Skip to content

Commit 21e6e71

Browse files
jkowalleckjkowalleck
committed
unique license-identifier
Signed-off-by: Jan Kowalleck <[email protected]>
1 parent 267ef6d commit 21e6e71

File tree

4 files changed

+58
-24
lines changed

4 files changed

+58
-24
lines changed

‎schema/bom-1.7.schema.json‎

Lines changed: 12 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1494,25 +1494,20 @@
14941494
},
14951495
"expressionDetails": {
14961496
"title": "Expression Details",
1497-
"description": "Details for parts of the `expression`.",
1498-
"type": "array",
1499-
"items": {
1497+
"description": "Details for parts of the `expression`.\n(An SPDX expression may be a compound of license identifiers.)",
1498+
"$comment": "Property keys are valid SPDX license identifier. Refer to https://spdx.org/specifications for syntax requirements.",
1499+
"type": "object",
1500+
"examples": [
1501+
{
1502+
"Apache-2.0": { "text": "..." },
1503+
"GPL-3.0-only WITH Classpath-exception-2.0": { "text": "..." },
1504+
"LicenseRef-my-custom-license": { "text": "..." }
1505+
}
1506+
],
1507+
"additionalProperties": {
15001508
"type": "object",
1501-
"description": "Specifies the details and attributes related to a software license identifier.\n(An SPDX expression may be a compound of license identifiers.)",
1502-
"required": [
1503-
"licenseIdentifier"
1504-
],
1509+
"description": "Specifies the details and attributes related to a software license identifier.",
15051510
"properties": {
1506-
"licenseIdentifier": {
1507-
"title": "License Identifier",
1508-
"description": "The valid SPDX license identifier. Refer to https://spdx.org/specifications for syntax requirements.\nThis property serves as the primary key, which uniquely identifies each record.",
1509-
"type": "string",
1510-
"examples": [
1511-
"Apache-2.0",
1512-
"GPL-3.0-only WITH Classpath-exception-2.0",
1513-
"LicenseRef-my-custom-license"
1514-
]
1515-
},
15161511
"text": {
15171512
"title": "License texts",
15181513
"description": "An optional way to include the textual content of the license.",

‎schema/bom-1.7.xsd‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2388,7 +2388,18 @@ limitations under the License.
23882388
<xs:choice>
23892389
<xs:element name="license" type="bom:licenseType" minOccurs="0" maxOccurs="unbounded"/>
23902390
<xs:element name="expression" type="bom:expressionType" minOccurs="0" maxOccurs="1" />
2391-
<xs:element name="expression-detailed" type="bom:expressionDetailedType" minOccurs="0" maxOccurs="1" />
2391+
<xs:element name="expression-detailed" type="bom:expressionDetailedType" minOccurs="0" maxOccurs="1">
2392+
<xs:unique name="expression-detailed_details_unique_license-identifier">
2393+
<xs:annotation>
2394+
<xs:documentation>
2395+
The attribute `license-identifier` serves as the primary key, which uniquely identifies each record.
2396+
Therefore, it must be unique.
2397+
</xs:documentation>
2398+
</xs:annotation>
2399+
<xs:selector xpath="./bom:details"/>
2400+
<xs:field xpath="@license-identifier"/>
2401+
</xs:unique>
2402+
</xs:element>
23922403
</xs:choice>
23932404
</xs:complexType>
23942405

‎tools/src/test/resources/1.7/invalid-license-expression-with-text-1.7.xml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
<?xml version="1.0"?>
2+
<bom serialNumber="urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79" version="1" xmlns="http://cyclonedx.org/schema/bom/1.7">
3+
<components>
4+
<component type="application">
5+
<publisher>Acme Inc</publisher>
6+
<group>com.acme</group>
7+
<name>tomcat-catalina</name>
8+
<version>9.0.14</version>
9+
<description>Modified version of Apache Catalina</description>
10+
<scope>required</scope>
11+
<licenses>
12+
<expression-detailed bom-ref="my-license" acknowledgement="declared"
13+
expression="EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0"
14+
>
15+
<details license-identifier="EPL-2.0">
16+
<text><![CDATA[Eclipse Public License - v 2.0
17+
18+
THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE
19+
PUBLIC LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION
20+
OF THE PROGRAM CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT...]]]></text>
21+
</details>
22+
<details license-identifier="EPL-2.0">
23+
<text>duplicate license-identifier</text>
24+
</details>
25+
</expression-detailed>
26+
</licenses>
27+
<purl>pkg:maven/com.acme/[email protected]?packaging=jar</purl>
28+
</component>
29+
</components>
30+
</bom>

‎tools/src/test/resources/1.7/valid-license-expression-with-text-1.7.json‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -18,21 +18,19 @@
1818
"bom-ref": "my-license",
1919
"acknowledgement": "declared",
2020
"expression": "EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0",
21-
"expressionDetails": [
22-
{
23-
"licenseIdentifier": "EPL-2.0",
21+
"expressionDetails": {
22+
"EPL-2.0": {
2423
"text": {
2524
"content": "Eclipse Public License - v 2.0\n\n THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE\n PUBLIC LICENSE (\"AGREEMENT\"). ANY USE, REPRODUCTION OR DISTRIBUTION\n OF THE PROGRAM CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT..."
2625
}
2726
},
28-
{
29-
"licenseIdentifier": "GPL-2.0 WITH Classpath-exception-2.0",
27+
"GPL-2.0 WITH Classpath-exception-2.0": {
3028
"text": {
3129
"contentType": "text/plain",
3230
"content": " GNU GENERAL PUBLIC LICENSE\n Version 2, June 1991\n\n Copyright (C) 1989, 1991 Free Software Foundation, Inc.,\n <https://fsf.org/>\n Everyone is permitted to copy and distribute verbatim copies\n of this license document, but changing it is not allowed...\n\n...\n\nLinking this library statically or dynamically with other modules is making a combined work based on this library..."
3331
}
3432
}
35-
]
33+
}
3634
}
3735
],
3836
"purl": "pkg:maven/com.acme/[email protected]?packaging=jar"

0 commit comments

Comments
 (0)