Update stereoscope to get rid of the replace directive (#1140 )

Correct squashfs import and fix incorrect bouncer configuration (#1138 )
Overwrite deprecated SPDX licenses automatically (#1009 )
2026-10-20 18:12:32 +02:00 · 2022-08-03 12:24:20 -04:00 · 2022-08-03 09:46:14 -04:00 · 2022-08-02 15:25:33 -04:00 · 2022-08-02 14:47:07 -04:00
16 changed files with 7678 additions and 244 deletions
@@ -1,11 +1,13 @@
 permit:
  - BSD.*
+  - CC0.*
  - MIT.*
  - Apache.*
  - MPL.*
  - ISC
+  - WTFPL
+
 ignore-packages:
-  - .
  # packageurl-go is released under the MIT license located in the root of the repo at /mit.LICENSE
  - github.com/anchore/packageurl-go

@@ -49,4 +51,4 @@ ignore-packages:
  - modernc.org/libc/uuid/uuid
  - modernc.org/libc/wctype
  - modernc.org/mathutil
-  - modernc.org/memory
+  - modernc.org/memory
@@ -148,7 +148,7 @@ jobs:
        with:
          status: ${{ job.status }}
          fields: repo,workflow,action,eventName
-          text: "A new Syft release is ready to be manually published: https://github.com/anchore/syft/releases"
+          text: "A new Syft release has been published: https://github.com/anchore/syft/releases/tag/${{ github.ref_name }}"
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_TOOLBOX_WEBHOOK_URL }}
        if: ${{ success() }}
@@ -4,6 +4,9 @@
 # https://github.com/anchore/syft/issues/577
 # https://github.com/anchore/syft/issues/519
 # https://github.com/anchore/syft/issues/576
+release:
+  disable: true
+
 env:
  # required to support multi architecture docker builds
  - DOCKER_CLI_EXPERIMENTAL=enabled
@@ -147,7 +147,7 @@ lint-fix: ## Auto-format all source code + run golangci lint fixers

 .PHONY: check-licenses
 check-licenses: ## Ensure transitive dependencies are compliant with the current license policy
-	$(TEMPDIR)/bouncer check ./cmd/syft
+	$(TEMPDIR)/bouncer check ./...

 check-go-mod-tidy:
 	@ .github/scripts/go-mod-tidy-check.sh && echo "go.mod and go.sum are tidy!"
@@ -13,7 +13,7 @@ require (
 	github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
 	github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
 	github.com/anchore/packageurl-go v0.1.1-0.20220428202044-a072fa3cb6d7
-	github.com/anchore/stereoscope v0.0.0-20220802140318-49d33a1fb915
+	github.com/anchore/stereoscope v0.0.0-20220803153229-c55b13fee7e4
 	github.com/antihax/optional v1.0.0
 	github.com/bmatcuk/doublestar/v4 v4.0.2
 	github.com/dustin/go-humanize v1.0.0
@@ -79,7 +79,6 @@ require (
 	github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect
 	github.com/Azure/go-autorest/logger v0.2.1 // indirect
 	github.com/Azure/go-autorest/tracing v0.6.0 // indirect
-	github.com/CalebQ42/squashfs v0.5.4 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Masterminds/semver/v3 v3.1.1 // indirect
 	github.com/Microsoft/go-winio v0.5.2 // indirect
@@ -216,7 +215,6 @@ require (
 	github.com/prometheus/client_model v0.2.0 // indirect
 	github.com/prometheus/common v0.34.0 // indirect
 	github.com/prometheus/procfs v0.7.3 // indirect
-	github.com/rasky/go-lzo v0.0.0-20200203143853-96a758eda86e // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0 // indirect
 	github.com/rivo/uniseg v0.2.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
@@ -234,6 +232,7 @@ require (
 	github.com/stretchr/objx v0.4.0 // indirect
 	github.com/subosito/gotenv v1.3.0 // indirect
 	github.com/sylabs/sif/v2 v2.7.0 // indirect
+	github.com/sylabs/squashfs v0.5.5-0.20220803150326-9393a0b4cef5 // indirect
