mirror of
https://github.com/anchore/syft.git
synced 2026-11-04 00:16:38 +01:00
Christopher Angelo Phillips
42fa9e4965
this PR makes the following changes to update the underlying license model to have more expressive capabilities it also provides some guarantee's surrounding the license values themselves - Licenses are updated from string -> pkg.LicenseSet which contain pkg.License with the following fields: - original `Value` read by syft - If it's possible to construct licenses will always have a valid SPDX expression for downstream consumption - the above is run against a generated list of SPDX license ID to try and find the correct ID - SPDX concluded vs declared is added to the new struct - URL source for license is added to the new struct - Location source is added to the new struct to show where the expression was pulled from
191 lines
4.7 KiB
Plaintext
191 lines
4.7 KiB
Plaintext
{
|
|
"spdxVersion": "SPDX-2.3",
|
|
"dataLicense": "CC0-1.0",
|
|
"SPDXID": "SPDXRef-DOCUMENT",
|
|
"name": "user-image-input",
|
|
"documentNamespace": "https://anchore.com/syft/image/user-image-input-1de3ac0e-5829-4294-9198-8d8fcdb5dd51",
|
|
"creationInfo": {
|
|
"licenseListVersion": "3.20",
|
|
"creators": [
|
|
"Organization: Anchore, Inc",
|
|
"Tool: syft-v0.42.0-bogus"
|
|
],
|
|
"created": "2023-05-09T17:11:26Z"
|
|
},
|
|
"packages": [
|
|
{
|
|
"name": "package-1",
|
|
"SPDXID": "SPDXRef-Package-python-package-1-125840abc1c66dd7",
|
|
"versionInfo": "1.0.1",
|
|
"downloadLocation": "NOASSERTION",
|
|
"sourceInfo": "acquired package info from installed python package manifest file: /somefile-1.txt",
|
|
"licenseConcluded": "NOASSERTION",
|
|
"licenseDeclared": "MIT",
|
|
"copyrightText": "NOASSERTION",
|
|
"externalRefs": [
|
|
{
|
|
"referenceCategory": "SECURITY",
|
|
"referenceType": "cpe23Type",
|
|
"referenceLocator": "cpe:2.3:*:some:package:1:*:*:*:*:*:*:*"
|
|
},
|
|
{
|
|
"referenceCategory": "PACKAGE-MANAGER",
|
|
"referenceType": "purl",
|
|
"referenceLocator": "a-purl-1"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"name": "package-2",
|
|
"SPDXID": "SPDXRef-Package-deb-package-2-958443e2d9304af4",
|
|
"versionInfo": "2.0.1",
|
|
"downloadLocation": "NOASSERTION",
|
|
"sourceInfo": "acquired package info from DPKG DB: /somefile-2.txt",
|
|
"licenseConcluded": "NOASSERTION",
|
|
"licenseDeclared": "NOASSERTION",
|
|
"copyrightText": "NOASSERTION",
|
|
"externalRefs": [
|
|
{
|
|
"referenceCategory": "SECURITY",
|
|
"referenceType": "cpe23Type",
|
|
"referenceLocator": "cpe:2.3:*:some:package:2:*:*:*:*:*:*:*"
|
|
},
|
|
{
|
|
"referenceCategory": "PACKAGE-MANAGER",
|
|
"referenceType": "purl",
|
|
"referenceLocator": "pkg:deb/debian/package-2@2.0.1"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"files": [
|
|
{
|
|
"fileName": "/a1/f6",
|
|
"SPDXID": "SPDXRef-File-a1-f6-9c2f7510199b17f6",
|
|
"fileTypes": [
|
|
"OTHER"
|
|
],
|
|
"checksums": [
|
|
{
|
|
"algorithm": "SHA1",
|
|
"checksumValue": "0000000000000000000000000000000000000000"
