Skip to content

Commit e30dfe6

Browse files
pombredannepombredanne
authored
Merge pull request #2704 from nexB/spdx-2.2
Adopt SPDX v2.2 and fix SPDX TV correctness
2 parents 891d99e + e44733f commit e30dfe6

File tree

12 files changed

+144
-86
lines changed

12 files changed

+144
-86
lines changed

‎requirements.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ saneyaml==0.5.2
6666
six==1.16.0
6767
sortedcontainers==2.4.0
6868
soupsieve==2.2.1
69-
spdx-tools==0.6.1
69+
spdx-tools==0.7.0a3
7070
text-unidecode==1.3
7171
toml==0.10.2
7272
typecode==21.6.1

‎setup-mini.cfg‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@ install_requires =
9393
pymaven_patch >= 0.2.8
9494
requests >= 2.7.0, < 3.0.0
9595
saneyaml >= 0.5.2
96-
spdx_tools >= 0.6.0
96+
spdx_tools >= 0.7.0a3
9797
text_unidecode >= 1.0, < 2.0
9898
toml >= 0.10.0
9999
typing >=3.6, < 3.7; python_version < "3.7"

‎setup.cfg‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@ install_requires =
9393
pymaven_patch >= 0.2.8
9494
requests >= 2.7.0, < 3.0.0
9595
saneyaml >= 0.5.2
96-
spdx_tools >= 0.6.0
96+
spdx_tools >= 0.7.0a3
9797
text_unidecode >= 1.0, < 2.0
9898
toml >= 0.10.0
9999
typing >=3.6, < 3.7; python_version < "3.7"

‎src/formattedcode/output_spdx.py‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -215,6 +215,8 @@ def write_spdx(
215215
package_name='',
216216
download_location=NoAssert(),
217217
as_tagvalue=True,
218+
spdx_version = (2, 2),
219+
with_notice_text=False,
218220
):
219221
"""
220222
Write scan output as SPDX Tag/value to ``output_file`` file-like
@@ -231,19 +233,25 @@ def write_spdx(
231233

232234
ns_prefix = '_'.join(package_name.lower().split())
233235
comment = notice + f'\nSPDX License List: {scancode_config.spdx_license_list_version}'
236+
234237
doc = Document(
235-
version=Version(2, 1),
238+
version=Version(*spdx_version),
236239
data_license=License.from_identifier('CC0-1.0'),
237240
comment=notice,
238241
namespace=f'http://spdx.org/spdxdocs/{ns_prefix}-{uuid.uuid4()}',
242+
license_list_version=scancode_config.spdx_license_list_version,
243+
name='SPDX Document created by ScanCode Toolkit'
239244
)
245+
240246
tool_name = tool_name or 'ScanCode'
241247
doc.creation_info.add_creator(Tool(f'{tool_name} {tool_version}'))
242248
doc.creation_info.set_created_now()
243249

250+
package_id = '001'
244251
package = doc.package = Package(
245252
name=package_name,
246-
download_location=download_location
253+
download_location=download_location,
254+
spdx_id=f'SPDXRef-{package_id}',
247255
)
248256

249257
# Use a set of unique copyrights for the package.
@@ -253,7 +261,7 @@ def write_spdx(
253261
all_files_have_no_copyright = True
254262

255263
# FIXME: this should walk the codebase instead!!!
256-
for file_data in files:
264+
for sid, file_data in enumerate(files, 1):
257265

258266
# Skip directories.
259267
if file_data.get('type') != 'file':
@@ -263,6 +271,7 @@ def write_spdx(
263271
# SPDX output (with explicit leading './').
264272
name = './' + file_data.get('path')
265273
file_entry = File(
274+
spdx_id=f'SPDXRef-{sid}',
266275
name=name,
267276
chk_sum=Algorithm('SHA1', file_data.get('sha1') or '')
268277
)