 	github.com/syndtr/goleveldb v1.0.1-0.20210819022825-2ae1ddf74ef7 // indirect
 	github.com/tent/canonical-json-go v0.0.0-20130607151641-96e4ba3a7613 // indirect
 	github.com/thales-e-security/pool v0.0.2 // indirect
@@ -162,8 +162,6 @@ github.com/BurntSushi/toml v0.4.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbi
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/CalebQ42/GoAppImage v0.5.0 h1:znoKNXtliH754tS9sYwyOIg/0wFDjFN5Twc7PAh1rSM=
 github.com/CalebQ42/GoAppImage v0.5.0/go.mod h1:qHudJKAn/dlkNWNnH4h1YKXp29EZ7Bppsn7sNP2HuvU=
-github.com/CalebQ42/squashfs v0.5.4 h1:Ju5EwUob8j3ShkhqqYZzaX8wB9j3N81o0iYQaIPXL7w=
-github.com/CalebQ42/squashfs v0.5.4/go.mod h1:odzrLJgn0aKn2+xOsCH97c81DU/xZfTzeFBqV5ob2g4=
 github.com/CycloneDX/cyclonedx-go v0.5.2 h1:CkdGw2R/tZWmEbSypJVZG+3+2SAsDjJirfIrG/RbIVg=
 github.com/CycloneDX/cyclonedx-go v0.5.2/go.mod h1:nQCiF4Tvrg5Ieu8qPhYMvzPGMu5I7fANZkrSsJjl5mg=
 github.com/DataDog/datadog-go v3.2.0+incompatible/go.mod h1:LButxg5PwREeZtORoXG3tL4fMGNddJ+vMq1mwgfaqoQ=
@@ -256,8 +254,8 @@ github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b h1:e1bmaoJfZV
 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b/go.mod h1:Bkc+JYWjMCF8OyZ340IMSIi2Ebf3uwByOk6ho4wne1E=
 github.com/anchore/packageurl-go v0.1.1-0.20220428202044-a072fa3cb6d7 h1:kDrYkTSM9uIxaX/P9s0F4nKYNM+hnSgLJdLpqvsaQ/g=
 github.com/anchore/packageurl-go v0.1.1-0.20220428202044-a072fa3cb6d7/go.mod h1:Blo6OgJNiYF41ufcgHKkbCKF2MDOMlrqhXv/ij6ocR4=
-github.com/anchore/stereoscope v0.0.0-20220802140318-49d33a1fb915 h1:VKva4g42RnLztyCdjs1FWvqz7zWBWC6H8yScJYTffc4=
-github.com/anchore/stereoscope v0.0.0-20220802140318-49d33a1fb915/go.mod h1:H0QxjoKdQTceA1lZOhS3+5ZCvXYaIv+gdbuO+pTj4As=
+github.com/anchore/stereoscope v0.0.0-20220803153229-c55b13fee7e4 h1:OMc0B7MxfjfqagdgboPFVJzsDJbFk7J7NXhgTTnhvuo=
+github.com/anchore/stereoscope v0.0.0-20220803153229-c55b13fee7e4/go.mod h1:90tB0wMdDe2V8fB52tPf1xjg/ieLoWayRu8YJNd9c7w=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/andybalholm/brotli v1.0.1/go.mod h1:loMXtMfwqflxFJPmdbJO0a3KNoPuLBgiu3qAvBg8x/Y=
 github.com/andybalholm/brotli v1.0.2/go.mod h1:loMXtMfwqflxFJPmdbJO0a3KNoPuLBgiu3qAvBg8x/Y=
@@ -1663,8 +1661,6 @@ github.com/quasilyte/go-ruleguard/rules v0.0.0-20201231183845-9e62ed36efe1/go.mo
 github.com/quasilyte/go-ruleguard/rules v0.0.0-20210428214800-545e0d2e0bf7/go.mod h1:4cgAphtvu7Ftv7vOT2ZOYhC6CvBxZixcasr8qIOTA50=
 github.com/quasilyte/regex/syntax v0.0.0-20200407221936-30656e2c4a95/go.mod h1:rlzQ04UMyJXu/aOvhd8qT+hvDrFpiwqp8MRXDY9szc0=
 github.com/qur/ar v0.0.0-20130629153254-282534b91770/go.mod h1:SjlYv2m9lpV0UW6K7lDqVJwEIIvSjaHbGk7nIfY8Hxw=
-github.com/rasky/go-lzo v0.0.0-20200203143853-96a758eda86e h1:dCWirM5F3wMY+cmRda/B1BiPsFtmzXqV9b0hLWtVBMs=
-github.com/rasky/go-lzo v0.0.0-20200203143853-96a758eda86e/go.mod h1:9leZcVcItj6m9/CfHY5Em/iBrCz7js8LcRQGTKEEv2M=
 github.com/rcrowley/go-metrics v0.0.0-20181016184325-3113b8401b8a/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
 github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0 h1:OdAsTTz6OkFY5QxjkYwrChwuRruF69c169dPK26NUlk=
 github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
@@ -1850,6 +1846,8 @@ github.com/subosito/gotenv v1.3.0 h1:mjC+YW8QpAdXibNi+vNWgzmgBH4+5l5dCXv8cNysBLI
 github.com/subosito/gotenv v1.3.0/go.mod h1:YzJjq/33h7nrwdY+iHMhEOEEbW0ovIz0tB6t6PwAXzs=
 github.com/sylabs/sif/v2 v2.7.0 h1:VFzN8alnJ/3n1JA0K9DyUtfSzezWgWrzLDcYGhgBskk=
