def ImportBom(bompath, curs):
    """
    Imports package data into our internal package database
    using a combination of the bom file and data in Apple's
    package database into our internal package database.
    """
    # If we completely trusted the accuracy of Apple's database, we wouldn't
    # need the bom files, but in my environment at least, the bom files are
    # a better indicator of what flat packages have actually been installed
    # on the current machine.
    # We still need to consult Apple's package database
    # because the bom files are missing metadata about the package.

    pkgname = os.path.basename(bompath)

    timestamp = os.stat(bompath).st_mtime
    owner = 0
    pkgid = os.path.splitext(pkgname)[0]
    vers = "1.0"
    ppath = ""

    # try to get metadata from applepkgdb
    proc = subprocess.Popen(["/usr/sbin/pkgutil", "--pkg-info-plist", pkgid],
                            bufsize=1, stdout=subprocess.PIPE,
                            stderr=subprocess.PIPE)
    (pliststr, dummy_err) = proc.communicate()
    if pliststr:
        plist = FoundationPlist.readPlistFromString(pliststr)
        if "install-location" in plist:
            ppath = plist["install-location"]
            ppath = ppath.lstrip('./').rstrip('/')
        if "pkg-version" in plist:
            vers = plist["pkg-version"]
        if "install-time" in plist:
            timestamp = plist["install-time"]

    values_t = (timestamp, owner, pkgid, vers, ppath, pkgname)
    curs.execute(
        '''INSERT INTO pkgs (timestamp, owner, pkgid, vers, ppath, pkgname)
           values (?, ?, ?, ?, ?, ?)''', values_t)
    pkgkey = curs.lastrowid

    cmd = ["/usr/bin/lsbom", bompath]
    proc = subprocess.Popen(cmd, shell=False, bufsize=1,
                            stdin=subprocess.PIPE,
                            stdout=subprocess.PIPE, stderr=subprocess.STDOUT)

    while True:
        line = proc.stdout.readline().decode('UTF-8')
        if not line and (proc.poll() != None):
            break
        try:
            item = line.rstrip("\n").split("\t")
            path = item[0]
            perms = item[1]
            uidgid = item[2].split("/")
            uid = uidgid[0]
            gid = uidgid[1]
        except __HOLE__:
            # we really only care about the path
            perms = "0000"
            uid = "0"
            gid = "0"

        if path != ".":
            # special case for MS Office 2008 installers
            if ppath == "tmp/com.microsoft.updater/office_location":
                ppath = "Applications"

            #prepend the ppath so the paths match the actual install locations
            path = path.lstrip("./")
            if ppath:
                path = ppath + "/" + path

            values_t = (path, )
            row = curs.execute(
                'SELECT path_key from paths where path = ?',
                values_t).fetchone()
            if not row:
                curs.execute(
                    'INSERT INTO paths (path) values (?)', values_t)
                pathkey = curs.lastrowid
            else:
                pathkey = row[0]

            values_t = (pkgkey, pathkey, uid, gid, perms)
            curs.execute(
                'INSERT INTO pkgs_paths (pkg_key, path_key, uid, gid, perms) '
                'values (?, ?, ?, ?, ?)', values_t)
dataset/ETHPy150Open munki/munki/code/client/munkilib/removepackages.py/ImportBom