|
|
}
|
|
],
|
|
"licenseConcluded": "NOASSERTION",
|
|
"copyrightText": ""
|
|
},
|
|
{
|
|
"fileName": "/d1/f3",
|
|
"SPDXID": "SPDXRef-File-d1-f3-c6f5b29dca12661f",
|
|
"fileTypes": [
|
|
"OTHER"
|
|
],
|
|
"checksums": [
|
|
{
|
|
"algorithm": "SHA1",
|
|
"checksumValue": "0000000000000000000000000000000000000000"
|
|
}
|
|
],
|
|
"licenseConcluded": "NOASSERTION",
|
|
"copyrightText": ""
|
|
},
|
|
{
|
|
"fileName": "/d2/f4",
|
|
"SPDXID": "SPDXRef-File-d2-f4-c641caa71518099f",
|
|
"fileTypes": [
|
|
"OTHER"
|
|
],
|
|
"checksums": [
|
|
{
|
|
"algorithm": "SHA1",
|
|
"checksumValue": "0000000000000000000000000000000000000000"
|
|
}
|
|
],
|
|
"licenseConcluded": "NOASSERTION",
|
|
"copyrightText": ""
|
|
},
|
|
{
|
|
"fileName": "/f1",
|
|
"SPDXID": "SPDXRef-File-f1-5265a4dde3edbf7c",
|
|
"fileTypes": [
|
|
"OTHER"
|
|
],
|
|
"checksums": [
|
|
{
|
|
"algorithm": "SHA1",
|
|
"checksumValue": "0000000000000000000000000000000000000000"
|
|
}
|
|
],
|
|
"licenseConcluded": "NOASSERTION",
|
|
"copyrightText": ""
|
|
},
|
|
{
|
|
"fileName": "/f2",
|
|
"SPDXID": "SPDXRef-File-f2-f9e49132a4b96ccd",
|
|
"fileTypes": [
|
|
"OTHER"
|
|
],
|
|
"checksums": [
|
|
{
|
|
"algorithm": "SHA1",
|
|
"checksumValue": "0000000000000000000000000000000000000000"
|
|
}
|
|
],
|
|
"licenseConcluded": "NOASSERTION",
|
|
"copyrightText": ""
|
|
},
|
|
{
|
|
"fileName": "/z1/f5",
|
|
"SPDXID": "SPDXRef-File-z1-f5-839d99ee67d9d174",
|
|
"fileTypes": [
|
|
"OTHER"
|
|
],
|
|
"checksums": [
|
|
{
|
|
"algorithm": "SHA1",
|
|
"checksumValue": "0000000000000000000000000000000000000000"
|
|
}
|
|
],
|
|
"licenseConcluded": "NOASSERTION",
|
|
"copyrightText": ""
|
|
}
|
|
],
|
|
"relationships": [
|
|
{
|
|
"spdxElementId": "SPDXRef-Package-python-package-1-125840abc1c66dd7",
|
|
"relatedSpdxElement": "SPDXRef-File-f1-5265a4dde3edbf7c",
|
|
"relationshipType": "CONTAINS"
|
|
},
|
|
{
|
|
"spdxElementId": "SPDXRef-Package-python-package-1-125840abc1c66dd7",
|
|
"relatedSpdxElement": "SPDXRef-File-z1-f5-839d99ee67d9d174",
|
|
"relationshipType": "CONTAINS"
|
|
},
|
|
{
|
|
"spdxElementId": "SPDXRef-Package-python-package-1-125840abc1c66dd7",
|
|
"relatedSpdxElement": "SPDXRef-File-a1-f6-9c2f7510199b17f6",
|
|
"relationshipType": "CONTAINS"
|
|
},
|
|
{
|
|
"spdxElementId": "SPDXRef-Package-python-package-1-125840abc1c66dd7",
|
|
"relatedSpdxElement": "SPDXRef-File-d2-f4-c641caa71518099f",
|
|
"relationshipType": "CONTAINS"
|
|
},
|
|
{
|
|
"spdxElementId": "SPDXRef-Package-python-package-1-125840abc1c66dd7",
|
|
"relatedSpdxElement": "SPDXRef-File-d1-f3-c6f5b29dca12661f",
|
|
"relationshipType": "CONTAINS"
|
|
},
|
|
{
|
|
"spdxElementId": "SPDXRef-Package-python-package-1-125840abc1c66dd7",
|
|
"relatedSpdxElement": "SPDXRef-File-f2-f9e49132a4b96ccd",
|
|
"relationshipType": "CONTAINS"
|
|
},
|
|
{
|
|
"spdxElementId": "SPDXRef-DOCUMENT",
|
|
"relatedSpdxElement": "SPDXRef-DOCUMENT",
|
|
"relationshipType": "DESCRIBES"
|
|
}
|
|
]
|
|
}
|