 github.com/sylabs/sif/v2 v2.7.0/go.mod h1:TiyBWsgWeh5yBeQFNuQnvROwswqK7YJT8JA1L53bsXQ=
+github.com/sylabs/squashfs v0.5.5-0.20220803150326-9393a0b4cef5 h1:OfmBgc/n/FAKrtK5TEkX2sqQo5zMBb/4EFEQQAKKrro=
+github.com/sylabs/squashfs v0.5.5-0.20220803150326-9393a0b4cef5/go.mod h1:lGupCIjaVP476d0G7UppFr3h123OsNLGRCtm6rgwPwA=
 github.com/sylvia7788/contextcheck v1.0.4/go.mod h1:vuPKJMQ7MQ91ZTqfdyreNKwZjyUg6KO+IebVyQDedZQ=
 github.com/syndtr/gocapability v0.0.0-20170704070218-db04d3cc01c8/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
 github.com/syndtr/gocapability v0.0.0-20180916011248-d98352740cb2/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
@@ -49,7 +49,7 @@ func Test_encodeLicense(t *testing.T) {
 			},
 			expected: &cyclonedx.Licenses{
 				{License: &cyclonedx.License{ID: "MIT"}},
-				{License: &cyclonedx.License{ID: "GPL-3.0"}},
+				{License: &cyclonedx.License{ID: "GPL-3.0-only"}},
 			},
 		},
 		{
@@ -60,7 +60,7 @@ func Test_encodeLicense(t *testing.T) {
 				},
 			},
 			expected: &cyclonedx.Licenses{
-				{License: &cyclonedx.License{ID: "GPL-3.0"}},
+				{License: &cyclonedx.License{ID: "GPL-3.0-only"}},
 			},
 		},
 		{
@@ -71,7 +71,7 @@ func Test_encodeLicense(t *testing.T) {
 				},
 			},
 			expected: &cyclonedx.Licenses{
-				{License: &cyclonedx.License{ID: "GPL-2.0"}},
+				{License: &cyclonedx.License{ID: "GPL-2.0-only"}},
 			},
 		},
 	}
@@ -44,7 +44,7 @@ func Test_License(t *testing.T) {
 					"GPL-3.0",
 				},
 			},
-			expected: "MIT AND GPL-3.0",
+			expected: "MIT AND GPL-3.0-only",
 		},
 		{
 			name: "cap insensitive",
@@ -53,7 +53,7 @@ func Test_License(t *testing.T) {
 					"gpl-3.0",
 				},
 			},
-			expected: "GPL-3.0",
+			expected: "GPL-3.0-only",
 		},
 		{
 			name: "debian to spdx conversion",
@@ -62,7 +62,7 @@ func Test_License(t *testing.T) {
 					"GPL-2",
 				},
 			},
-			expected: "GPL-2.0",
+			expected: "GPL-2.0-only",
 		},
 	}
 	for _, test := range tests {
@@ -37,18 +37,6 @@ var licenseIDs = map[string]string{

 var versionMatch = regexp.MustCompile(`-([0-9]+)\.?([0-9]+)?\.?([0-9]+)?\.?`)

-type LicenseList struct {
-	Version  string `json:"licenseListVersion"`
-	Licenses []struct {
-		ID          string   `json:"licenseId"`
-		Name        string   `json:"name"`
-		Text        string   `json:"licenseText"`
-		Deprecated  bool     `json:"isDeprecatedLicenseId"`
-		OSIApproved bool     `json:"isOsiApproved"`
-		SeeAlso     []string `json:"seeAlso"`
-	} `json:"licenses"`
-}
-
 func main() {
 	if err := run(); err != nil {
 		fmt.Println(err.Error())
@@ -102,8 +90,9 @@ func run() error {
 	return nil
 }

-// Parsing the provided SPDX license list necessitates a two pass approach.
-// The first pass is only related to what SPDX considers the truth. These K:V pairs will never be overwritten.
+// Parsing the provided SPDX license list necessitates a three pass approach.
+// The first pass is only related to what SPDX considers the truth. We use license info to
+// find replacements for deprecated licenses.
 // The second pass attempts to generate known short/long version listings for each key.
 // For info on some short name conventions see this document:
 // https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/#license-short-name.
@@ -111,6 +100,8 @@ func run() error {
 // The new keys are then also associated with their relative SPDX value. If a key has already been entered
 // we know to ignore it since it came from the first pass which is considered the SPDX source of truth.
