From b02bec4c3b61db10047963aa8eaeb40ec5dc5e5d Mon Sep 17 00:00:00 2001
From: Jochem Rutgers <68805714+jhrutgers@users.noreply.github.com>
Date: Fri, 14 Nov 2025 13:33:46 +0100
Subject: [PATCH 1/2] fix all dependency

---
 cmake/sbom.cmake | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cmake/sbom.cmake b/cmake/sbom.cmake
index 3685c9f..bf538c6 100644
--- a/cmake/sbom.cmake
+++ b/cmake/sbom.cmake
@@ -1250,7 +1250,7 @@ function(reuse_lint)
 		set(REUSE_LINT_TARGET ${PROJECT_NAME}-reuse-lint)
 	endif()
 
-	if(REUSE_LINT_ALL OR NOT REUSE_LINT_CONFIG)
+	if(REUSE_LINT_ALL AND NOT REUSE_LINT_CONFIG)
 		set(lint_all ALL)
 	else()
 		set(lint_all)

From bdec7b20fd70dba48f6e7fde8c1b1508f912cc72 Mon Sep 17 00:00:00 2001
From: Jochem Rutgers <68805714+jhrutgers@users.noreply.github.com>
Date: Tue, 7 Apr 2026 14:24:15 +0200
Subject: [PATCH 2/2] fix spaces (#123)

---
 CHANGELOG.rst           | 16 ++++++++++++++--
 cmake/git_version.cmake | 28 +++++++++++++---------------
 cmake/sbom.cmake        | 22 +++++++++++-----------
 test/CMakeLists.txt     |  6 +++---
 test/external.cmake     |  4 ++--
 test/input_doc.cmake    |  4 ++--
 6 files changed, 45 insertions(+), 35 deletions(-)

diff --git a/CHANGELOG.rst b/CHANGELOG.rst
index 530e6aa..458fce1 100644
--- a/CHANGELOG.rst
+++ b/CHANGELOG.rst
@@ -1,7 +1,7 @@
 
 
 ..
-   SPDX-FileCopyrightText: 2023-2025 Jochem Rutgers
+   SPDX-FileCopyrightText: 2023-2026 Jochem Rutgers
    
    SPDX-License-Identifier: CC0-1.0
 
@@ -25,7 +25,19 @@ Added
 
 ...
 
-.. _Unreleased: https://github.com/DEMCON/cmake-sbom/compare/v1.4.0...HEAD
+.. _Unreleased: https://github.com/DEMCON/cmake-sbom/compare/v1.4.1...HEAD
+
+
+
+`1.4.1`_ - 2026-04-07
+---------------------
+
+Fixed
+`````
+
+- #123: Fix handling spaces in paths.
+
+.. _1.4.1: https://github.com/DEMCON/cmake-sbom/releases/tag/v1.4.1
 
 
 
diff --git a/cmake/git_version.cmake b/cmake/git_version.cmake
index 61e48b1..0117892 100644
--- a/cmake/git_version.cmake
+++ b/cmake/git_version.cmake
@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: 2023-2025 Jochem Rutgers
+# SPDX-FileCopyrightText: 2023-2026 Jochem Rutgers
 #
 # SPDX-License-Identifier: MIT
 
@@ -45,14 +45,14 @@ function(version_extract)
 
 	if(Git_FOUND)
 		execute_process(
-			COMMAND ${GIT_EXECUTABLE} rev-parse --short HEAD
+			COMMAND "${GIT_EXECUTABLE}" rev-parse --short HEAD
 			WORKING_DIRECTORY "${PROJECT_SOURCE_DIR}"
 			OUTPUT_VARIABLE version_git_head
 			ERROR_QUIET OUTPUT_STRIP_TRAILING_WHITESPACE
 		)
 
 		execute_process(
-			COMMAND ${GIT_EXECUTABLE} rev-parse HEAD
+			COMMAND "${GIT_EXECUTABLE}" rev-parse HEAD
 			WORKING_DIRECTORY "${PROJECT_SOURCE_DIR}"
 			OUTPUT_VARIABLE version_git_hash
 			ERROR_QUIET OUTPUT_STRIP_TRAILING_WHITESPACE
@@ -64,7 +64,7 @@ function(version_extract)
 
