feat: add copyright to evidence collection

src/extractor.ts

@@ -125,7 +125,8 @@ export class Extractor {
 
     if (collectEvidence) {
       component.evidence = new CDX.Models.ComponentEvidence({
-        licenses: new CDX.Models.LicenseRepository(this.getLicenseEvidence(dirname(pkg.path), logger))
+        licenses: new CDX.Models.LicenseRepository(this.getLicenseEvidence(dirname(pkg.path), logger)),
+        copyright: new CDX.Models.CopyrightRepository(this.getCopyrightEvidence(dirname(pkg.path), logger))
       })
     }
 
@@ -146,6 +147,46 @@ export class Extractor {
     }
   }
 
+  readonly #COPYRIGHT_FILENAME_PATTERN = /^(?:UN)?LICEN[CS]E|.\.LICEN[CS]E$|^NOTICE$|^COPYRIGHTNOTICE$/i
+
+  public * getCopyrightEvidence (packageDir: string, logger?: WebpackLogger): Generator<string> {
+    let pcis
+    try {
+      pcis = readdirSync(packageDir, {withFileTypes: true})
+    } catch (e) {
+      logger?.warn('collecting copyright evidence in', packageDir, 'failed:', e)
+      return
+    }
+    for (const pci of pcis) {
+      if (
+        !pci.isFile() ||
+        !this.#COPYRIGHT_FILENAME_PATTERN.test(pci.name)
+      ) {
+        continue
+      }
+      const fp = join(packageDir, pci.name)
+      try {
+        // Add copyright evidence
+        const linesStartingWithCopyright = readFileSync(fp).toString('utf-8')
+          .split(/\r\n?|\n/)
+          .map(line => line.trimStart())
+          .filter(trimmedLine => {
+            return trimmedLine.startsWith('opyright', 1) && // include copyright statements
+              !trimmedLine.startsWith('opyright notice', 1) && // exclude lines from license text
+              !trimmedLine.startsWith('opyright and related rights', 1) &&
+              !trimmedLine.startsWith('opyright license to reproduce', 1)
+          })
+          .filter((value, index, list) => index === 0 || value !== list[0]) // remove duplicates
+
+        for (const line of linesStartingWithCopyright) {
+          yield line
+        }
+      } catch (e) { // may throw if `readFileSync()` fails
+        logger?.warn('collecting copyright evidences from', fp, 'failed:', e)
+      }
+    }
+  }
+
   readonly #LICENSE_FILENAME_PATTERN = /^(?:UN)?LICEN[CS]E|.\.LICEN[CS]E$|^NOTICE$/i
 
   public * getLicenseEvidence (packageDir: string, logger?: WebpackLogger): Generator<CDX.Models.License> {
@@ -168,6 +209,7 @@ export class Extractor {
 
       const contentType = getMimeForLicenseFile(pci.name)
       if (contentType === undefined) {
+        logger?.warn(`could not determine content-type for ${pci.name}`)
         continue
       }