 // We also sort the licenses for the second pass so that cases like `GPL-1` associate to `GPL-1.0` and not `GPL-1.1`.
+// The third pass is for overwriting deprecated licenses with replacements, for example GPL-2.0+ is deprecated
+// and now maps to GPL-2.0-or-later.
 func processSPDXLicense(result LicenseList) map[string]string {
 	// first pass build map
 	var licenseIDs = make(map[string]string)
@@ -122,69 +113,48 @@ func processSPDXLicense(result LicenseList) map[string]string {
 		licenseIDs[cleanID] = l.ID
 	}

+	// The order of variations/permutations of a license ID matters because of we how shuffle its digits,
+	// that is because the permutation code can generate the same value for two difference licenses,
+	// for example: The licenses `ABC-1.0` and `ABC-1.1` can both map to `ABC-1`,
+	// so we need to guarantee the order they are created to avoid mapping them wrongly. So we use a sorted list.
+	// To overwrite deprecated licenses during the first pass we would later on rely on map order,
+	// [which in go is not consistent by design](https://stackoverflow.com/a/55925880).
 	sort.Slice(result.Licenses, func(i, j int) bool {
 		return result.Licenses[i].ID < result.Licenses[j].ID
 	})

-	// second pass build exceptions
-	// do not overwrite if already exists
+	// second pass to build exceptions and replacements
+	replaced := strset.New()
 	for _, l := range result.Licenses {
 		var multipleID []string
 		cleanID := strings.ToLower(l.ID)
+
+		var replacement *License
+		if l.Deprecated {
+			replacement = result.findReplacementLicense(l)
+			if replacement != nil {
+				licenseIDs[cleanID] = replacement.ID
+			}
+		}
+
 		multipleID = append(multipleID, buildLicensePermutations(cleanID)...)
 		for _, id := range multipleID {
-			if _, exists := licenseIDs[id]; !exists {
-				licenseIDs[id] = l.ID
+			// don't make replacements for IDs that have already been replaced. Since we have a sorted license list
+			// the earliest replacement is correct (any future replacements are not.
+			// e.g. replace lgpl-2 with LGPL-2.1-only is wrong, but with LGPL-2.0-only is correct)
+			if replacement == nil || replaced.Has(id) {
+				if _, exists := licenseIDs[id]; !exists {
+					licenseIDs[id] = l.ID
+				}
+			} else {
+				// a useful debugging line during builds
+				log.Printf("replacing %s with %s\n", id, replacement.ID)
+
+				licenseIDs[id] = replacement.ID
+				replaced.Add(id)
 			}
 		}
 	}

 	return licenseIDs
 }
-
-func buildLicensePermutations(license string) (perms []string) {
-	lv := findLicenseVersion(license)
-	vp := versionPermutations(lv)
-
-	version := strings.Join(lv, ".")
-	for _, p := range vp {
-		perms = append(perms, strings.Replace(license, version, p, 1))
-	}
-
-	return perms
-}
-
-func findLicenseVersion(license string) (version []string) {
-	versionList := versionMatch.FindAllStringSubmatch(license, -1)
-
-	if len(versionList) == 0 {
-		return version
-	}
-
-	for i, v := range versionList[0] {
-		if v != "" && i != 0 {
-			version = append(version, v)
-		}
-	}
-
-	return version
-}
-
-func versionPermutations(version []string) []string {
-	ver := append([]string(nil), version...)
-	perms := strset.New()
-	for i := 1; i <= 3; i++ {
-		if len(ver) < i+1 {
-			ver = append(ver, "0")
-		}
-
-		perm := strings.Join(ver[:i], ".")
-		badCount := strings.Count(perm, "0") + strings.Count(perm, ".")
-
-		if badCount != len(perm) {
-			perms.Add(perm)
-		}
-	}
-
-	return perms.List()
-}
@@ -0,0 +1,104 @@
+package main
+
+import (
+	"strings"
+
+	"github.com/scylladb/go-set/strset"
+)
+
+type LicenseList struct {
+	Version  string    `json:"licenseListVersion"`
+	Licenses []License `json:"licenses"`
+}
+
+type License struct {
+	ID          string   `json:"licenseId"`
+	Name        string   `json:"name"`
+	Text        string   `json:"licenseText"`
+	Deprecated  bool     `json:"isDeprecatedLicenseId"`
+	OSIApproved bool     `json:"isOsiApproved"`
+	SeeAlso     []string `json:"seeAlso"`
+}
+
+func (l License) canReplace(other License) bool {
+	if l.Deprecated {
+		return false
+	}
+
+	if l.Name != other.Name {
+		return false
+	}
+
+	if l.OSIApproved != other.OSIApproved {
+		return false
+	}
+
+	if len(l.SeeAlso) != len(other.SeeAlso) {
+		return false
+	}
+
+	for i, sa := range l.SeeAlso {
+		if sa != other.SeeAlso[i] {
+			return false
+		}
+	}
+
+	return l.ID != other.ID
+}
+
+func (ll LicenseList) findReplacementLicense(deprecated License) *License {
+	for _, l := range ll.Licenses {
+		if l.canReplace(deprecated) {
+			return &l
+		}
+	}
+
+	return nil
+}
+
+func buildLicensePermutations(license string) (perms []string) {
+	lv := findLicenseVersion(license)
+	vp := versionPermutations(lv)
+
+	version := strings.Join(lv, ".")