 		if("${GIT_VERSION_BRANCH}" STREQUAL "")
 			execute_process(
-				COMMAND ${GIT_EXECUTABLE} rev-parse --abbrev-ref HEAD
+				COMMAND "${GIT_EXECUTABLE}" rev-parse --abbrev-ref HEAD
 				WORKING_DIRECTORY "${PROJECT_SOURCE_DIR}"
 				OUTPUT_VARIABLE version_git_branch
 				ERROR_QUIET OUTPUT_STRIP_TRAILING_WHITESPACE
@@ -79,7 +79,7 @@ function(version_extract)
 
 		if("${GIT_VERSION_TAG}" STREQUAL "")
 			execute_process(
-				COMMAND ${GIT_EXECUTABLE} tag --points-at HEAD
+				COMMAND "${GIT_EXECUTABLE}" tag --points-at HEAD
 				WORKING_DIRECTORY "${PROJECT_SOURCE_DIR}"
 				OUTPUT_VARIABLE version_git_tag
 				ERROR_QUIET OUTPUT_STRIP_TRAILING_WHITESPACE
@@ -91,7 +91,7 @@ function(version_extract)
 		endif()
 
 		execute_process(
-			COMMAND ${GIT_EXECUTABLE} status -s
+			COMMAND "${GIT_EXECUTABLE}" status -s
 			WORKING_DIRECTORY "${PROJECT_SOURCE_DIR}"
 			OUTPUT_VARIABLE version_git_dirty
 			ERROR_QUIET OUTPUT_STRIP_TRAILING_WHITESPACE
@@ -103,7 +103,7 @@ function(version_extract)
 
 		macro(git_hash TAG TAG_VAR)
 			execute_process(
-				COMMAND ${GIT_EXECUTABLE} rev-parse ${TAG}
+				COMMAND "${GIT_EXECUTABLE}" rev-parse ${TAG}
 				WORKING_DIRECTORY "${PROJECT_SOURCE_DIR}"
 				OUTPUT_VARIABLE ${TAG_VAR}_
 				ERROR_QUIET OUTPUT_STRIP_TRAILING_WHITESPACE
@@ -116,7 +116,7 @@ function(version_extract)
 		endmacro()
 
 		execute_process(
-			COMMAND ${GIT_EXECUTABLE} tag
+			COMMAND "${GIT_EXECUTABLE}" tag
 			WORKING_DIRECTORY "${PROJECT_SOURCE_DIR}"
 			OUTPUT_VARIABLE GIT_TAGS
 			ERROR_QUIET OUTPUT_STRIP_TRAILING_WHITESPACE
@@ -136,7 +136,7 @@ function(version_extract)
 		endif()
 
 		execute_process(
-			COMMAND ${GIT_EXECUTABLE} show --no-patch --format=%ci
+			COMMAND "${GIT_EXECUTABLE}" show --no-patch --format=%ci
 			WORKING_DIRECTORY "${PROJECT_SOURCE_DIR}"
 			OUTPUT_VARIABLE GIT_TIMESTAMP
 			ERROR_QUIET OUTPUT_STRIP_TRAILING_WHITESPACE
@@ -166,9 +166,7 @@ function(version_extract)
 		string(REGEX REPLACE "[^A-Za-z0-9]+" "+" _version_git_branch
 				     "${version_git_branch}"
 		)
-		set(GIT_VERSION
-		    "${version_git_head}+${_version_git_branch}${version_git_dirty}"
-		)
+		set(GIT_VERSION "${version_git_head}+${_version_git_branch}${version_git_dirty}")
 	endif()
 
 	set(GIT_VERSION
@@ -291,13 +289,13 @@ function(version_generate)
 	string(REGEX REPLACE "[^A-Z0-9]+" "_" PROJECT_NAME_UC "${PROJECT_NAME_UC}")
 
 	configure_file(
-		${VERSION_SOURCE_DIR}/git_version.sh.in ${PROJECT_BINARY_DIR}/version.sh
+		"${VERSION_SOURCE_DIR}/git_version.sh.in" "${PROJECT_BINARY_DIR}/version.sh"
 		ESCAPE_QUOTES @ONLY
 	)
 
 	configure_file(
-		${VERSION_SOURCE_DIR}/git_version.h.in
-		${PROJECT_BINARY_DIR}/include/${PROJECT_NAME}_version.h ESCAPE_QUOTES @ONLY
+		"${VERSION_SOURCE_DIR}/git_version.h.in"
+		"${PROJECT_BINARY_DIR}/include/${PROJECT_NAME}_version.h" ESCAPE_QUOTES @ONLY
 	)
 	file(WRITE ${PROJECT_BINARY_DIR}/version.txt "${GIT_VERSION}")
 
diff --git a/cmake/sbom.cmake b/cmake/sbom.cmake
index bf538c6..dbcdcb8 100644
--- a/cmake/sbom.cmake
+++ b/cmake/sbom.cmake
@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: 2023-2025 Jochem Rutgers
+# SPDX-FileCopyrightText: 2023-2026 Jochem Rutgers
 #
 # SPDX-License-Identifier: MIT
 
