Skip to content

Commit 9f5b308

Browse files
jkowalleckjkowalleck
committed
feat: licenses allow mix of multiple SPDX expressions AND/OR multiple named/spdx licenses
Signed-off-by: Jan Kowalleck <[email protected]>
1 parent 544db94 commit 9f5b308

8 files changed

+343
-27
lines changed

‎schema/bom-1.7.proto‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -114,7 +114,7 @@ message Component {
114114
optional Scope scope = 11;
115115
// The hashes of the component.
116116
repeated Hash hashes = 12;
117-
// EITHER (list of SPDX licenses and/or named licenses) OR (tuple of one SPDX License Expression)
117+
// A list of SPDX licenses and/or named licenses and/or SPDX License Expression.
118118
repeated LicenseChoice licenses = 13;
119119
// An optional copyright notice informing users of the underlying claims to copyright ownership in a published work.
120120
optional string copyright = 14;
@@ -506,7 +506,7 @@ message Metadata {
506506
// The organization that supplied the component that the BOM describes. The supplier may often be the manufacture, but may also be a distributor or repackager.
507507
optional OrganizationalEntity supplier = 6;
508508
// The license information for the BOM document. This may be different from the license(s) of the component(s) that the BOM describes.
509-
// EITHER (list of SPDX licenses and/or named licenses) OR (tuple of one SPDX License Expression)
509+
// A list of SPDX licenses and/or named licenses and/or SPDX License Expression.
510510
repeated LicenseChoice licenses = 7;
511511
// Specifies optional, custom, properties
512512
repeated Property properties = 8;
@@ -641,7 +641,7 @@ message Service {
641641
optional bool x_trust_boundary = 9;
642642
// Specifies information about the data including the directional flow of data and the data classification.
643643
repeated DataFlow data = 10;
644-
// EITHER (list of SPDX licenses and/or named licenses) OR (tuple of one SPDX License Expression)
644+
// A list of SPDX licenses and/or named licenses and/or SPDX License Expression.
645645
repeated LicenseChoice licenses = 11;
646646
// Provides the ability to document external references related to the service.
647647
repeated ExternalReference external_references = 12;
@@ -745,7 +745,7 @@ message EvidenceCopyright {
745745

746746
// Provides the ability to document evidence collected through various forms of extraction or analysis.
747747
message Evidence {
748-
// EITHER (list of SPDX licenses and/or named licenses) OR (tuple of one SPDX License Expression)
748+
// A list of SPDX licenses and/or named licenses and/or SPDX License Expression.
749749
repeated LicenseChoice licenses = 1;
750750
// Copyright evidence captures intellectual property assertions, providing evidence of possible ownership and legal protection.
751751
repeated EvidenceCopyright copyright = 2;

‎schema/bom-1.7.schema.json‎

Lines changed: 10 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1454,32 +1454,22 @@
14541454
},
14551455
"licenseChoice": {
14561456
"title": "License Choice",
1457-
"description": "EITHER (list of SPDX licenses and/or named licenses) OR (tuple of one SPDX License Expression)",
1457+
"description": "A list of SPDX licenses and/or named licenses and/or SPDX License Expression.",
14581458
"type": "array",
1459-
"oneOf": [
1460-
{
1461-
"title": "Multiple licenses",
1462-
"description": "A list of SPDX licenses and/or named licenses.",
1463-
"type": "array",
1464-
"items": {
1459+
"items": {
1460+
"oneOf": [
1461+
{
14651462
"type": "object",
14661463
"title": "License",
14671464
"required": ["license"],
14681465
"additionalProperties": false,
14691466
"properties": {
14701467
"license": {"$ref": "#/definitions/license"}
14711468
}
1472-
}
1473-
},
1474-
{
1475-
"title": "SPDX License Expression",
1476-
"description": "A tuple of exactly one SPDX License Expression.",
1477-
"type": "array",
1478-
"additionalItems": false,
1479-
"minItems": 1,
1480-
"maxItems": 1,
1481-
"items": [{
1469+
},
1470+
{
14821471
"type": "object",
1472+
"title": "SPDX License Expression",
14831473
"additionalProperties": false,
14841474
"required": ["expression"],
14851475
"properties": {
@@ -1501,9 +1491,9 @@
15011491
"description": "An optional identifier which can be used to reference the license elsewhere in the BOM. Every bom-ref must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid conflicts with BOM-Links."
15021492
}
15031493
}
1504-
}]
1505-
}
1506-
]
1494+
}
1495+
]
1496+
}
15071497
},
15081498
"commit": {
15091499
"type": "object",

