Skip to content

Commit 59c9a1f

Browse files
jkowalleckjkowalleck
committed
ework license expression lext attachments and add shema
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
1 parent 903cb43 commit 59c9a1f

File tree

4 files changed

+91
-78
lines changed

4 files changed

+91
-78
lines changed

‎schema/bom-1.7.proto‎

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -386,13 +386,13 @@ message LicenseChoice {
386386
License license = 1;
387387
// A valid SPDX license expression. Refer to https://spdx.org/specifications for syntax requirements
388388
string expression = 2;
389+
// TODO
390+
ExpressionDetailed expression_detailed = 5;
389391
}
390392
// This field must only be used when "expression" is chosen as the License object has its own acknowledgement.
391393
optional LicenseAcknowledgementEnumeration acknowledgement = 3;
392394
// This field must only be used when "expression" is chosen as the License object has its own bom_ref.
393395
optional string bom_ref = 4;
394-
// This field must only be used when "expression" is chosen ... TODO.
395-
repeated ExpressionDetails expression_details = 5;
396396
}
397397

398398
// Specifies the details and attributes related to a software license. It can either include a valid SPDX license identifier or a named license, along with additional properties such as license acknowledgment, comprehensive commercial licensing information, and the full text of the license.
@@ -417,12 +417,22 @@ message License {
417417
optional LicenseAcknowledgementEnumeration acknowledgement = 8;
418418
}
419419

420+
message ExpressionDetailed {
421+
// A valid SPDX license expression. Refer to https://spdx.org/specifications for syntax requirements
422+
string expression = 1;
423+
optional string bom_ref = 2;
424+
// Declared licenses and concluded licenses represent two different stages in the licensing process within software development. Declared licenses refer to the initial intention of the software authors regarding the licensing terms under which their code is released. On the other hand, concluded licenses are the result of a comprehensive analysis of the project's codebase to identify and confirm the actual licenses of the components used, which may differ from the initially declared licenses. While declared licenses provide an upfront indication of the licensing intentions, concluded licenses offer a more thorough understanding of the actual licensing within a project, facilitating proper compliance and risk management. Observed licenses are defined in `@.evidence.licenses`. Observed licenses form the evidence necessary to substantiate a concluded license.
425+
optional LicenseAcknowledgementEnumeration acknowledgement = 3;
426+
// TODO
427+
repeated ExpressionDetails details = 4;
428+
}
429+
420430
// TODO
421431
message ExpressionDetails {
422432
// TODO
423433
string license_identifier = 1;
424434
// Specifies the optional full text of the attachment
425-
optional AttachedText text = 3;
435+
optional AttachedText text = 2;
426436
}
427437

428438
// Declared licenses and concluded licenses represent two different stages in the licensing process within software development. Declared licenses refer to the initial intention of the software authors regarding the licensing terms under which their code is released. On the other hand, concluded licenses are the result of a comprehensive analysis of the project's codebase to identify and confirm the actual licenses of the components used, which may differ from the initially declared licenses. While declared licenses provide an upfront indication of the licensing intentions, concluded licenses offer a more thorough understanding of the actual licensing within a project, facilitating proper compliance and risk management. Observed licenses are defined in `@.evidence.licenses`. Observed licenses form the evidence necessary to substantiate a concluded license.

‎schema/bom-1.7.xsd‎

Lines changed: 60 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -966,74 +966,74 @@ limitations under the License.
966966
<xs:attributeGroup ref="bom:licenseAttributes"/>
967967
</xs:complexType>
968968

969-
<xs:complexType name="expressionType">
970-
<xs:choice>
971-
<xs:simpleContent>
972-
<xs:extension base="xs:normalizedString">
973-
<xs:annotation>
974-
<xs:documentation>A valid SPDX license expression.
975-
Refer to https://spdx.org/specifications for syntax requirements
969+
<xs:complexType name="expressionSimpleType">
970+
<xs:simpleContent>
971+
<xs:extension base="xs:normalizedString">
972+
<xs:annotation>
973+
<xs:documentation>A valid SPDX license expression.
974+
Refer to https://spdx.org/specifications for syntax requirements
976975