@@ -459,7 +459,7 @@ function(sbom_finalize)
 
 	get_property(_packages GLOBAL PROPERTY sbom_packages)
 	foreach(_p IN LISTS _packages)
-		file(APPEND ${PROJECT_BINARY_DIR}/sbom/CMakeLists.txt "install(SCRIPT ${_p})
+		file(APPEND ${PROJECT_BINARY_DIR}/sbom/CMakeLists.txt "install(SCRIPT \"${_p}\")
 "
 		)
 	endforeach()
@@ -467,14 +467,14 @@ function(sbom_finalize)
 	get_property(_licenses GLOBAL PROPERTY sbom_licenses)
 	foreach(_lic IN LISTS _licenses)
 		file(APPEND ${PROJECT_BINARY_DIR}/sbom/CMakeLists.txt
-		     "install(SCRIPT ${PROJECT_BINARY_DIR}/sbom/${_lic}.cmake)
+		     "install(SCRIPT \"${PROJECT_BINARY_DIR}/sbom/${_lic}.cmake\")
 "
 		)
 	endforeach()
 
 	get_property(_relations GLOBAL PROPERTY sbom_relations)
 	foreach(_rel IN LISTS _relations)
-		file(APPEND ${PROJECT_BINARY_DIR}/sbom/CMakeLists.txt "install(SCRIPT ${_rel})
+		file(APPEND ${PROJECT_BINARY_DIR}/sbom/CMakeLists.txt "install(SCRIPT \"${_rel}\")
 "
 		)
 	endforeach()
@@ -523,7 +523,7 @@ function(sbom_finalize)
 			"
 			message(STATUS \"Verifying: ${_sbom}\")
 			execute_process(
-				COMMAND ${Python3_EXECUTABLE} -m spdx_tools.spdx.clitools.pyspdxtools
+				COMMAND \"${Python3_EXECUTABLE}\" -m spdx_tools.spdx.clitools.pyspdxtools
 				-i \"${_sbom}\" ${_graph}
 				RESULT_VARIABLE _res
 			)
@@ -532,7 +532,7 @@ function(sbom_finalize)
 			endif()
 
 			execute_process(
-				COMMAND ${Python3_EXECUTABLE} -m ntia_conformance_checker.main
+				COMMAND \"${Python3_EXECUTABLE}\" -m ntia_conformance_checker.main
 				--file \"${_sbom}\"
 				RESULT_VARIABLE _res
 			)
@@ -725,7 +725,7 @@ FileCopyrightText: NOASSERTION${relationship}
 			"
 	)
 
-	install(SCRIPT ${CMAKE_CURRENT_BINARY_DIR}/${SBOM_FILE_SPDXID}.cmake)
+	install(SCRIPT "${CMAKE_CURRENT_BINARY_DIR}/${SBOM_FILE_SPDXID}.cmake")
 endfunction()
 
 # Append a target output to the SBOM. Use this after calling sbom_generate().
@@ -875,7 +875,7 @@ Relationship: ${SBOM_DIRECTORY_RELATIONSHIP}-\${_count}
 			"
 	)
 
-	install(SCRIPT ${CMAKE_CURRENT_BINARY_DIR}/${SBOM_DIRECTORY_SPDXID}.cmake)
+	install(SCRIPT "${CMAKE_CURRENT_BINARY_DIR}/${SBOM_DIRECTORY_SPDXID}.cmake")
 