‎tests/formattedcode/data/spdx/license_known/expected.tv‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,10 @@
11
# Document Information
2-
SPDXVersion: SPDX-2.1
2+
SPDXVersion: SPDX-2.2
33
DataLicense: CC0-1.0
4+
DocumentNamespace: http://spdx.org/spdxdocs/scan
5+
DocumentName: SPDX Document created by ScanCode Toolkit
6+
LicenseListVersion: 3.14
47
SPDXID: SPDXRef-DOCUMENT
5-
DocumentNamespace: http://spdx.org/spdxdocs/scan-ab8a6f7e-3a9a-466f-964f-be56571a3c19
68
DocumentComment: <text>Generated with ScanCode and provided on an "AS IS" BASIS, WITHOUT WARRANTIES
79
OR CONDITIONS OF ANY KIND, either express or implied. No content created from
810
ScanCode should be considered or used as legal advice. Consult an Attorney
@@ -12,6 +14,7 @@ Visit https://github.com/nexB/scancode-toolkit/ for support and download.</text>
1214
# Creation Info
1315
# Package
1416
PackageName: scan
17+
SPDXID: SPDXRef-001
1518
PackageDownloadLocation: NOASSERTION
1619
PackageVerificationCode: 517c26f04b5a3edaaa0c17bf1a6571953209e209
1720
PackageLicenseDeclared: NOASSERTION
@@ -21,12 +24,14 @@ PackageLicenseInfoFromFiles: CC0-1.0
2124
PackageCopyrightText: NONE
2225
# File
2326
FileName: ./scan/apache-2.0.LICENSE
27+
SPDXID: SPDXRef-2
2428
FileChecksum: SHA1: 2b8b815229aa8a61e483fb4ba0588b8b6c491890
2529
LicenseConcluded: NOASSERTION
2630
LicenseInfoInFile: Apache-2.0
2731
FileCopyrightText: NONE
2832
# File
2933
FileName: ./scan/cc0-1.0.LICENSE
34+
SPDXID: SPDXRef-3
3035
FileChecksum: SHA1: 172444e7c137eb5cd3cae530aca0879c90f7fada
3136
LicenseConcluded: NOASSERTION
3237
LicenseInfoInFile: CC0-1.0

‎tests/formattedcode/data/spdx/license_known/expected_with_text.tv‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,10 @@
11
# Document Information
2-
SPDXVersion: SPDX-2.1
2+
SPDXVersion: SPDX-2.2
33
DataLicense: CC0-1.0
4+
DocumentNamespace: http://spdx.org/spdxdocs/scan
5+
DocumentName: SPDX Document created by ScanCode Toolkit
6+
LicenseListVersion: 3.14
47
SPDXID: SPDXRef-DOCUMENT
5-
DocumentNamespace: http://spdx.org/spdxdocs/scan-8f1122d0-e528-466c-a22e-04bc0b174984
68
DocumentComment: <text>Generated with ScanCode and provided on an "AS IS" BASIS, WITHOUT WARRANTIES
79
OR CONDITIONS OF ANY KIND, either express or implied. No content created from
810
ScanCode should be considered or used as legal advice. Consult an Attorney
@@ -12,6 +14,7 @@ Visit https://github.com/nexB/scancode-toolkit/ for support and download.</text>
1214
# Creation Info
1315
# Package
1416
PackageName: scan
17+
SPDXID: SPDXRef-001
1518
PackageDownloadLocation: NOASSERTION
1619
PackageVerificationCode: 517c26f04b5a3edaaa0c17bf1a6571953209e209
1720
PackageLicenseDeclared: NOASSERTION
@@ -21,12 +24,14 @@ PackageLicenseInfoFromFiles: CC0-1.0
2124
PackageCopyrightText: NONE
2225
# File
2326
FileName: ./scan/apache-2.0.LICENSE
27+
SPDXID: SPDXRef-2
2428
FileChecksum: SHA1: 2b8b815229aa8a61e483fb4ba0588b8b6c491890
2529
LicenseConcluded: NOASSERTION
2630
LicenseInfoInFile: Apache-2.0
2731
FileCopyrightText: NONE
2832
# File
2933
FileName: ./scan/cc0-1.0.LICENSE
34+
SPDXID: SPDXRef-3
3035
FileChecksum: SHA1: 172444e7c137eb5cd3cae530aca0879c90f7fada
3136
LicenseConcluded: NOASSERTION
3237
LicenseInfoInFile: CC0-1.0

