Fix cyclonedx unhashable type bug #3016

Signed-off-by: Ayan Sinha Mahapatra <[email protected]>

Author: AyanSinhaMahapatra

src/formattedcode/output_cyclonedx.py

@@ -61,6 +61,10 @@ class CycloneDxLicenseExpression(ToDictMixin):
     """
     expression: str = attr.ib(default=None)
 
+    @property
+    def identifier(self):
+        return self.expression
+
     @classmethod
     def from_package(cls, package):
         """
@@ -81,6 +85,10 @@ class CycloneDxProperty(ToDictMixin):
     name: str = attr.ib()
     value: str = attr.ib()
 
+    @property
+    def identifier(self):
+        return f"{self.name}-{self.value}"
+
 
 @attr.s
 class CycloneDxHashObject(ToDictMixin):
@@ -98,6 +106,10 @@ class CycloneDxHashObject(ToDictMixin):
     alg: str = attr.ib()
     content: str = attr.ib()
 
+    @property
+    def identifier(self):
+        return f"{self.alg}-{self.content}"
+
     @classmethod
     def from_package(cls, package):
         """
@@ -159,6 +171,10 @@ class CycloneDxExternalRef(ToDictMixin):
     comment: str = attr.ib(default=None)
     hashes: List[CycloneDxHashObject] = attr.ib(factory=list)
 
+    @property
+    def identifier(self):
+        return f"{self.url}-{self.type}-{self.comment}"
+
     @classmethod
     def from_package(cls, package: dict):
         """
@@ -428,8 +444,8 @@ def merge_lists(x, y):
     Merge ``y`` list items in list ``x`` avoiding duplicate entries.
     Return the updated ``x``.
     """
-    seen = set(x)
-    new = (i for i in y if i not in seen)
+    seen = set([item.identifier for item in x])
+    new = (item for item in y if item.identifier not in seen)
     x.extend(new)
     return x
 

tests/formattedcode/data/cyclonedx/simple-icu-expected.json

@@ -0,0 +1,36 @@
+{
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.3",
+  "version": 1,
+  "components": [
+    {
+      "name": "source",
+      "version": null,
+      "bom-ref": "pkg:autotools/source",
+      "group": null,
+      "type": "library",
+      "scope": "required",
+      "copyright": null,
+      "author": null,
+      "description": null,
+      "purl": "pkg:autotools/source",
+      "hashes": [],
+      "licenses": [
+        {
+          "expression": "LicenseRef-scancode-unicode AND FSFUL AND (FSFUL AND LicenseRef-scancode-unicode)"
+        },
+        {
+          "expression": "LicenseRef-scancode-unicode"
+        }
+      ],
+      "externalReferences": [],
+      "properties": [
+        {
+          "name": "WARNING",
+          "value": "WARNING: component skipped in CycloneDX output: {'type': 'autotools', 'namespace': None, 'name': 'source', 'version': None, 'qualifiers': {}, 'subpath': None, 'primary_language': None, 'description': None, 'release_date': None, 'parties': [], 'keywords': [], 'homepage_url': None, 'download_url': None, 'size': None, 'sha1': None, 'md5': None, 'sha256': None, 'sha512': None, 'bug_tracking_url': None, 'code_view_url': None, 'vcs_url': None, 'copyright': None, 'declared_license_expression': 'unicode AND fsf-free AND (fsf-free AND unicode)', 'declared_license_expression_spdx': 'LicenseRef-scancode-unicode AND FSFUL AND (FSFUL AND LicenseRef-scancode-unicode)', 'license_detections': [{'license_expression': 'unicode', 'detection_log': ['from-package-file'], 'matches': [{'score': 100.0, 'start_line': 7, 'end_line': 7, 'matched_length': 10, 'match_coverage': 100.0, 'matcher': '2-aho', 'license_expression': 'unicode', 'rule_identifier': 'unicode_12.RULE', 'rule_url': 'https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/unicode_12.RULE', 'matched_text': 'License & terms of use: http://www.unicode.org/copyright.html'}]}, {'license_expression': 'fsf-free', 'detection_log': ['from-package-file'], 'matches': [{'score': 100.0, 'start_line': 13, 'end_line': 14, 'matched_length': 18, 'match_coverage': 100.0, 'matcher': '2-aho', 'license_expression': 'fsf-free', 'rule_identifier': 'fsf-free.LICENSE', 'rule_url': 'https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/licenses/fsf-free.LICENSE', 'matched_text': 'This configure script is free software; the Free Software Foundation\\n# gives unlimited permission to copy, distribute and modify it.'}]}, {'license_expression': 'fsf-free AND unicode', 'detection_log': ['from-package-file'], 'matches': [{'score': 100.0, 'start_line': 1587, 'end_line': 1588, 'matched_length': 18, 'match_coverage': 100.0, 'matcher': '2-aho', 'license_expression': 'fsf-free', 'rule_identifier': 'fsf-free.LICENSE', 'rule_url': 'https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/licenses/fsf-free.LICENSE', 'matched_text': 'This configure script is free software; the Free Software Foundation\\ngives unlimited permission to copy, distribute and modify it.'}, {'score': 100.0, 'start_line': 1590, 'end_line': 1590, 'matched_length': 10, 'match_coverage': 100.0, 'matcher': '2-aho', 'license_expression': 'unicode', 'rule_identifier': 'unicode_12.RULE', 'rule_url': 'https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/unicode_12.RULE', 'matched_text': 'License & terms of use: http://www.unicode.org/copyright.html'}]}, {'license_expression': 'fsf-free', 'detection_log': ['from-package-file'], 'matches': [{'score': 100.0, 'start_line': 8663, 'end_line': 8664, 'matched_length': 19, 'match_coverage': 100.0, 'matcher': '2-aho', 'license_expression': 'fsf-free', 'rule_identifier': 'fsf-free.RULE', 'rule_url': 'https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/fsf-free.RULE', 'matched_text': 'This config.status script is free software; the Free Software Foundation\\ngives unlimited permission to copy, distribute and modify it.\"'}]}], 'other_license_expression': None, 'other_license_expression_spdx': None, 'other_license_detections': [], 'extracted_license_statement': None, 'notice_text': None, 'source_packages': [], 'extra_data': {}, 'repository_homepage_url': None, 'repository_download_url': None, 'api_data_url': None, 'package_uid': 'pkg:autotools/source?uuid=c629d8db-61d4-4d85-b222-ad9914234d67', 'datafile_paths': ['simple-icu/source/configure'], 'datasource_ids': ['autotools_configure'], 'purl': 'pkg:autotools/source'}"
+        }
+      ]
+    }
+  ],
+  "dependencies": []
+}