wip

Signed-off-by: Jan Kowalleck <[email protected]>

Author: jkowalleck

cyclonedx_py/_internal/utils/pep639.py

@@ -23,7 +23,6 @@
 
 from base64 import b64encode
 from collections.abc import Generator
-from glob import glob
 from os.path import dirname, join
 from typing import TYPE_CHECKING, Any
 
@@ -32,6 +31,7 @@
 
 from .bytes import bytes2str
 from .mimetypes import guess_type
+from .py_interop import glob
 
 if TYPE_CHECKING:  # pragma: no cover
     from importlib.metadata import Distribution
@@ -54,7 +54,7 @@ def project2licenses(project: dict[str, Any], lfac: 'LicenseFactory',
         # https://peps.python.org/pep-0639/#add-license-files-key
         plfiles_root = dirname(fpath)
         for plfile_glob in plfiles:
-            for plfile in glob(plfile_glob, root_dir=plfiles_root):
+            for plfile in glob(plfile_glob, root_dir=plfiles_root, recursive=True):
                 # per spec:
                 # > Tools MUST assume that license file content is valid UTF-8 encoded text
                 # anyway, we don't trust this and assume binary

cyclonedx_py/_internal/utils/py_interop.py

@@ -0,0 +1,37 @@
+# This file is part of CycloneDX Python
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# Copyright (c) OWASP Foundation. All Rights Reserved.
+
+__all__ = ['glob']
+
+import sys
+from glob import glob as _glob
+
+if sys.version_info > (3, 10):
+    glob = _glob
+else:
+    from os.path import join, sep
+    from typing import Optional
+
+    def glob(pathname: str, *, root_dir: Optional[str] = None, recursive: bool = False) -> list[str]:
+        if root_dir is not None:
+            pathname = join(root_dir, pathname)
+        files = glob(pathname, recursive=recursive)
+        if root_dir is not None:
+            if not root_dir.endswith(sep):
+                root_dir += sep
+            files = [f.removeprefix(root_dir) for f in files]
+        return files

tests/_data/infiles/environment/with-license-pep639/licenses_b/legal/NOTICE.txt

@@ -0,0 +1 @@
+this is the content of licenses_b/legal/NOTICE.txt file. it is expected to be detected.

tests/_data/infiles/environment/with-license-pep639/pyproject.toml

@@ -9,8 +9,8 @@ license = "MIT OR GPL-2.0-or-later OR (FSFUL AND BSD-2-Clause)"
 # https://peps.python.org/pep-0639/#add-license-files-key
 license-files = [
   "LICEN[CS]E*", "AUTHORS*",
-  "licenses_a/LICENSE.MIT", "licenses_a/LICENSE.CC0",
-  "LICENSE.txt", "licenses_b/*",
+  "licenses_a/LICENSE.MIT", "licenses_a/*.CC0",
+  "LICENSE.txt", "licenses_b/**",
   "nonexisting_file", "nonexisting_dir/foo",
 ]