‎tests/formattedcode/data/spdx/license_ref/expected.tv‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,10 @@
11
# Document Information
2-
SPDXVersion: SPDX-2.1
2+
SPDXVersion: SPDX-2.2
33
DataLicense: CC0-1.0
4+
DocumentNamespace: http://spdx.org/spdxdocs/scan
5+
DocumentName: SPDX Document created by ScanCode Toolkit
6+
LicenseListVersion: 3.14
47
SPDXID: SPDXRef-DOCUMENT
5-
DocumentNamespace: http://spdx.org/spdxdocs/scan-25498bb4-1cfc-461c-a7cf-389008e49b5a
68
DocumentComment: <text>Generated with ScanCode and provided on an "AS IS" BASIS, WITHOUT WARRANTIES
79
OR CONDITIONS OF ANY KIND, either express or implied. No content created from
810
ScanCode should be considered or used as legal advice. Consult an Attorney
@@ -12,6 +14,7 @@ Visit https://github.com/nexB/scancode-toolkit/ for support and download.</text>
1214
# Creation Info
1315
# Package
1416
PackageName: scan
17+
SPDXID: SPDXRef-001
1518
PackageDownloadLocation: NOASSERTION
1619
PackageVerificationCode: b49eeefd776fb76555378d07fd05d986a249a2b3
1720
PackageLicenseDeclared: NOASSERTION
@@ -25,6 +28,7 @@ PackageCopyrightText: <text>Copyright (c) 2017 nexB Inc. and others
2528
</text>
2629
# File
2730
FileName: ./scan/NOTICE
31+
SPDXID: SPDXRef-2
2832
FileChecksum: SHA1: f9c28fa2714ad0c2e36d3e5561afb0031fa76831
2933
LicenseConcluded: NOASSERTION
3034
LicenseInfoInFile: Apache-2.0
@@ -36,16 +40,19 @@ FileCopyrightText: <text>Copyright (c) 2017 nexB Inc. and others
3640
</text>
3741
# Extracted Licenses
3842
LicenseID: LicenseRef-scancode-other-copyleft
43+
LicenseName: Other Copyleft Licenses
3944
LicenseComment: <text>See details at https://github.com/nexB/scancode-toolkit/blob/develop/src/licensedcode/data/licenses/other-copyleft.yml
4045
</text>
4146
ExtractedText: <text>See details at https://github.com/nexB/scancode-toolkit/blob/develop/src/licensedcode/data/licenses/other-copyleft.yml
4247
</text>
4348
LicenseID: LicenseRef-scancode-other-permissive
49+
LicenseName: Other Permissive Licenses
4450
LicenseComment: <text>See details at https://github.com/nexB/scancode-toolkit/blob/develop/src/licensedcode/data/licenses/other-permissive.yml
4551
</text>
4652
ExtractedText: <text>See details at https://github.com/nexB/scancode-toolkit/blob/develop/src/licensedcode/data/licenses/other-permissive.yml
4753
</text>
4854
LicenseID: LicenseRef-scancode-scancode-acknowledgment
55+
LicenseName: ScanCode generated data acknowledgment
4956
LicenseComment: <text>See details at https://github.com/nexB/scancode-toolkit/blob/develop/src/licensedcode/data/licenses/scancode-acknowledgment.yml
5057
</text>
5158
ExtractedText: <text>See details at https://github.com/nexB/scancode-toolkit/blob/develop/src/licensedcode/data/licenses/scancode-acknowledgment.yml