‎schema/bom-1.7.xsd‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2297,9 +2297,12 @@ limitations under the License.
22972297
</xs:simpleType>
22982298

22992299
<xs:complexType name="licenseChoiceType">
2300-
<xs:choice>
2301-
<xs:element name="license" type="bom:licenseType" minOccurs="0" maxOccurs="unbounded"/>
2302-
<xs:element name="expression" minOccurs="0" maxOccurs="1">
2300+
<xs:annotation>
2301+
<xs:documentation>A list of SPDX licenses and/or named licenses and/or SPDX License Expression.</xs:documentation>
2302+
</xs:annotation>
2303+
<xs:choice minOccurs="0" maxOccurs="unbounded">
2304+
<xs:element name="license" type="bom:licenseType"/>
2305+
<xs:element name="expression">
23032306
<xs:annotation>
23042307
<xs:documentation>A valid SPDX license expression.
23052308
Refer to https://spdx.org/specifications for syntax requirements

‎tools/src/test/resources/1.6/invalid-license-declared-concluded-mix-1.6.json‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
{
2+
"$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
3+
"bomFormat": "CycloneDX",
4+
"specVersion": "1.6",
5+
"serialNumber": "urn:uuid:df628836-6b9b-41c9-a724-b44743c54d42",
6+
"version": 1,
7+
"metadata": {
8+
"lifecycles": [{"phase": "design"}]
9+
},
10+
"components": [
11+
{
12+
"type": "library",
13+
"group": "com.example",
14+
"name": "situation-A",
15+
"version": "1",
16+
"description": "Multiple licenses: declared ids/names, and a concluded expression",
17+
"licenses": [
18+
{
19+
"license": {
20+
"id": "MIT",
21+
"acknowledgement": "declared"
22+
}
23+
},
24+
{
25+
"license": {
26+
"id": "PostgreSQL",
27+
"acknowledgement": "declared"
28+
}
29+
},
30+
{
31+
"license": {
32+
"name": "Apache Software License",
33+
"acknowledgement": "declared"
34+
}
35+
},
36+
{
37+
"expression": "(MIT OR PostgreSQL OR Apache-2.0)",
38+
"acknowledgement": "concluded"
39+
}
40+
]
41+
},
42+
{
43+
"type": "library",
44+
"group": "com.example",
45+
"name": "situation-B",
46+
"version": "1",
47+
"description": "Multiple license expressions: one declared, one concluded",
48+
"licenses": [
49+
{
50+
"expression": "MIT OR (GPL-3.0 OR GPL-2.0)",
51+
"acknowledgement": "declared"
52+
},
53+
{
54+
"expression": "(GPL-3.0-only AND LGPL-2.0-only)",
55+
"acknowledgement": "concluded"
56+
}
57+
]
58+
},
59+
{
60+
"type": "library",
61+
"group": "com.example",
62+
"name": "situation-C",
63+
"version": "1",
64+
"description": "Multiple license: one declared expression, one concluded id",
65+
"licenses": [
66+
{
67+
"expression": "GPL-3.0-or-later OR GPL-2.0",
68+
"acknowledgement": "declared"
69+
},
70+
{
71+
"license": {
72+
"id": "GPL-3.0-only",
73+
"acknowledgement": "concluded"
74+
}
75+
}
76+
]
77+
}
78+
]
79+
}