977-
Example values:
978-
- Apache-2.0 AND (MIT OR GPL-2.0-only)
979-
- GPL-3.0-only WITH Classpath-exception-2.0
980-
</xs:documentation>
981-
</xs:annotation>
982-
</xs:extension>
983-
</xs:simpleContent>
984-
<xs:complexContent>
985-
<xs:sequence>
986-
<xs:element name="details" minOccurs="0" maxOccurs="unbounded">
987-
<xs:complexType>
988-
<xs:sequence>
989-
<xs:element name="text" type="bom:attachedTextType" minOccurs="0" maxOccurs="1">
990-
<xs:annotation>
991-
<xs:documentation>Specifies the optional full text of the attachment</xs:documentation>
992-
</xs:annotation>
993-
</xs:element>
994-
<xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded">
995-
<xs:annotation>
996-
<xs:documentation>
997-
Allows any undeclared elements as long as the elements are placed in a different namespace.
998-
</xs:documentation>
999-
</xs:annotation>
1000-
</xs:any>
1001-
</xs:sequence>
1002-
<xs:attribute name="license-identifier" type="xs:normalizedString" use="required">
1003-
<xs:annotation>
1004-
<xs:documentation>
1005-
TODO
976+
Example values:
977+
- Apache-2.0 AND (MIT OR GPL-2.0-only)
978+
- GPL-3.0-only WITH Classpath-exception-2.0
979+
</xs:documentation>
980+
</xs:annotation>
981+
<xs:attributeGroup ref="bom:licenseAttributes"/>
982+
</xs:extension>
983+
</xs:simpleContent>
984+
</xs:complexType>
1006985

1007-
Examples:
1008-
- Apache-2.0
1009-
- GPL-3.0-only WITH Classpath-exception-2.0
1010-
</xs:documentation>
1011-
</xs:annotation>
1012-
</xs:attribute>
1013-
</xs:complexType>
1014-
</xs:element>
1015-
<xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded">
986+
<xs:complexType name="expressionComplexType">
987+
<xs:sequence>
988+
<xs:element name="details" minOccurs="0" maxOccurs="unbounded">
989+
<xs:complexType>
990+
<xs:sequence>
991+
<xs:element name="text" type="bom:attachedTextType" minOccurs="0" maxOccurs="1">
992+
<xs:annotation>
993+
<xs:documentation>Specifies the optional full text of the attachment</xs:documentation>
994+
</xs:annotation>
995+
</xs:element>
996+
<xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded">
997+
<xs:annotation>
998+
<xs:documentation>
999+
Allows any undeclared elements as long as the elements are placed in a different namespace.
1000+
</xs:documentation>
1001+
</xs:annotation>
1002+
</xs:any>
1003+
</xs:sequence>
1004+
<xs:attribute name="license-identifier" type="xs:normalizedString" use="required">
10161005
<xs:annotation>
10171006
<xs:documentation>
1018-
Allows any undeclared elements as long as the elements are placed in a different namespace.
1007+
TODO
1008+
1009+
Examples:
1010+
- Apache-2.0
1011+
- GPL-3.0-only WITH Classpath-exception-2.0
10191012
</xs:documentation>
10201013
</xs:annotation>
1021-
</xs:any>
1022-
</xs:sequence>
1023-
<xs:attribute name="value" type="xs:normalizedString" use="required">
1014+
</xs:attribute>
1015+
</xs:complexType>
1016+
</xs:element>
1017+
<xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded">
10241018
<xs:annotation>
1025-
<xs:documentation>A valid SPDX license expression.
1026-
Refer to https://spdx.org/specifications for syntax requirements
1027-
1028-
Example values:
1029-
- Apache-2.0 AND (MIT OR GPL-2.0-only)
1030-
- GPL-3.0-only WITH Classpath-exception-2.0
1019+
<xs:documentation>
1020+
Allows any undeclared elements as long as the elements are placed in a different namespace.
10311021
</xs:documentation>
10321022
</xs:annotation>
1033-
</xs:attribute>
1034-
</xs:complexContent>
1035-
</xs:choice>
1023+
</xs:any>
1024+
</xs:sequence>
10361025
<xs:attributeGroup ref="bom:licenseAttributes"/>
1026+
<xs:attribute name="expression" type="xs:normalizedString" use="required">
1027+
<xs:annotation>
1028+
<xs:documentation>A valid SPDX license expression.
1029+
Refer to https://spdx.org/specifications for syntax requirements
1030+
1031+
Example values:
1032+
- Apache-2.0 AND (MIT OR GPL-2.0-only)
1033+
- GPL-3.0-only WITH Classpath-exception-2.0
1034+
</xs:documentation>
1035+
</xs:annotation>
1036+
</xs:attribute>
10371037
</xs:complexType>
10381038