+	for _, p := range vp {
+		perms = append(perms, strings.Replace(license, version, p, 1))
+	}
+
+	return perms
+}
+
+func findLicenseVersion(license string) (version []string) {
+	versionList := versionMatch.FindAllStringSubmatch(license, -1)
+
+	if len(versionList) == 0 {
+		return version
+	}
+
+	for i, v := range versionList[0] {
+		if v != "" && i != 0 {
+			version = append(version, v)
+		}
+	}
+
+	return version
+}
+
+func versionPermutations(version []string) []string {
+	ver := append([]string(nil), version...)
+	perms := strset.New()
+	for i := 1; i <= 3; i++ {
+		if len(ver) < i+1 {
+			ver = append(ver, "0")
+		}
+
+		perm := strings.Join(ver[:i], ".")
+		badCount := strings.Count(perm, "0") + strings.Count(perm, ".")
+
+		if badCount != len(perm) {
+			perms.Add(perm)
+		}
+	}
+
+	return perms.List()
+}
@@ -0,0 +1,220 @@
+package main
+
+import (
+	"github.com/stretchr/testify/assert"
+	"strings"
+	"testing"
+)
+
+var (
+	license1 = License{
+		ID:         "ABC-1.0+",
+		Name:       "The ABC License 1.0",
+		Deprecated: true,
+	}
+
+	license2 = License{
+		ID:   "ABC-1.0-Or-later",
+		Name: "The ABC License 1.0",
+	}
+
+	license3 = License{
+		ID:         "ABC-1.0",
+		Name:       "The ABC License 1.0 Only",
+		Deprecated: true,
+	}
+
+	license4 = License{
+		ID:   "ABC-1.0-Only",
+		Name: "The ABC License 1.0 Only",
+	}
+	license5 = License{
+		ID:         "Duh-1.0",
+		Name:       "The Duh License 1.0",
+		Deprecated: true,
+	}
+	license6 = License{
+		ID:         "Duh-1.0-duh",
+		Name:       "The Duh License 1.0",
+		Deprecated: true,
+	}
+)
+
+func TestLicense_canReplace(t *testing.T) {
+	tests := []struct {
+		l1, l2   License
+		expected bool
+	}{
+		{license1, license2, false},
+		{license2, license1, true},
+		{license2, license3, false},
+		{license3, license2, false},
+	}
+
+	for _, tt := range tests {
+		assert.Equal(t, tt.expected, tt.l1.canReplace(tt.l2))
+	}
+}
+
+func TestLicensePermutations(t *testing.T) {
+	var tests = []struct {
+		shortName    string
+		permutations []string
+	}{
+		{
+			"GPL-1-only",
+			[]string{
+				"GPL-1-only",
+				"GPL-1.0-only",
+				"GPL-1.0.0-only",
+			},
+		},
+		{
+			"GPL-2",
+			[]string{
+				"GPL-2",
+				"GPL-2.0",
+				"GPL-2.0.0",
+			},
+		},
+		{
+			"GPL-2.0+",
+			[]string{
+				"GPL-2+",
+				"GPL-2.0+",
+				"GPL-2.0.0+",
+			},
+		},
+		{
+			"GPL-3.0.0-or-later",
+			[]string{
+				"GPL-3-or-later",
+				"GPL-3.0-or-later",
+				"GPL-3.0.0-or-later",
+			},
+		},
+		{
+			"abc-1.1",
+			[]string{
+				"abc-1",
+				"abc-1.1",
+				"abc-1.1.0",
+			},
+		},
+		{
+			"oldap-2.0",
+			[]string{
+				"oldap-2",
+				"oldap-2.0",
+				"oldap-2.0.0",
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.shortName, func(t *testing.T) {
+			perms := buildLicensePermutations(test.shortName)
+			assert.ElementsMatch(t, test.permutations, perms)
+		})
+	}
+}
+
+func TestVersionPermutations(t *testing.T) {
+	var tests = []struct {
+		version      []string
+		permutations []string
+	}{
+		{
+			[]string{"1", "0"},
+			[]string{"1", "1.0", "1.0.0"},
+		},
+		{
+			[]string{"2"},
+			[]string{"2", "2.0", "2.0.0"},
+		},
+		{
+			[]string{"2", "0"},
+			[]string{"2", "2.0", "2.0.0"},
+		},
+
+		{
+			[]string{"3", "0", "0"},
+			[]string{"3", "3.0", "3.0.0"},
+		},
+		{
+			[]string{"0", "3"},
+			[]string{"0.3", "0.3.0"},
+		},
+		{
+			[]string{"0", "0", "3"},
+			[]string{"0.0.3"},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(strings.Join(test.version, "."), func(t *testing.T) {
+			got := versionPermutations(test.version)
+			assert.ElementsMatch(t, test.permutations, got)
+		})
+	}
+}
+