‎tools/src/test/resources/1.6/invalid-license-declared-concluded-mix-1.6.xml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
<?xml version="1.0"?>
2+
<bom xmlns="http://cyclonedx.org/schema/bom/1.6"
3+
serialNumber="urn:uuid:df628836-6b9b-41c9-a724-b44743c54d42"
4+
>
5+
<!--
6+
All license posture in here is for show-case ony.
7+
This is not a real law-case!
8+
-->
9+
<metadata>
10+
<lifecycles><lifecycle><phase>design</phase></lifecycle></lifecycles>
11+
</metadata>
12+
<components>
13+
<component type="library">
14+
<group>com.example</group>
15+
<name>situation-A</name>
16+
<version>1</version>
17+
<description>Multiple licenses: declared ids/names, and a concluded expression</description>
18+
<licenses>
19+
<license acknowledgement="declared"><id>MIT</id></license>
20+
<license acknowledgement="declared"><id>PostgreSQL</id></license>
21+
<license acknowledgement="declared"><name>Apache Software License</name></license>
22+
<expression acknowledgement="concluded">(MIT OR PostgreSQL OR Apache-2.0)</expression>
23+
</licenses>
24+
</component>
25+
<component type="library">
26+
<group>com.example</group>
27+
<name>situation-B</name>
28+
<version>1</version>
29+
<description>Multiple license expressions: one declared, one concluded</description>
30+
<licenses>
31+
<expression acknowledgement="declared">MIT OR (GPL-3.0 OR GPL-2.0)</expression>
32+
<expression acknowledgement="concluded">(GPL-3.0-only AND LGPL-2.0-only)</expression>
33+
</licenses>
34+
</component>
35+
<component type="library">
36+
<group>com.example</group>
37+
<name>situation-C</name>
38+
<version>1</version>
39+
<description>Multiple license: one declared expression, one concluded id</description>
40+
<licenses>
41+
<expression acknowledgement="declared">GPL-3.0-or-later OR GPL-2.0</expression>
42+
<license acknowledgement="concluded"><id>GPL-3.0-only</id></license>
43+
</licenses>
44+
</component>
45+
</components>
46+
</bom>

‎tools/src/test/resources/1.7/valid-license-declared-concluded-mix-1.7.json‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
{
2+
"$schema": "http://cyclonedx.org/schema/bom-1.7.schema.json",
3+
"bomFormat": "CycloneDX",
4+
"specVersion": "1.7",
5+
"serialNumber": "urn:uuid:df628836-6b9b-41c9-a724-b44743c54d42",
6+
"version": 1,
7+
"metadata": {
8+
"lifecycles": [{"phase": "design"}]
9+
},
10+
"components": [
11+
{
12+
"type": "library",
13+
"group": "com.example",
14+
"name": "situation-A",
15+
"version": "1",
16+
"description": "Multiple licenses: declared ids/names, and a concluded expression",
17+
"licenses": [
18+
{
19+
"license": {
20+
"id": "MIT",
21+
"acknowledgement": "declared"
22+
}
23+
},
24+
{
25+
"license": {
26+
"id": "PostgreSQL",
27+
"acknowledgement": "declared"
28+
}
29+
},
30+
{
31+
"license": {
32+
"name": "Apache Software License",
33+
"acknowledgement": "declared"
34+
}
35+
},
36+
{
37+
"expression": "(MIT OR PostgreSQL OR Apache-2.0)",
38+
"acknowledgement": "concluded"
39+
}
40+
]
41+
},
42+
{
43+
"type": "library",
44+
"group": "com.example",
45+
"name": "situation-B",
46+
"version": "1",
47+
"description": "Multiple license expressions: one declared, one concluded",
48+
"licenses": [
49+
{
50+
"expression": "MIT OR (GPL-3.0 OR GPL-2.0)",
51+
"acknowledgement": "declared"
52+
},
53+
{
54+
"expression": "(GPL-3.0-only AND LGPL-2.0-only)",
55+
"acknowledgement": "concluded"
56+
}
57+
]
58+
},
59+
{
60+
"type": "library",
61+
"group": "com.example",
62+
"name": "situation-C",
63+
"version": "1",
64+
"description": "Multiple license: one declared expression, one concluded id",
65+
"licenses": [
66+
{
67+
"expression": "GPL-3.0-or-later OR GPL-2.0",
68+
"acknowledgement": "declared"
69+
},
70+
{
71+
"license": {
72+
"id": "GPL-3.0-only",
73+
"acknowledgement": "concluded"
74+
}
75+
}
76+
]
77+
}
78+
]
79+
}

