oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2025-11-18 17:03:17 +01:00
Code Issues Packages Projects Releases Wiki Activity

Parse Python licenses from LicenseExpression entry in the Wheel Metadata (#2431)

Browse Source 
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
This commit is contained in:
Colm O hEigeartaigh 2023-12-14 17:41:41 +00:00 committed by GitHub
parent f5d5892434
commit 649d152548
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 12 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
syft/pkg/cataloger/python/package.go
View File

@ -59,9 +59,13 @@ func newPackageForRequirementsWithMetadata(name, version string, metadata pkg.Py
func newPackageForPackage(resolver file.Resolver, m parsedData, sources ...file.Location) pkg.Package { func newPackageForPackage(resolver file.Resolver, m parsedData, sources ...file.Location) pkg.Package {
var licenseSet pkg.LicenseSet var licenseSet pkg.LicenseSet
if m.Licenses != "" {
switch {
case m.LicenseExpression != "":
licenseSet = pkg.NewLicenseSet(pkg.NewLicensesFromLocation(m.LicenseLocation, m.LicenseExpression)...)
case m.Licenses != "":
licenseSet = pkg.NewLicenseSet(pkg.NewLicensesFromLocation(m.LicenseLocation, m.Licenses)...) licenseSet = pkg.NewLicenseSet(pkg.NewLicensesFromLocation(m.LicenseLocation, m.Licenses)...)
} else if m.LicenseLocation.Path() != "" { case m.LicenseLocation.Path() != "":
// If we have a license file then resolve and parse it // If we have a license file then resolve and parse it
found, err := resolver.FilesByPath(m.LicenseLocation.Path()) found, err := resolver.FilesByPath(m.LicenseLocation.Path())
if err != nil { if err != nil {
@ -82,6 +86,7 @@ func newPackageForPackage(resolver file.Resolver, m parsedData, sources ...file.
} }
} }
} }
p := pkg.Package{ p := pkg.Package{
Name: m.Name, Name: m.Name,
Version: m.Version, Version: m.Version,

3
syft/pkg/cataloger/python/parse_wheel_egg_metadata.go
View File

@ -18,6 +18,7 @@ import (
type parsedData struct { type parsedData struct {
Licenses string `mapstructure:"License"` Licenses string `mapstructure:"License"`
LicenseFile string `mapstructure:"LicenseFile"` LicenseFile string `mapstructure:"LicenseFile"`
LicenseExpression string `mapstructure:"LicenseExpression"`
LicenseLocation file.Location LicenseLocation file.Location
pkg.PythonPackage `mapstructure:",squash"` pkg.PythonPackage `mapstructure:",squash"`
} }
@ -81,7 +82,7 @@ func parseWheelOrEggMetadata(path string, reader io.Reader) (parsedData, error)
// add additional metadata not stored in the egg/wheel metadata file // add additional metadata not stored in the egg/wheel metadata file
pd.SitePackagesRootPath = determineSitePackagesRootPath(path) pd.SitePackagesRootPath = determineSitePackagesRootPath(path)
if pd.Licenses != "" { if pd.Licenses != "" || pd.LicenseExpression != "" {
pd.LicenseLocation = file.NewLocation(path) pd.LicenseLocation = file.NewLocation(path)
} else if pd.LicenseFile != "" { } else if pd.LicenseFile != "" {
pd.LicenseLocation = file.NewLocation(filepath.Join(filepath.Dir(path), pd.LicenseFile)) pd.LicenseLocation = file.NewLocation(filepath.Join(filepath.Dir(path), pd.LicenseFile))

3
syft/pkg/cataloger/python/parse_wheel_egg_metadata_test.go
View File

@ -20,6 +20,7 @@ func TestParseWheelEggMetadata(t *testing.T) {
ExpectedMetadata: parsedData{ ExpectedMetadata: parsedData{
"Apache 2.0", "Apache 2.0",
"", "",
"",
file.NewLocation("test-fixtures/egg-info/PKG-INFO"), file.NewLocation("test-fixtures/egg-info/PKG-INFO"),
pkg.PythonPackage{ pkg.PythonPackage{
Name: "requests", Name: "requests",
@ -36,6 +37,7 @@ func TestParseWheelEggMetadata(t *testing.T) {
ExpectedMetadata: parsedData{ ExpectedMetadata: parsedData{
"BSD License", "BSD License",
"", "",
"",
file.NewLocation("test-fixtures/dist-info/METADATA"), file.NewLocation("test-fixtures/dist-info/METADATA"),
pkg.PythonPackage{ pkg.PythonPackage{
Name: "Pygments", Name: "Pygments",
@ -136,6 +138,7 @@ func TestParseWheelEggMetadataInvalid(t *testing.T) {
{ {
Fixture: "test-fixtures/egg-info/PKG-INFO-INVALID", Fixture: "test-fixtures/egg-info/PKG-INFO-INVALID",
ExpectedMetadata: parsedData{ ExpectedMetadata: parsedData{
"",
"", "",
"", "",
file.Location{}, file.Location{},