+func TestFindLicenseVersion(t *testing.T) {
+	var tests = []struct {
+		license string
+		version []string
+	}{
+		{
+			"GPL-1.0-only",
+			[]string{"1", "0"},
+		},
+		{
+			"GPL-2.0",
+			[]string{"2", "0"},
+		},
+		{
+			"GPL-2.0.0",
+			[]string{"2", "0", "0"},
+		},
+		{
+			"GPL-2",
+			[]string{"2"},
+		},
+		{
+			"bzip2-1",
+			[]string{"1"},
+		},
+		{
+			"php-3.01",
+			[]string{"3", "01"},
+		},
+		{
+			"oldap-2.0",
+			[]string{"2", "0"},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.license, func(t *testing.T) {
+			got := findLicenseVersion(test.license)
+			assert.Equal(t, test.version, got)
+		})
+	}
+}
+
+func Test_findReplacementLicense(t *testing.T) {
+	tests := []struct {
+		l        License
+		expected *License
+		licenses LicenseList
+	}{
+		{license1, nil, LicenseList{}},
+		{license1, nil, LicenseList{Licenses: []License{license3}}},
+		{license1, &license2, LicenseList{Licenses: []License{license2, license3}}},
+		{license1, &license2, LicenseList{Licenses: []License{license2, license3, license4, license5}}},
+	}
+
+	for _, tt := range tests {
+		assert.Equal(t, tt.expected, tt.licenses.findReplacementLicense(tt.l))
+	}
+}
@@ -1,5 +1,5 @@
 // Code generated by go generate; DO NOT EDIT.
-// This file was generated by robots at 2022-05-09 10:01:37.625063 -0400 EDT m=+0.423632834
+// This file was generated by robots at 2022-08-02 12:46:45.90647 -0400 EDT m=+0.327870639
 // using data from https://spdx.org/licenses/licenses.json
 package spdxlicense

@@ -524,20 +524,20 @@ var licenseIDs = map[string]string{
 	"glulxe":                                   "Glulxe",
 	"glwtpl":                                   "GLWTPL",
 	"gnuplot":                                  "gnuplot",
-	"gpl-1":                                    "GPL-1.0",
-	"gpl-1+":                                   "GPL-1.0+",
+	"gpl-1":                                    "GPL-1.0-only",
+	"gpl-1+":                                   "GPL-1.0-or-later",
 	"gpl-1-only":                               "GPL-1.0-only",
 	"gpl-1-or-later":                           "GPL-1.0-or-later",
-	"gpl-1.0":                                  "GPL-1.0",
-	"gpl-1.0+":                                 "GPL-1.0+",
+	"gpl-1.0":                                  "GPL-1.0-only",
+	"gpl-1.0+":                                 "GPL-1.0-or-later",
 	"gpl-1.0-only":                             "GPL-1.0-only",
 	"gpl-1.0-or-later":                         "GPL-1.0-or-later",
-	"gpl-1.0.0":                                "GPL-1.0",
-	"gpl-1.0.0+":                               "GPL-1.0+",
+	"gpl-1.0.0":                                "GPL-1.0-only",
+	"gpl-1.0.0+":                               "GPL-1.0-or-later",
 	"gpl-1.0.0-only":                           "GPL-1.0-only",
 	"gpl-1.0.0-or-later":                       "GPL-1.0-or-later",
-	"gpl-2":                                    "GPL-2.0",
-	"gpl-2+":                                   "GPL-2.0+",
+	"gpl-2":                                    "GPL-2.0-only",
+	"gpl-2+":                                   "GPL-2.0-or-later",
 	"gpl-2-only":                               "GPL-2.0-only",
 	"gpl-2-or-later":                           "GPL-2.0-or-later",
 	"gpl-2-with-autoconf-exception":            "GPL-2.0-with-autoconf-exception",
@@ -545,8 +545,8 @@ var licenseIDs = map[string]string{
 	"gpl-2-with-classpath-exception":           "GPL-2.0-with-classpath-exception",
 	"gpl-2-with-font-exception":                "GPL-2.0-with-font-exception",
 	"gpl-2-with-gcc-exception":                 "GPL-2.0-with-GCC-exception",
-	"gpl-2.0":                                  "GPL-2.0",