‎tests/formattedcode/data/spdx/license_ref/expected_with_text.tv‎

Lines changed: 33 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,10 @@
11
# Document Information
2-
SPDXVersion: SPDX-2.1
2+
SPDXVersion: SPDX-2.2
33
DataLicense: CC0-1.0
4+
DocumentNamespace: http://spdx.org/spdxdocs/scan
5+
DocumentName: SPDX Document created by ScanCode Toolkit
6+
LicenseListVersion: 3.14
47
SPDXID: SPDXRef-DOCUMENT
5-
DocumentNamespace: http://spdx.org/spdxdocs/scan-ff644ef5-7b50-4793-ac2e-69cb1a0bece3
68
DocumentComment: <text>Generated with ScanCode and provided on an "AS IS" BASIS, WITHOUT WARRANTIES
79
OR CONDITIONS OF ANY KIND, either express or implied. No content created from
810
ScanCode should be considered or used as legal advice. Consult an Attorney
@@ -12,6 +14,7 @@ Visit https://github.com/nexB/scancode-toolkit/ for support and download.</text>
1214
# Creation Info
1315
# Package
1416
PackageName: scan
17+
SPDXID: SPDXRef-001
1518
PackageDownloadLocation: NOASSERTION
1619
PackageVerificationCode: b49eeefd776fb76555378d07fd05d986a249a2b3
1720
PackageLicenseDeclared: NOASSERTION
@@ -25,6 +28,7 @@ PackageCopyrightText: <text>Copyright (c) 2017 nexB Inc. and others
2528
</text>
2629
# File
2730
FileName: ./scan/NOTICE
31+
SPDXID: SPDXRef-2
2832
FileChecksum: SHA1: f9c28fa2714ad0c2e36d3e5561afb0031fa76831
2933
LicenseConcluded: NOASSERTION
3034
LicenseInfoInFile: Apache-2.0
@@ -36,6 +40,7 @@ FileCopyrightText: <text>Copyright (c) 2017 nexB Inc. and others
3640
</text>
3741
# Extracted Licenses
3842
LicenseID: LicenseRef-scancode-other-copyleft
43+
LicenseName: Other Copyleft Licenses
3944
LicenseComment: <text>See details at https://github.com/nexB/scancode-toolkit/blob/develop/src/licensedcode/data/licenses/other-copyleft.yml
4045
</text>
4146
ExtractedText: <text>Software license
@@ -53,12 +58,12 @@ CONDITIONS OF ANY KIND, either express or implied. See the License for the
5358
specific language governing permissions and limitations under the License.
5459
When you publish or redistribute any data created with ScanCode or any ScanCode
5560
derivative work, you must accompany this data with the following acknowledgment:
56-
Generated with ScanCode and provided on an "AS IS" BASIS, WITHOUT WARRANTIES
57-
OR CONDITIONS OF ANY KIND, either express or implied. No content created from
58-
ScanCode should be considered or used as legal advice. Consult an Attorney
59-
for any legal advice.
60-
ScanCode is a free software code scanning tool from nexB Inc. and others.
61-
Visit https://github.com/nexB/scancode-toolkit/ for support and download.
61+
Generated with ScanCode and provided on an "AS IS" BASIS, WITHOUT WARRANTIES
62+
OR CONDITIONS OF ANY KIND, either express or implied. No content created from
63+
ScanCode should be considered or used as legal advice. Consult an Attorney
64+
for any legal advice.
65+
ScanCode is a free software code scanning tool from nexB Inc. and others.
66+
Visit https://github.com/nexB/scancode-toolkit/ for support and download.
6267
Third-party software licenses
6368
=============================
6469
ScanCode embeds third-party free and open source software packages under various
@@ -71,8 +76,8 @@ https://github.com/nexB/scancode-toolkit/
7176
or https://github.com/nexB/scancode-thirdparty-src/
7277
You may also contact us to request the source code by email at [email protected] or
7378
by postal mail at:
74-
nexB Inc., ScanCode open source code request
75-
735 Industrial Road, Suite #101, 94070 San Carlos, CA, USA
79+
nexB Inc., ScanCode open source code request
80+
735 Industrial Road, Suite #101, 94070 San Carlos, CA, USA
7681
Please indicate in your communication the ScanCode version for which you are
7782
requesting source code.
7883
License for ScanCode datasets
@@ -81,6 +86,7 @@ ScanCode includes datasets (e.g. for license detection) that are dedicated
8186
to the Public Domain using the Creative Commons CC0 1.0 Universal (CC0 1.0)
8287
Public Domain Dedication: http://creativecommons.org/publicdomain/zero/1.0/</text>
8388
LicenseID: LicenseRef-scancode-other-permissive
89+
LicenseName: Other Permissive Licenses
8490
LicenseComment: <text>See details at https://github.com/nexB/scancode-toolkit/blob/develop/src/licensedcode/data/licenses/other-permissive.yml
8591
</text>
8692
ExtractedText: <text>Software license
@@ -98,12 +104,12 @@ CONDITIONS OF ANY KIND, either express or implied. See the License for the
98104
