feat: update syft license construction to be able to look up by URL (#4132)

---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

internal/spdxlicense/generate/generate_license_list.go

@@ -31,6 +31,13 @@ var licenseIDs = map[string]string{
 	{{ printf "%q" $k }}: {{ printf "%q" $v }},
 {{- end }}
 }
+
+// urlToLicense maps license URLs from the seeAlso field to license IDs
+var urlToLicense = map[string]string{
+{{- range $url, $id := .URLToLicense }}
+	{{ printf "%q" $url }}: {{ printf "%q" $id }},
+{{- end }}
+}
 `))
 
 var versionMatch = regexp.MustCompile(`([0-9]+)\.?([0-9]+)?\.?([0-9]+)?\.?`)
@@ -68,17 +75,20 @@ func run() error {
 	}()
 
 	licenseIDs := processSPDXLicense(result)
+	urlToLicense := buildURLToLicenseMap(result)
 
 	err = tmp.Execute(f, struct {
-		Timestamp  time.Time
-		URL        string
-		Version    string
-		LicenseIDs map[string]string
+		Timestamp    time.Time
+		URL          string
+		Version      string
+		LicenseIDs   map[string]string
+		URLToLicense map[string]string
 	}{
-		Timestamp:  time.Now(),
-		URL:        url,
-		Version:    result.Version,
-		LicenseIDs: licenseIDs,
+		Timestamp:    time.Now(),
+		URL:          url,
+		Version:      result.Version,
+		LicenseIDs:   licenseIDs,
+		URLToLicense: urlToLicense,
 	})
 
 	if err != nil {
@@ -156,3 +166,30 @@ func cleanLicenseID(id string) string {
 	cleanID := strings.ToLower(id)
 	return strings.ReplaceAll(cleanID, "-", "")
 }
+
+// buildURLToLicenseMap creates a mapping from license URLs (from seeAlso fields) to license IDs
+func buildURLToLicenseMap(result LicenseList) map[string]string {
+	urlMap := make(map[string]string)
+
+	for _, l := range result.Licenses {
+		// Skip deprecated licenses
+		if l.Deprecated {
+			// Find replacement license if available
+			replacement := result.findReplacementLicense(l)
+			if replacement != nil {
+				// Map deprecated license URLs to the replacement license
+				for _, url := range l.SeeAlso {
+					urlMap[url] = replacement.ID
+				}
+			}
+			continue
+		}
+
+		// Add URLs from non-deprecated licenses
+		for _, url := range l.SeeAlso {
+			urlMap[url] = l.ID
+		}
+	}
+
+	return urlMap
+}

internal/spdxlicense/license.go

@@ -35,3 +35,20 @@ func cleanLicenseID(id string) string {
 	id = strings.ToLower(id)
 	return strings.ReplaceAll(id, "-", "")
 }
+
+// LicenseInfo contains license ID and name
+type LicenseInfo struct {
+	ID string
+}
+
+// LicenseByURL returns the license ID and name for a given URL from the SPDX license list
+// The URL should match one of the URLs in the seeAlso field of an SPDX license
+func LicenseByURL(url string) (LicenseInfo, bool) {
+	url = strings.TrimSpace(url)
+	if id, exists := urlToLicense[url]; exists {
+		return LicenseInfo{
+			ID: id,
+		}, true
+	}
+	return LicenseInfo{}, false
+}

internal/spdxlicense/license_url_test.go

@@ -0,0 +1,97 @@
+package spdxlicense
+
+import (
+	"testing"
+)
+
+func TestLicenseByURL(t *testing.T) {
+	tests := []struct {
+		name      string
+		url       string
+		wantID    string
+		wantFound bool
+	}{
+		{
+			name:      "MIT license URL (https)",
+			url:       "https://opensource.org/license/mit/",
+			wantID:    "MIT",
+			wantFound: true,
+		},
+		{
+			name:      "MIT license URL (http)",
+			url:       "http://opensource.org/licenses/MIT",
+			wantID:    "MIT",
+			wantFound: true,
+		},
+		{
+			name:      "Apache 2.0 license URL",
+			url:       "https://www.apache.org/licenses/LICENSE-2.0",
+			wantID:    "Apache-2.0",
+			wantFound: true,
+		},
+		{
+			name:      "GPL 3.0 or later URL",
+			url:       "https://www.gnu.org/licenses/gpl-3.0-standalone.html",
+			wantID:    "GPL-3.0-or-later",
+			wantFound: true,
+		},
+		{
+			name:      "BSD 3-Clause URL",
+			url:       "https://opensource.org/licenses/BSD-3-Clause",
+			wantID:    "BSD-3-Clause",
+			wantFound: true,
+		},
+		{
+			name:      "URL with trailing whitespace",
+			url:       "  http://opensource.org/licenses/MIT  ",
+			wantID:    "MIT",
+			wantFound: true,
+		},
+		{
+			name:      "Unknown URL",
+			url:       "https://example.com/unknown-license",
+			wantID:    "",
+			wantFound: false,
+		},
+		{
+			name:      "Empty URL",
+			url:       "",
+			wantID:    "",
+			wantFound: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			info, found := LicenseByURL(tt.url)
+			if found != tt.wantFound {
+				t.Errorf("LicenseByURL() found = %v, want %v", found, tt.wantFound)
+			}
+			if found {
+				if info.ID != tt.wantID {
+					t.Errorf("LicenseByURL() ID = %v, want %v", info.ID, tt.wantID)
+				}
+			}
+		})
+	}
+}
+
+func TestLicenseByURL_DeprecatedLicenses(t *testing.T) {
+	// Test that deprecated license URLs map to their replacement licenses
+	// For example, GPL-2.0+ should map to GPL-2.0-or-later
+
+	// This test needs actual URLs from deprecated licenses
+	// We can verify by checking if a deprecated license URL maps to a non-deprecated ID
+	url := "https://www.gnu.org/licenses/old-licenses/gpl-2.0-standalone.html"
+	info, found := LicenseByURL(url)
+
+	if found {
+		// Check that we got a valid non-deprecated license ID
+		if info.ID == "" {
+			t.Error("Got empty license ID for deprecated license URL")
+		}
+		// The ID should be the replacement (GPL-2.0-only or GPL-2.0-or-later)
+		// depending on the URL
+		t.Logf("Deprecated license URL mapped to: ID=%s", info.ID)
+	}
+}