-	"gpl-2.0+":                                 "GPL-2.0+",
+	"gpl-2.0":                                  "GPL-2.0-only",
+	"gpl-2.0+":                                 "GPL-2.0-or-later",
 	"gpl-2.0-only":                             "GPL-2.0-only",
 	"gpl-2.0-or-later":                         "GPL-2.0-or-later",
 	"gpl-2.0-with-autoconf-exception":          "GPL-2.0-with-autoconf-exception",
@@ -554,8 +554,8 @@ var licenseIDs = map[string]string{
 	"gpl-2.0-with-classpath-exception":         "GPL-2.0-with-classpath-exception",
 	"gpl-2.0-with-font-exception":              "GPL-2.0-with-font-exception",
 	"gpl-2.0-with-gcc-exception":               "GPL-2.0-with-GCC-exception",
-	"gpl-2.0.0":                                "GPL-2.0",
-	"gpl-2.0.0+":                               "GPL-2.0+",
+	"gpl-2.0.0":                                "GPL-2.0-only",
+	"gpl-2.0.0+":                               "GPL-2.0-or-later",
 	"gpl-2.0.0-only":                           "GPL-2.0-only",
 	"gpl-2.0.0-or-later":                       "GPL-2.0-or-later",
 	"gpl-2.0.0-with-autoconf-exception":        "GPL-2.0-with-autoconf-exception",
@@ -563,20 +563,20 @@ var licenseIDs = map[string]string{
 	"gpl-2.0.0-with-classpath-exception":       "GPL-2.0-with-classpath-exception",
 	"gpl-2.0.0-with-font-exception":            "GPL-2.0-with-font-exception",
 	"gpl-2.0.0-with-gcc-exception":             "GPL-2.0-with-GCC-exception",
-	"gpl-3":                                    "GPL-3.0",
-	"gpl-3+":                                   "GPL-3.0+",
+	"gpl-3":                                    "GPL-3.0-only",
+	"gpl-3+":                                   "GPL-3.0-or-later",
 	"gpl-3-only":                               "GPL-3.0-only",
 	"gpl-3-or-later":                           "GPL-3.0-or-later",
 	"gpl-3-with-autoconf-exception":            "GPL-3.0-with-autoconf-exception",
 	"gpl-3-with-gcc-exception":                 "GPL-3.0-with-GCC-exception",
-	"gpl-3.0":                                  "GPL-3.0",
-	"gpl-3.0+":                                 "GPL-3.0+",
+	"gpl-3.0":                                  "GPL-3.0-only",
+	"gpl-3.0+":                                 "GPL-3.0-or-later",
 	"gpl-3.0-only":                             "GPL-3.0-only",
 	"gpl-3.0-or-later":                         "GPL-3.0-or-later",
 	"gpl-3.0-with-autoconf-exception":          "GPL-3.0-with-autoconf-exception",
 	"gpl-3.0-with-gcc-exception":               "GPL-3.0-with-GCC-exception",
-	"gpl-3.0.0":                                "GPL-3.0",
-	"gpl-3.0.0+":                               "GPL-3.0+",
+	"gpl-3.0.0":                                "GPL-3.0-only",
+	"gpl-3.0.0+":                               "GPL-3.0-or-later",
 	"gpl-3.0.0-only":                           "GPL-3.0-only",
 	"gpl-3.0.0-or-later":                       "GPL-3.0-or-later",
 	"gpl-3.0.0-with-autoconf-exception":        "GPL-3.0-with-autoconf-exception",
@@ -622,36 +622,36 @@ var licenseIDs = map[string]string{
 	"lal-1.3.0":                                "LAL-1.3",
 	"latex2e":                                  "Latex2e",
 	"leptonica":                                "Leptonica",
-	"lgpl-2":                                   "LGPL-2.0",
-	"lgpl-2+":                                  "LGPL-2.0+",
+	"lgpl-2":                                   "LGPL-2.1-only",
+	"lgpl-2+":                                  "LGPL-2.0-or-later",
 	"lgpl-2-only":                              "LGPL-2.0-only",
 	"lgpl-2-or-later":                          "LGPL-2.0-or-later",
-	"lgpl-2.0":                                 "LGPL-2.0",
-	"lgpl-2.0+":                                "LGPL-2.0+",
