mirror of
https://github.com/anchore/syft.git
synced 2026-04-05 14:20:34 +02:00
42fa9e4965
this PR makes the following changes to update the underlying license model to have more expressive capabilities it also provides some guarantee's surrounding the license values themselves - Licenses are updated from string -> pkg.LicenseSet which contain pkg.License with the following fields: - original `Value` read by syft - If it's possible to construct licenses will always have a valid SPDX expression for downstream consumption - the above is run against a generated list of SPDX license ID to try and find the correct ID - SPDX concluded vs declared is added to the new struct - URL source for license is added to the new struct - Location source is added to the new struct to show where the expression was pulled from
130 lines
3.1 KiB
Plaintext
130 lines
3.1 KiB
Plaintext
{
|
|
"$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
|
|
"bomFormat": "CycloneDX",
|
|
"specVersion": "1.4",
|
|
"serialNumber": "urn:uuid:1695d6ae-0ddf-4e77-9c9d-74df1bdd8d5b",
|
|
"version": 1,
|
|
"metadata": {
|
|
"timestamp": "2023-05-08T14:40:32-04:00",
|
|
"tools": [
|
|
{
|
|
"vendor": "anchore",
|
|
"name": "syft",
|
|
"version": "v0.42.0-bogus"
|
|
}
|
|
],
|
|
"component": {
|
|
"bom-ref": "38160ebc2a6876e8",
|
|
"type": "container",
|
|
"name": "user-image-input",
|
|
"version": "sha256:2731251dc34951c0e50fcc643b4c5f74922dad1a5d98f302b504cf46cd5d9368"
|
|
}
|
|
},
|
|
"components": [
|
|
{
|
|
"bom-ref": "ec2e0c93617507ef",
|
|
"type": "library",
|
|
"name": "package-1",
|
|
"version": "1.0.1",
|
|
"licenses": [
|
|
{
|
|
"license": {
|
|
"id": "MIT"
|
|
}
|
|
}
|
|
],
|
|
"cpe": "cpe:2.3:*:some:package:1:*:*:*:*:*:*:*",
|
|
"purl": "a-purl-1",
|
|
"properties": [
|
|
{
|
|
"name": "syft:package:foundBy",
|
|
"value": "the-cataloger-1"
|
|
},
|
|
{
|
|
"name": "syft:package:language",
|
|
"value": "python"
|
|
},
|
|
{
|
|
"name": "syft:package:metadataType",
|
|
"value": "PythonPackageMetadata"
|
|
},
|
|
{
|
|
"name": "syft:package:type",
|
|
"value": "python"
|
|
},
|
|
{
|
|
"name": "syft:location:0:layerID",
|
|
"value": "sha256:ab62016f9bec7286af65604081564cadeeb364a48faca2346c3f5a5a1f5ef777"
|
|
},
|
|
{
|
|
"name": "syft:location:0:path",
|
|
"value": "/somefile-1.txt"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"bom-ref": "pkg:deb/debian/package-2@2.0.1?package-id=958443e2d9304af4",
|
|
"type": "library",
|
|
"name": "package-2",
|
|
"version": "2.0.1",
|
|
"cpe": "cpe:2.3:*:some:package:2:*:*:*:*:*:*:*",
|
|
"purl": "pkg:deb/debian/package-2@2.0.1",
|
|
"properties": [
|
|
{
|
|
"name": "syft:package:foundBy",
|
|
"value": "the-cataloger-2"
|
|
},
|
|
{
|
|
"name": "syft:package:metadataType",
|
|
"value": "DpkgMetadata"
|
|
},
|
|
{
|
|
"name": "syft:package:type",
|
|
"value": "deb"
|
|
},
|
|
{
|
|
"name": "syft:location:0:layerID",
|
|
"value": "sha256:f1803845b6747d94d6e4ecce2331457e5f1c4fb97de5216f392a76f4582f63b2"
|
|
},
|
|
{
|
|
"name": "syft:location:0:path",
|
|
"value": "/somefile-2.txt"
|
|
},
|
|
{
|
|
"name": "syft:metadata:installedSize",
|
|
"value": "0"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"type": "operating-system",
|
|
"name": "debian",
|
|
"version": "1.2.3",
|
|
"description": "debian",
|
|
"swid": {
|
|
"tagId": "debian",
|
|
"name": "debian",
|
|
"version": "1.2.3"
|
|
},
|
|
"properties": [
|
|
{
|
|
"name": "syft:distro:id",
|
|
"value": "debian"
|
|
},
|
|
{
|
|
"name": "syft:distro:idLike:0",
|
|
"value": "like!"
|
|
},
|
|
{
|
|
"name": "syft:distro:prettyName",
|
|
"value": "debian"
|
|
},
|
|
{
|
|
"name": "syft:distro:versionID",
|
|
"value": "1.2.3"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|