specific language governing permissions and limitations under the License.
99105
When you publish or redistribute any data created with ScanCode or any ScanCode
100106
derivative work, you must accompany this data with the following acknowledgment:
101-
Generated with ScanCode and provided on an "AS IS" BASIS, WITHOUT WARRANTIES
102-
OR CONDITIONS OF ANY KIND, either express or implied. No content created from
103-
ScanCode should be considered or used as legal advice. Consult an Attorney
104-
for any legal advice.
105-
ScanCode is a free software code scanning tool from nexB Inc. and others.
106-
Visit https://github.com/nexB/scancode-toolkit/ for support and download.
107+
Generated with ScanCode and provided on an "AS IS" BASIS, WITHOUT WARRANTIES
108+
OR CONDITIONS OF ANY KIND, either express or implied. No content created from
109+
ScanCode should be considered or used as legal advice. Consult an Attorney
110+
for any legal advice.
111+
ScanCode is a free software code scanning tool from nexB Inc. and others.
112+
Visit https://github.com/nexB/scancode-toolkit/ for support and download.
107113
Third-party software licenses
108114
=============================
109115
ScanCode embeds third-party free and open source software packages under various
@@ -116,8 +122,8 @@ https://github.com/nexB/scancode-toolkit/
116122
or https://github.com/nexB/scancode-thirdparty-src/
117123
You may also contact us to request the source code by email at [email protected] or
118124
by postal mail at:
119-
nexB Inc., ScanCode open source code request
120-
735 Industrial Road, Suite #101, 94070 San Carlos, CA, USA
125+
nexB Inc., ScanCode open source code request
126+
735 Industrial Road, Suite #101, 94070 San Carlos, CA, USA
121127
Please indicate in your communication the ScanCode version for which you are
122128
requesting source code.
123129
License for ScanCode datasets
@@ -126,6 +132,7 @@ ScanCode includes datasets (e.g. for license detection) that are dedicated
126132
to the Public Domain using the Creative Commons CC0 1.0 Universal (CC0 1.0)
127133
Public Domain Dedication: http://creativecommons.org/publicdomain/zero/1.0/</text>
128134
LicenseID: LicenseRef-scancode-scancode-acknowledgment
135+
LicenseName: ScanCode generated data acknowledgment
129136
LicenseComment: <text>See details at https://github.com/nexB/scancode-toolkit/blob/develop/src/licensedcode/data/licenses/scancode-acknowledgment.yml
130137
</text>
131138
ExtractedText: <text>Software license
@@ -143,12 +150,12 @@ CONDITIONS OF ANY KIND, either express or implied. See the License for the
143150
specific language governing permissions and limitations under the License.
144151
When you publish or redistribute any data created with ScanCode or any ScanCode
145152
derivative work, you must accompany this data with the following acknowledgment:
146-
Generated with ScanCode and provided on an "AS IS" BASIS, WITHOUT WARRANTIES
147-
OR CONDITIONS OF ANY KIND, either express or implied. No content created from
148-
ScanCode should be considered or used as legal advice. Consult an Attorney
149-
for any legal advice.
150-
ScanCode is a free software code scanning tool from nexB Inc. and others.
151-
Visit https://github.com/nexB/scancode-toolkit/ for support and download.
153+
Generated with ScanCode and provided on an "AS IS" BASIS, WITHOUT WARRANTIES
154+
OR CONDITIONS OF ANY KIND, either express or implied. No content created from
155+
ScanCode should be considered or used as legal advice. Consult an Attorney
156+
for any legal advice.
157+
ScanCode is a free software code scanning tool from nexB Inc. and others.
158+
Visit https://github.com/nexB/scancode-toolkit/ for support and download.
152159
Third-party software licenses
153160
=============================
154161
ScanCode embeds third-party free and open source software packages under various
@@ -161,8 +168,8 @@ https://github.com/nexB/scancode-toolkit/
161168
or https://github.com/nexB/scancode-thirdparty-src/
162169
You may also contact us to request the source code by email at [email protected] or
163170
by postal mail at:
164-
nexB Inc., ScanCode open source code request
165-
735 Industrial Road, Suite #101, 94070 San Carlos, CA, USA
171+
nexB Inc., ScanCode open source code request
172+
735 Industrial Road, Suite #101, 94070 San Carlos, CA, USA
166173
Please indicate in your communication the ScanCode version for which you are
167174
requesting source code.
168175
License for ScanCode datasets

