oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-11-05 00:46:38 +01:00
Code Issues Packages Projects Releases Wiki Activity

feat: update syft license construction to be able to look up by URL (#4132)

Browse Source 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
This commit is contained in:
Christopher Angelo Phillips
2025-08-12 14:30:32 -04:00
committed by GitHub
parent 104df88143
commit 89470ecdd3
10 changed files with 1446 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
syft/pkg/license.go
+21 -2
View File
@@ -14,6 +14,7 @@ import (
"github.com/anchore/syft/internal/licenses"
"github.com/anchore/syft/internal/log"
"github.com/anchore/syft/internal/spdxlicense"
"github.com/anchore/syft/syft/artifact"
"github.com/anchore/syft/syft/file"
"github.com/anchore/syft/syft/license"
@@ -132,6 +133,13 @@ func stripUnwantedCharacters(rawURL string) (string, error) {
}
func NewLicenseFromFieldsWithContext(ctx context.Context, value, url string, location *file.Location) License {
// If value is empty but URL is provided, try to enrich from SPDX database
if value == "" && url != "" {
if info, found := spdxlicense.LicenseByURL(url); found {
value = info.ID
}
}
lics := newLicenseBuilder().WithValues(value).WithURLs(url).WithOptionalLocation(location).Build(ctx).ToSlice()
if len(lics) > 0 {
return lics[0]
@@ -294,11 +302,22 @@ func (b *licenseBuilder) Build(ctx context.Context) LicenseSet {
if set.Empty() && len(b.urls) > 0 {
// if we have no values or contents, but we do have URLs, let's make a license with the URLs
set.Add(License{
// try to enrich the license by looking up the URL in the SPDX database
license := License{
Type: b.tp,
URLs: b.urls,
Locations: locations,
})
}
// attempt to fill in missing license information from the first URL
if len(b.urls) > 0 {
if info, found := spdxlicense.LicenseByURL(b.urls[0]); found {
license.Value = info.ID
license.SPDXExpression = info.ID
}
}
set.Add(license)
}
return set
syft/pkg/license_url_enrichment_test.go
+180
View File
@@ -0,0 +1,180 @@
package pkg
import (
"context"
"testing"
)
func TestNewLicenseFromFieldsWithContext_URLEnrichment(t *testing.T) {
tests := []struct {
name string
value string
url string
wantValue string
wantHasURL bool
}{
{
name: "Empty value with MIT URL should enrich",
value: "",
url: "http://opensource.org/licenses/MIT",
wantValue: "MIT",
wantHasURL: true,
},
{
name: "Empty value with Apache URL should enrich",
value: "",
url: "https://www.apache.org/licenses/LICENSE-2.0",
wantValue: "Apache-2.0",
wantHasURL: true,
},
{
name: "Non-empty value should not be overridden",
value: "Custom-License",
url: "http://opensource.org/licenses/MIT",
wantValue: "Custom-License",
wantHasURL: true,
},
{
name: "Unknown URL should not enrich",
value: "",
url: "https://example.com/unknown-license",
wantValue: "",
wantHasURL: true,
},
{
name: "Empty value and empty URL",
value: "",
url: "",
wantValue: "",
wantHasURL: false,
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
ctx := context.Background()
license := NewLicenseFromFieldsWithContext(ctx, tt.value, tt.url, nil)
if license.Value != tt.wantValue {
t.Errorf("NewLicenseFromFieldsWithContext() Value = %v, want %v", license.Value, tt.wantValue)
}
hasURL := len(license.URLs) > 0
if hasURL != tt.wantHasURL {
t.Errorf("NewLicenseFromFieldsWithContext() has URL = %v, want %v", hasURL, tt.wantHasURL)
}
if tt.wantHasURL && tt.url != "" && license.URLs[0] != tt.url {
t.Errorf("NewLicenseFromFieldsWithContext() URL = %v, want %v", license.URLs[0], tt.url)
}
})
}
}
func TestLicenseBuilder_URLOnlyEnrichment(t *testing.T) {
tests := []struct {
name string
urls []string
wantValue string
wantSPDX string
wantHasURL bool
}{
{
name: "MIT URL only should enrich",
urls: []string{"http://opensource.org/licenses/MIT"},
wantValue: "MIT",
wantSPDX: "MIT",
wantHasURL: true,
},
{
name: "Apache URL only should enrich",
urls: []string{"https://www.apache.org/licenses/LICENSE-2.0"},
wantValue: "Apache-2.0",
wantSPDX: "Apache-2.0",
wantHasURL: true,
},
{
name: "Multiple URLs should use first",
urls: []string{"http://opensource.org/licenses/MIT", "https://example.com/other"},
wantValue: "MIT",
wantSPDX: "MIT",
wantHasURL: true,
},
{
name: "Unknown URL should not enrich",
urls: []string{"https://example.com/unknown-license"},
wantValue: "",
wantSPDX: "",
wantHasURL: true,
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
ctx := context.Background()
builder := newLicenseBuilder().WithURLs(tt.urls...)
licenses := builder.Build(ctx).ToSlice()
if len(licenses) == 0 {
t.Fatal("Expected at least one license")
}
license := licenses[0]
if license.Value != tt.wantValue {
t.Errorf("License Value = %v, want %v", license.Value, tt.wantValue)
}
if license.SPDXExpression != tt.wantSPDX {
t.Errorf("License SPDXExpression = %v, want %v", license.SPDXExpression, tt.wantSPDX)
}
hasURL := len(license.URLs) > 0
if hasURL != tt.wantHasURL {
t.Errorf("License has URL = %v, want %v", hasURL, tt.wantHasURL)
}
if tt.wantHasURL && len(tt.urls) > 0 {
if len(license.URLs) != len(tt.urls) {
t.Errorf("License URL count = %v, want %v", len(license.URLs), len(tt.urls))
}
if license.URLs[0] != tt.urls[0] {
t.Errorf("License first URL = %v, want %v", license.URLs[0], tt.urls[0])
}
}
})
}
}
func TestNewLicenseFromURLsWithContext_URLEnrichment(t *testing.T) {
tests := []struct {
name string
value string
urls []string
wantValue string
}{
{
name: "Empty value with MIT URL should enrich via builder",
value: "",
urls: []string{"http://opensource.org/licenses/MIT"},
wantValue: "MIT",
},
{
name: "Non-empty value should not be changed",
value: "Custom-License",
urls: []string{"http://opensource.org/licenses/MIT"},
wantValue: "Custom-License",
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
ctx := context.Background()
license := NewLicenseFromURLsWithContext(ctx, tt.value, tt.urls...)
if license.Value != tt.wantValue {
t.Errorf("NewLicenseFromURLsWithContext() Value = %v, want %v", license.Value, tt.wantValue)
}
})
}
}