mirror of
https://github.com/anchore/syft.git
synced 2026-11-02 23:46:35 +01:00
Christopher Angelo Phillips
42fa9e4965
this PR makes the following changes to update the underlying license model to have more expressive capabilities it also provides some guarantee's surrounding the license values themselves - Licenses are updated from string -> pkg.LicenseSet which contain pkg.License with the following fields: - original `Value` read by syft - If it's possible to construct licenses will always have a valid SPDX expression for downstream consumption - the above is run against a generated list of SPDX license ID to try and find the correct ID - SPDX concluded vs declared is added to the new struct - URL source for license is added to the new struct - Location source is added to the new struct to show where the expression was pulled from
129 lines
2.9 KiB
Go
129 lines
2.9 KiB
Go
package spdxhelpers
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
|
|
"github.com/anchore/syft/syft/pkg"
|
|
)
|
|
|
|
func Test_License(t *testing.T) {
|
|
type expected struct {
|
|
concluded string
|
|
declared string
|
|
}
|
|
tests := []struct {
|
|
name string
|
|
input pkg.Package
|
|
expected expected
|
|
}{
|
|
{
|
|
name: "no licenses",
|
|
input: pkg.Package{},
|
|
expected: expected{
|
|
concluded: "NOASSERTION",
|
|
declared: "NOASSERTION",
|
|
},
|
|
},
|
|
{
|
|
name: "no SPDX licenses",
|
|
input: pkg.Package{
|
|
Licenses: pkg.NewLicenseSet(pkg.NewLicense("made-up")),
|
|
},
|
|
expected: expected{
|
|
concluded: "NOASSERTION",
|
|
declared: "LicenseRef-made-up",
|
|
},
|
|
},
|
|
{
|
|
name: "with SPDX license",
|
|
input: pkg.Package{
|
|
Licenses: pkg.NewLicenseSet(pkg.NewLicense("MIT")),
|
|
},
|
|
expected: struct {
|
|
concluded string
|
|
declared string
|
|
}{
|
|
concluded: "NOASSERTION",
|
|
declared: "MIT",
|
|
},
|
|
},
|
|
{
|
|
name: "with SPDX license expression",
|
|
input: pkg.Package{
|
|
Licenses: pkg.NewLicenseSet(
|
|
pkg.NewLicense("MIT"),
|
|
pkg.NewLicense("GPL-3.0-only"),
|
|
),
|
|
},
|
|
expected: expected{
|
|
concluded: "NOASSERTION",
|
|
// because we sort licenses alphabetically GPL ends up at the start
|
|
declared: "GPL-3.0-only AND MIT",
|
|
},
|
|
},
|
|
{
|
|
name: "includes valid LicenseRef-",
|
|
input: pkg.Package{
|
|
Licenses: pkg.NewLicenseSet(
|
|
pkg.NewLicense("one thing first"),
|
|
pkg.NewLicense("two things/#$^second"),
|
|
pkg.NewLicense("MIT"),
|
|
),
|
|
},
|
|
expected: expected{
|
|
concluded: "NOASSERTION",
|
|
// because we separate licenses between valid SPDX and non valid, valid ID always end at the front
|
|
declared: "MIT AND LicenseRef-one-thing-first AND LicenseRef-two-things----second",
|
|
},
|
|
},
|
|
{
|
|
name: "join parentheses correctly",
|
|
input: pkg.Package{
|
|
Licenses: pkg.NewLicenseSet(
|
|
pkg.NewLicense("one thing first"),
|
|
pkg.NewLicense("MIT AND GPL-3.0-only"),
|
|
pkg.NewLicense("MIT OR APACHE-2.0"),
|
|
),
|
|
},
|
|
expected: expected{
|
|
concluded: "NOASSERTION",
|
|
// because we separate licenses between valid SPDX and non valid, valid ID always end at the front
|
|
declared: "(MIT AND GPL-3.0-only) AND (MIT OR APACHE-2.0) AND LicenseRef-one-thing-first",
|
|
},
|
|
},
|
|
}
|
|
for _, test := range tests {
|
|
t.Run(test.name, func(t *testing.T) {
|
|
c, d := License(test.input)
|
|
assert.Equal(t, test.expected.concluded, c)
|
|
assert.Equal(t, test.expected.declared, d)
|
|
})
|
|
}
|
|
}
|
|
|
|
func Test_joinLicenses(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
args []string
|
|
want string
|
|
}{
|
|
{
|
|
name: "multiple licenses",
|
|
args: []string{"MIT", "GPL-3.0-only"},
|
|
want: "MIT AND GPL-3.0-only",
|
|
},
|
|
{
|
|
name: "multiple licenses with complex expressions",
|
|
args: []string{"MIT AND Apache", "GPL-3.0-only"},
|
|
want: "(MIT AND Apache) AND GPL-3.0-only",
|
|
},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
assert.Equalf(t, tt.want, joinLicenses(tt.args), "joinLicenses(%v)", tt.args)
|
|
})
|
|
}
|
|
}
|