 	set(SBOM_LAST_SPDXID
 	    ""
@@ -1262,7 +1262,7 @@ function(reuse_lint)
 		add_custom_target(
 			${REUSE_LINT_TARGET}
 			${lint_all}
-			COMMAND ${Python3_EXECUTABLE} -m reuse --root "${PROJECT_SOURCE_DIR}" lint
+			COMMAND "${Python3_EXECUTABLE}" -m reuse --root "${PROJECT_SOURCE_DIR}" lint
 			WORKING_DIRECTORY ${PROJECT_SOURCE_DIR}
 			VERBATIM
 		)
@@ -1274,7 +1274,7 @@ function(reuse_lint)
 		# It seems that there is a race in linting and generating build artifacts. So, run
 		# this (also) during config, to make sure that there is nothing else going on.
 		execute_process(
-			COMMAND ${Python3_EXECUTABLE} -m reuse --root "${PROJECT_SOURCE_DIR}" lint
+			COMMAND "${Python3_EXECUTABLE}" -m reuse --root "${PROJECT_SOURCE_DIR}" lint
 			WORKING_DIRECTORY ${PROJECT_SOURCE_DIR}
 			RESULT_VARIABLE res
 		)
@@ -1306,7 +1306,7 @@ function(reuse_spdx)
 
 		add_custom_target(
 			${REUSE_SPDX_TARGET} ALL
-			COMMAND ${Python3_EXECUTABLE} -m reuse --root "${PROJECT_SOURCE_DIR}" spdx
+			COMMAND "${Python3_EXECUTABLE}" -m reuse --root "${PROJECT_SOURCE_DIR}" spdx
 				-o "${REUSE_SPDX_OUTPUT}"
 			WORKING_DIRECTORY ${PROJECT_SOURCE_DIR}
 			VERBATIM
diff --git a/test/CMakeLists.txt b/test/CMakeLists.txt
index beb719e..6500784 100644
--- a/test/CMakeLists.txt
+++ b/test/CMakeLists.txt
@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: 2023-2025 Jochem Rutgers
+# SPDX-FileCopyrightText: 2023-2026 Jochem Rutgers
 #
 # SPDX-License-Identifier: MIT
 
@@ -48,12 +48,12 @@ include(git_version)
 		${TEST_TARGET}
 		DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/${name}.cmake
 		COMMAND
-			${CMAKE_COMMAND} -E env ${TEST_ENV} ${CMAKE_COMMAND} "${_dir}/src" -G
+			"${CMAKE_COMMAND}" -E env ${TEST_ENV} ${CMAKE_COMMAND} "${_dir}/src" -G
 			"${CMAKE_GENERATOR}" "-DCMAKE_INSTALL_PREFIX=${_dir}/out"
 			"-DCMAKE_MODULE_PATH=${PROJECT_SOURCE_DIR}/cmake"
 			"-DPython3_EXECUTABLE=${Python3_EXECUTABLE}"
 			"-DCMAKE_BUILD_TYPE=${CMAKE_BUILD_TYPE}"
-		COMMAND ${CMAKE_COMMAND} --build . --target install
+		COMMAND "${CMAKE_COMMAND}" --build . --target install
 		WORKING_DIRECTORY "${_dir}/build"
 		COMMENT "Testing ${name}"
 		VERBATIM
diff --git a/test/external.cmake b/test/external.cmake
index caae971..e246a60 100644
--- a/test/external.cmake
+++ b/test/external.cmake
@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: 2023-2024 Jochem Rutgers
+# SPDX-FileCopyrightText: 2023-2026 Jochem Rutgers
 #
 # SPDX-License-Identifier: MIT
 
@@ -13,7 +13,7 @@ file(
 	WRITE ${CMAKE_CURRENT_BINARY_DIR}/other/CMakeLists.txt
 	"
 	project(other)
-	sbom_generate(OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/other-sbom.spdx)
+	sbom_generate(OUTPUT \"${CMAKE_CURRENT_BINARY_DIR}/other-sbom.spdx\")
 	sbom_finalize()
 	"
 )
diff --git a/test/input_doc.cmake b/test/input_doc.cmake
index 6244b6e..b7d937c 100644
--- a/test/input_doc.cmake
+++ b/test/input_doc.cmake
@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: 2023-2024 Jochem Rutgers
+# SPDX-FileCopyrightText: 2023-2026 Jochem Rutgers
 #
 # SPDX-License-Identifier: MIT
 
@@ -6,6 +6,6 @@
 
 include(sbom)
 
-sbom_generate(INPUT @CMAKE_CURRENT_LIST_DIR@/input_doc.spdx.in COPYRIGHT "2023 me")
+sbom_generate(INPUT "@CMAKE_CURRENT_LIST_DIR@/input_doc.spdx.in" COPYRIGHT "2023 me")
 
 sbom_finalize()