci/sdks/android/scripts/build.sh
+++ b/swift-ci/sdks/android/scripts/build.sh
@@ -359,7 +359,6 @@ for arch in $archs; do
     groupend
 
     groupstart "Building libcurl for ${compiler_target_host}"
-    quiet_pushd ${swift_source_dir}/curl
         run cmake \
             -G Ninja \
             -S ${swift_source_dir}/curl \
@@ -393,9 +392,8 @@ for arch in $archs; do
 
         header "Installing libcurl for $arch"
         quiet_pushd ${build_dir}/$arch/curl
-            run ninja -j$parallel_jobs install
+            run cmake --install ${build_dir}/${arch}/curl
         quiet_popd
-    quiet_popd
     groupend
 
     groupstart "Building Android SDK for ${compiler_target_host}"

From c8ffa34e9d8bf721847b2b495af6874a0ff88e61 Mon Sep 17 00:00:00 2001
From: Marc Prud'hommeaux <mwp1@cornell.edu>
Date: Thu, 21 Aug 2025 20:51:05 -0400
Subject: [PATCH 3/4] Generate SBOM with SDK dependencies

---
 swift-ci/sdks/android/scripts/build.sh | 92 +++++++++++++++++++++++++-
 1 file changed, 91 insertions(+), 1 deletion(-)

diff --git a/swift-ci/sdks/android/scripts/build.sh b/swift-ci/sdks/android/scripts/build.sh
index 8cc05ec7..eeb4e0fc 100755
--- a/swift-ci/sdks/android/scripts/build.sh
+++ b/swift-ci/sdks/android/scripts/build.sh
@@ -101,7 +101,7 @@ function declare_package
     packages+=(${name})
 }
 
-declare_package android_sdk \
+declare_package swift_android_sdk \
                 "Swift SDK for Android" \
                 "Apache-2.0" "https://swift.org/install"
 declare_package swift "swift" "Apache-2.0" "https://swift.org"
@@ -503,6 +503,96 @@ cat > info.json <<EOF
 }
 EOF
 
+spdx_uuid=$(uuidgen)
+spdx_doc_uuid=$(uuidgen)
+spdx_timestamp=$(date -Iseconds)
+
+# Now generate SPDX data
+cat > sbom.spdx.json <<EOF
+{
+  "SPDXID": "SPDXRef-DOCUMENT",
+  "name": "SBOM-SPDX-${spdx_uuid}",
+  "spdxVersion": "SPDX-2.3",
+  "creationInfo": {
+    "created": "${spdx_timestamp}",
+    "creators": [
+      "Organization: Apple, Inc."
+    ]
+  },
+  "dataLicense": "Apache-2.0",
+  "documentNamespace": "urn:uuid:${spdx_doc_uuid}",
+  "documentDescribes": [
+    "SPDXRef-Package-swift-android-sdk"
+  ],
+  "packages": [
+EOF
+
+first=true
+for package in ${packages[@]}; do
+    if [[ "$first" == "true" ]]; then
+        first=false
+    else
+        cat >> sbom.spdx.json <<EOF
+    },
+EOF
+    fi
+
+    snake=${package}_snake; snake=${!snake}
+    version=${package}_version; version=${!version}
+    name=${package}_name; name=${!name}
+    license=${package}_license; license=${!license}
+    url=${package}_url; url=${!url}
+
+    cat >> sbom.spdx.json <<EOF
+    {
+      "SPDXID": "SPDXRef-Package-${snake}",
+      "name": "${name}",
+      "versionInfo": "${version}",
+      "filesAnalyzed": false,
+      "licenseDeclared": "${license}",
+      "licenseConcluded": "${license}",
+      "downloadLocation": "${url}",
+      "copyrightText": "NOASSERTION",
+      "checksums": []
+EOF
+done
+
+cat >> sbom.spdx.json <<EOF
+    }
+  ],
+  "relationships": [
+EOF
+
+first=true
+for package in ${packages[@]}; do
+    if [[ "$package" == "swift_android_sdk" ]]; then
+        continue
+    fi
+
+    if [[ "$first" == "true" ]]; then
+        first=false
+    else
+        cat >> sbom.spdx.json <<EOF
+    },
+EOF
+    fi
+
+    snake=${package}_snake; snake=${!snake}
+
+    cat >> sbom.spdx.json <<EOF
+    {
+      "spdxElementId": "SPDXRef-Package-swift-android-sdk",
+      "relationshipType": "GENERATED_FROM",
+      "relatedSpdxElement": "SPDXRef-Package-${snake}"
+EOF
+done
+
+cat >> sbom.spdx.json <<EOF
+    }
+  ]
+}
+EOF
+
 mkdir -p $sdk_base
 quiet_pushd $sdk_base
 

From f347502e685bfbe9a9b79726824e5ff240cda776 Mon Sep 17 00:00:00 2001
From: Marc Prud'hommeaux <mwp1@cornell.edu>
Date: Thu, 21 Aug 2025 22:41:08 -0400
Subject: [PATCH 4/4] Add example of command for building locally

---
 swift-ci/sdks/android/README.md | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/swift-ci/sdks/android/README.md b/swift-ci/sdks/android/README.md
index 1e57edd1..e7358192 100644
--- a/swift-ci/sdks/android/README.md
+++ b/swift-ci/sdks/android/README.md
@@ -81,5 +81,9 @@ perform the build locally on an Ubuntu 24.04 machine with all the
 build prerequisites already installed. This will generate
 the same artifacts in approximately half the time, and
 may be suitable to an already containerized envrionment (such as
-a GitHub runner).
+a GitHub runner). A local build can be run with the
+`build-local` script, such as:
 
+```
+./build-local swift-6.2-branch /tmp/android-sdk-devel
+```