10391039
<xs:complexType name="attachedTextType">
@@ -2373,7 +2373,8 @@ limitations under the License.
23732373
<xs:complexType name="licenseChoiceType">
23742374
<xs:choice>
23752375
<xs:element name="license" type="bom:licenseType" minOccurs="0" maxOccurs="unbounded"/>
2376-
<xs:element name="expression" type="bom:expressionType" minOccurs="0" maxOccurs="1" />
2376+
<xs:element name="expression" type="bom:expressionSimpleType" minOccurs="0" maxOccurs="1" />
2377+
<xs:element name="expression-detailed" type="bom:expressionComplexType" minOccurs="0" maxOccurs="1" />
23772378
</xs:choice>
23782379
</xs:complexType>
23792380

‎tools/src/test/resources/1.7/valid-license-expression-with-text-1.7.textproto‎

Lines changed: 15 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -13,20 +13,22 @@ components {
1313
description: "Modified version of Apache Catalina"
1414
scope: SCOPE_REQUIRED
1515
licenses {
16-
bom_ref: "my-license"
17-
acknowledgement: LICENSE_ACKNOWLEDGEMENT_ENUMERATION_DECLARED
18-
expression: "EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0"
19-
expression_details {
20-
license_identifier: "EPL-2.0"
21-
text {
22-
value: "Eclipse Public License - v 2.0\n\n THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE\n PUBLIC LICENSE (\"AGREEMENT\"). ANY USE, REPRODUCTION OR DISTRIBUTION\n OF THE PROGRAM CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT..."
16+
expression_detailed {
17+
bom_ref: "my-license"
18+
acknowledgement: LICENSE_ACKNOWLEDGEMENT_ENUMERATION_DECLARED
19+
expression: "EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0"
20+
details {
21+
license_identifier: "EPL-2.0"
22+
text {
23+
value: "Eclipse Public License - v 2.0\n\n THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE\n PUBLIC LICENSE (\"AGREEMENT\"). ANY USE, REPRODUCTION OR DISTRIBUTION\n OF THE PROGRAM CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT..."
24+
}
2325
}
24-
}
25-
expression_details {
26-
license_identifier: "GPL-2.0 WITH Classpath-exception-2.0",
27-
text {
28-
content_type: "text/plain",
29-
value: " GNU GENERAL PUBLIC LICENSE\n Version 2, June 1991\n\n Copyright (C) 1989, 1991 Free Software Foundation, Inc.,\n <https://fsf.org/>\n Everyone is permitted to copy and distribute verbatim copies\n of this license document, but changing it is not allowed...\n\n...\n\nLinking this library statically or dynamically with other modules is making a combined work based on this library..."
26+
details {
27+
license_identifier: "GPL-2.0 WITH Classpath-exception-2.0",
28+
text {
29+
content_type: "text/plain",
30+
value: " GNU GENERAL PUBLIC LICENSE\n Version 2, June 1991\n\n Copyright (C) 1989, 1991 Free Software Foundation, Inc.,\n <https://fsf.org/>\n Everyone is permitted to copy and distribute verbatim copies\n of this license document, but changing it is not allowed...\n\n...\n\nLinking this library statically or dynamically with other modules is making a combined work based on this library..."
31+
}
3032
}
3133
}
3234
}

‎tools/src/test/resources/1.7/valid-license-expression-with-text-1.7.xml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@
99
<description>Modified version of Apache Catalina</description>
1010
<scope>required</scope>
1111
<licenses>
12-
<expression bom-ref="my-license" acknowledgement="declared"
13-
value="EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0"
12+
<expression-detailed bom-ref="my-license" acknowledgement="declared"
13+
expression="EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0"
1414
>
1515
<details license-identifier="EPL-2.0">
1616
<text><![CDATA[Eclipse Public License - v 2.0
@@ -32,7 +32,7 @@
3232
3333
Linking this library statically or dynamically with other modules is making a combined work based on this library...]]></text>
3434
</details>
35-
</expression>
35+
</expression-detailed>
3636
</licenses>
3737
<purl>pkg:maven/com.acme/tomcat-catalina@9.0.14?packaging=jar</purl>
3838
</component>

0 commit comments

Comments
 (0)