+	"lgpl-2.0":                                 "LGPL-2.0-only",
+	"lgpl-2.0+":                                "LGPL-2.0-or-later",
 	"lgpl-2.0-only":                            "LGPL-2.0-only",
 	"lgpl-2.0-or-later":                        "LGPL-2.0-or-later",
-	"lgpl-2.0.0":                               "LGPL-2.0",
-	"lgpl-2.0.0+":                              "LGPL-2.0+",
+	"lgpl-2.0.0":                               "LGPL-2.0-only",
+	"lgpl-2.0.0+":                              "LGPL-2.0-or-later",
 	"lgpl-2.0.0-only":                          "LGPL-2.0-only",
 	"lgpl-2.0.0-or-later":                      "LGPL-2.0-or-later",
-	"lgpl-2.1":                                 "LGPL-2.1",
+	"lgpl-2.1":                                 "LGPL-2.1-only",
 	"lgpl-2.1+":                                "LGPL-2.1+",
 	"lgpl-2.1-only":                            "LGPL-2.1-only",
 	"lgpl-2.1-or-later":                        "LGPL-2.1-or-later",
-	"lgpl-2.1.0":                               "LGPL-2.1",
+	"lgpl-2.1.0":                               "LGPL-2.1-only",
 	"lgpl-2.1.0+":                              "LGPL-2.1+",
 	"lgpl-2.1.0-only":                          "LGPL-2.1-only",
 	"lgpl-2.1.0-or-later":                      "LGPL-2.1-or-later",
-	"lgpl-3":                                   "LGPL-3.0",
-	"lgpl-3+":                                  "LGPL-3.0+",
+	"lgpl-3":                                   "LGPL-3.0-only",
+	"lgpl-3+":                                  "LGPL-3.0-or-later",
 	"lgpl-3-only":                              "LGPL-3.0-only",
 	"lgpl-3-or-later":                          "LGPL-3.0-or-later",
-	"lgpl-3.0":                                 "LGPL-3.0",
-	"lgpl-3.0+":                                "LGPL-3.0+",
+	"lgpl-3.0":                                 "LGPL-3.0-only",
+	"lgpl-3.0+":                                "LGPL-3.0-or-later",
 	"lgpl-3.0-only":                            "LGPL-3.0-only",
 	"lgpl-3.0-or-later":                        "LGPL-3.0-or-later",
-	"lgpl-3.0.0":                               "LGPL-3.0",
-	"lgpl-3.0.0+":                              "LGPL-3.0+",
+	"lgpl-3.0.0":                               "LGPL-3.0-only",
+	"lgpl-3.0.0+":                              "LGPL-3.0-or-later",
 	"lgpl-3.0.0-only":                          "LGPL-3.0-only",
 	"lgpl-3.0.0-or-later":                      "LGPL-3.0-or-later",
 	"lgpllr":                                   "LGPLLR",
@@ -10,6 +10,7 @@ func TestLicenceListIDs(t *testing.T) {
 	// do a sanity check on the generated data
 	assert.Equal(t, "0BSD", licenseIDs["0bsd"])
 	assert.Equal(t, "ZPL-2.1", licenseIDs["zpl-2.1"])
-	assert.Equal(t, "GPL-2.0", licenseIDs["gpl-2"])
+	assert.Equal(t, "GPL-2.0-only", licenseIDs["gpl-2"])
+	assert.Equal(t, "GPL-2.0-or-later", licenseIDs["gpl-2+"])
 	assert.NotEmpty(t, Version)
 }
@@ -17,11 +17,11 @@ func TestIDParse(t *testing.T) {
 		},
 		{
 			"GPL-2",
-			"GPL-2.0",
+			"GPL-2.0-only",
 		},
 		{
 			"GPL-2+",
-			"GPL-2.0+",
+			"GPL-2.0-or-later",
 		},
 		{
 			"GPL-3.0.0-or-later",
Author	SHA1	Message	Date
Keith Zantow	69bde44c6e	Update stereoscope to get rid of the replace directive (#1140 )	2022-08-03 12:24:20 -04:00
Christopher Angelo Phillips	042304ee4c	Correct squashfs import and fix incorrect bouncer configuration (#1138 )	2022-08-03 09:46:14 -04:00
Jonas XavierandAlex Goodman	69fb0a6f3b	Overwrite deprecated SPDX licenses automatically (#1009 ) Co-authored-by: Alex Goodman <alex.goodman@anchore.com>	2022-08-02 15:25:33 -04:00
Christopher Angelo Phillips	e68f384063	disable release for docker assets (#1137 )	2022-08-02 14:47:07 -04:00