‎tools/src/test/resources/1.7/valid-license-declared-concluded-mix-1.7.textproto‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
# proto-file: schema/bom-1.7.proto
2+
# proto-message: Bom
3+
4+
# All license posture in here is for show-case ony.
5+
# This is not a real law-case!
6+
7+
spec_version: "1.7"
8+
version: 1
9+
serial_number: "urn:uuid:df628836-6b9b-41c9-a724-b44743c54d42"
10+
metadata: {
11+
lifecycles { phase: LIFECYCLE_PHASE_DESIGN }
12+
}
13+
components {
14+
type: CLASSIFICATION_LIBRARY
15+
group: "com.example"
16+
name: "situation-A"
17+
version: "1"
18+
description: "Multiple licenses: declared ids/names, and a concluded expression"
19+
licenses {
20+
license {
21+
id: "MIT"
22+
acknowledgement: LICENSE_ACKNOWLEDGEMENT_ENUMERATION_DECLARED
23+
}
24+
}
25+
licenses {
26+
license {
27+
id: "PostgreSQL"
28+
acknowledgement: LICENSE_ACKNOWLEDGEMENT_ENUMERATION_DECLARED
29+
}
30+
}
31+
licenses {
32+
license {
33+
name: "Apache Software License"
34+
acknowledgement: LICENSE_ACKNOWLEDGEMENT_ENUMERATION_DECLARED
35+
}
36+
}
37+
licenses {
38+
expression: "(MIT OR PostgreSQL OR Apache-2.0)"
39+
acknowledgement: LICENSE_ACKNOWLEDGEMENT_ENUMERATION_CONCLUDED
40+
}
41+
}
42+
components {
43+
type: CLASSIFICATION_LIBRARY
44+
group: "com.example"
45+
name: "situation-B"
46+
version: "1"
47+
description: "Multiple license expressions: one declared, one concluded"
48+
licenses {
49+
expression: "MIT OR (GPL-3.0 OR GPL-2.0)"
50+
acknowledgement: LICENSE_ACKNOWLEDGEMENT_ENUMERATION_DECLARED
51+
}
52+
licenses {
53+
expression: "(GPL-3.0-only AND LGPL-2.0-only)"
54+
acknowledgement: LICENSE_ACKNOWLEDGEMENT_ENUMERATION_CONCLUDED
55+
}
56+
}
57+
components {
58+
type: CLASSIFICATION_LIBRARY
59+
group: "com.example"
60+
name: "situation-C"
61+
version: "1"
62+
description: "Multiple license: one declared expression, one concluded id"
63+
licenses {
64+
expression: "GPL-3.0-or-later OR GPL-2.0"
65+
acknowledgement: LICENSE_ACKNOWLEDGEMENT_ENUMERATION_DECLARED
66+
}
67+
licenses {
68+
license {
69+
id: "GPL-3.0-only"
70+
acknowledgement: LICENSE_ACKNOWLEDGEMENT_ENUMERATION_CONCLUDED
71+
}
72+
}
73+
}

0 commit comments

Comments
 (0)