‎tests/formattedcode/data/spdx/simple/expected.rdf‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
11
{
22
"rdf:RDF": {
33
"ns1:SpdxDocument": {
4+
"ns1:name": {
5+
"@rdf:resource": "SPDX Document created by ScanCode Toolkit"
6+
},
47
"ns1:dataLicense": {
58
"@rdf:resource": "http://spdx.org/licenses/CC0-1.0"
69
},
@@ -22,11 +25,14 @@
2225
}
2326
},
2427
"ns1:fileName": "./test.txt",
25-
"@rdf:about": "http://www.spdx.org/files#None"
28+
"@rdf:about": "http://www.spdx.org/files#SPDXRef-1"
2629
}
2730
},
2831
"ns1:describesPackage": {
2932
"ns1:Package": {
33+
"ns1:Package": {
34+
"@rdf:resource": "SPDXRef-001"
35+
},
3036
"ns1:downloadLocation": {
3137
"@rdf:resource": "http://spdx.org/rdf/terms#noassertion"
3238
},
@@ -43,14 +49,14 @@
4349
"@rdf:resource": "http://spdx.org/rdf/terms#none"
4450
},
4551
"ns1:hasFile": {
46-
"@rdf:resource": "http://www.spdx.org/files#None"
52+
"@rdf:resource": "http://www.spdx.org/files#SPDXRef-1"
4753
},
4854
"@rdf:about": "http://www.spdx.org/tools#SPDXRef-Package",
4955
"ns1:name": "simple"
5056
}
5157
},
5258
"@rdf:about": "http://www.spdx.org/tools#SPDXRef-DOCUMENT",
53-
"ns1:specVersion": "SPDX-2.1"
59+
"ns1:specVersion": "SPDX-2.2"
5460
},
5561
"@xmlns:ns1": "http://spdx.org/rdf/terms#",
5662
"@xmlns:rdf": "http://www.w3.org/1999/02/22-rdf-syntax-ns#"

0 commit comments

Comments
 (0)