feat: add copyright to evidence collection #1338
Conversation
closes: CycloneDX#1310 Signed-off-by: frozen_byte <[email protected]>
src/extractor.ts
Outdated
| component.evidence = new CDX.Models.ComponentEvidence({ | ||
| licenses: new CDX.Models.LicenseRepository(this.getLicenseEvidence(dirname(pkg.path), logger)) | ||
| }) | ||
| for (const line of this.getCopyrightEvidence(dirname(pkg.path), logger)) { |
There was a problem hiding this comment.
I'd like use the same Method as lin 112, but sadly the Stringable is not exported via CDX.Models and the only way I found to create that Set is with the Component Evidence constructor. Maybe someone else have a more elegant way to iterate.
There was a problem hiding this comment.
why would you need the Stringable being exported?
There was a problem hiding this comment.
Basically I think its more elegant to use something like the following:
component.evidence = new CDX.Models.ComponentEvidence({
licenses: new CDX.Models.LicenseRepository(this.getLicenseEvidence(dirname(pkg.path), logger)),
copyright: new SortableStringables(copyrights)
})The SortableStringables is nowhere exported via the CDX object. Importing directly from '_helpers/sortable' will not work since its not exported in any barrel.
There was a problem hiding this comment.
I see.
If you feel that it is a good idea to export the SortableStringables, then feel free to write an issue for it in the library's repository: https://github.com/CycloneDX/cyclonedx-javascript-library
There was a problem hiding this comment.
How about adding and exporting a dedicated type for the purpose new CDX.Models.CopyrightRepository?
The thing is, that the SortableStringables is internal for a good reason. it is just no stable/public interface, yet.
see CycloneDX/cyclonedx-javascript-library#1192
There was a problem hiding this comment.
@Frozen-byte with version 7.1.0 of the JS library, the needed model was introduced.
see https://github.com/CycloneDX/cyclonedx-javascript-library/releases/tag/v7.1.0
There was a problem hiding this comment.
this dependency is intended to be bumped to ^7.0 via #1331
please remember to bump to ^7.1 with this PR 👍
There was a problem hiding this comment.
Since this PR was idle for a long time, v8 was already used on the main branch.
Updated to the more elegant way, that uses no iteration loop.
jkowalleck
changed the title
src/extractor.ts
Outdated
| try { | ||
| pcis = readdirSync(packageDir, {withFileTypes: true}) | ||
| } catch (e) { | ||
| logger?.warn('collecting license evidence in', packageDir, 'failed:', e) |
There was a problem hiding this comment.
"license evidence"? Probably a copy/paste error
|
Thank you for working on this feature. I do not see any test, so I assume this PR is still a work in progress. Feel free to set it to "ready for review", when all work is done. |
Signed-off-by: frozen_byte <[email protected]>
|
Signed-off-by: frozen_byte <[email protected]>
Signed-off-by: frozen_byte <[email protected]>
I added the updated snapshots. |
2 participants
closes: #1310