From 79bf654fb5230b13332b1398e7d73381e28658ad Mon Sep 17 00:00:00 2001 From: tdruez Date: Tue, 9 Sep 2025 12:48:08 +0400 Subject: [PATCH 01/11] Set documentDescribes to reference the root SPDX element(s) only Signed-off-by: tdruez --- scanpipe/pipes/output.py | 17 ++++++++++++++++- scanpipe/pipes/spdx.py | 10 +++++++--- 2 files changed, 23 insertions(+), 4 deletions(-) diff --git a/scanpipe/pipes/output.py b/scanpipe/pipes/output.py index 44b77f120f..4a9ba77492 100644 --- a/scanpipe/pipes/output.py +++ b/scanpipe/pipes/output.py @@ -705,15 +705,29 @@ def to_spdx(project, include_files=False): discovereddependency_qs = get_queryset(project, "discovereddependency") document_spdx_id = f"SPDXRef-DOCUMENT-{project.uuid}" + project_as_root_package = spdx.Package( + spdx_id=f"SPDXRef-scancodeio-project-{project.uuid}", + name=project.name, + files_analyzed=True, + ) packages_as_spdx = [] license_expressions = [] relationships = [] for package in discoveredpackage_qs: - packages_as_spdx.append(package.as_spdx()) + spdx_package = package.as_spdx() + packages_as_spdx.append(spdx_package) + if license_expression := package.declared_license_expression: license_expressions.append(license_expression) + spdx_relationship = spdx.Relationship( + spdx_id=project_as_root_package.spdx_id, + related_spdx_id=spdx_package.spdx_id, + relationship="DEPENDS_ON", + ) + relationships.append(spdx_relationship) + for dependency in discovereddependency_qs: spdx_relationship = get_dependency_as_spdx_relationship( dependency, @@ -733,6 +747,7 @@ def to_spdx(project, include_files=False): spdx_id=document_spdx_id, name=f"scancodeio_{project.name}", namespace=f"https://scancode.io/spdxdocs/{project.uuid}", + describe=project_as_root_package, creation_info=spdx.CreationInfo(tool=f"ScanCode.io-{scancodeio_version}"), packages=packages_as_spdx, files=files_as_spdx, diff --git a/scanpipe/pipes/spdx.py b/scanpipe/pipes/spdx.py index 6ab474f99a..a3e5384370 100644 --- a/scanpipe/pipes/spdx.py +++ b/scanpipe/pipes/spdx.py @@ -267,7 +267,7 @@ class ExtractedLicensingInfo: """ license_id: str - extracted_text: str + extracted_text: str = "NOASSERTION" name: str = "" comment: str = "" @@ -542,6 +542,7 @@ class Document: name: str namespace: str + describe: Package creation_info: CreationInfo packages: list[Package] @@ -556,15 +557,18 @@ class Document: def as_dict(self): """Return the SPDX document as a serializable dict.""" + packages = [self.describe.as_dict()] + packages.extend([package.as_dict() for package in self.packages]) + data = { "spdxVersion": f"SPDX-{self.version}", "dataLicense": self.data_license, "SPDXID": self.spdx_id, "name": self.safe_document_name(self.name), "documentNamespace": self.namespace, + "documentDescribes": [self.describe.spdx_id], "creationInfo": self.creation_info.as_dict(), - "packages": [package.as_dict() for package in self.packages], - "documentDescribes": [package.spdx_id for package in self.packages], + "packages": packages, } if self.files: From 45e54aba44a7711427ae52bfbd2d47d58de08ac9 Mon Sep 17 00:00:00 2001 From: tdruez Date: Wed, 10 Sep 2025 08:59:33 +0400 Subject: [PATCH 02/11] Rework the implementation of documentDescribes in SPDX module Signed-off-by: tdruez --- scanpipe/pipes/output.py | 7 ++++--- scanpipe/pipes/spdx.py | 21 ++++++++++++--------- 2 files changed, 16 insertions(+), 12 deletions(-) diff --git a/scanpipe/pipes/output.py b/scanpipe/pipes/output.py index 4a9ba77492..8ab002fbe2 100644 --- a/scanpipe/pipes/output.py +++ b/scanpipe/pipes/output.py @@ -700,17 +700,18 @@ def to_spdx(project, include_files=False): Return the path of the generated output file. """ output_file = project.get_output_file_path("results", "spdx.json") + document_spdx_id = f"SPDXRef-DOCUMENT-{project.uuid}" discoveredpackage_qs = get_queryset(project, "discoveredpackage") discovereddependency_qs = get_queryset(project, "discovereddependency") - document_spdx_id = f"SPDXRef-DOCUMENT-{project.uuid}" project_as_root_package = spdx.Package( spdx_id=f"SPDXRef-scancodeio-project-{project.uuid}", name=project.name, files_analyzed=True, ) - packages_as_spdx = [] + + packages_as_spdx = [project_as_root_package] license_expressions = [] relationships = [] @@ -747,7 +748,7 @@ def to_spdx(project, include_files=False): spdx_id=document_spdx_id, name=f"scancodeio_{project.name}", namespace=f"https://scancode.io/spdxdocs/{project.uuid}", - describe=project_as_root_package, + describes=[project_as_root_package.spdx_id], creation_info=spdx.CreationInfo(tool=f"ScanCode.io-{scancodeio_version}"), packages=packages_as_spdx, files=files_as_spdx, diff --git a/scanpipe/pipes/spdx.py b/scanpipe/pipes/spdx.py index a3e5384370..8134fb9081 100644 --- a/scanpipe/pipes/spdx.py +++ b/scanpipe/pipes/spdx.py @@ -43,7 +43,6 @@ Usage:: - import pathlib from scanpipe.pipes import spdx creation_info = spdx.CreationInfo( @@ -53,6 +52,11 @@ tool="SPDXCode-1.0", ) + root_package = spdx.Package( + spdx_id="SPDXRef-project1", + name="project1", + ) + package1 = spdx.Package( spdx_id="SPDXRef-package1", name="lxml", @@ -76,8 +80,9 @@ document = spdx.Document( name="Document name", namespace="https://[CreatorWebsite]/[pathToSpdx]/[DocumentName]-[UUID]", + describes=[root_package.spdx_id], creation_info=creation_info, - packages=[package1], + packages=[root_package, package1], extracted_licenses=[ spdx.ExtractedLicensingInfo( license_id="LicenseRef-1", @@ -93,7 +98,7 @@ print(document.as_json()) # Validate document - schema = pathlib.Path(spdx.SPDX_JSON_SCHEMA_LOCATION).read_text() + schema = spdx.SPDX_SCHEMA_PATH.read_text() document.validate(schema) # Write document to a file: @@ -542,7 +547,7 @@ class Document: name: str namespace: str - describe: Package + describes: list creation_info: CreationInfo packages: list[Package] @@ -557,18 +562,15 @@ class Document: def as_dict(self): """Return the SPDX document as a serializable dict.""" - packages = [self.describe.as_dict()] - packages.extend([package.as_dict() for package in self.packages]) - data = { "spdxVersion": f"SPDX-{self.version}", "dataLicense": self.data_license, "SPDXID": self.spdx_id, "name": self.safe_document_name(self.name), "documentNamespace": self.namespace, - "documentDescribes": [self.describe.spdx_id], + "documentDescribes": self.describes, "creationInfo": self.creation_info.as_dict(), - "packages": packages, + "packages": [package.as_dict() for package in self.packages], } if self.files: @@ -601,6 +603,7 @@ def from_data(cls, data): data_license=data.get("dataLicense"), name=data.get("name"), namespace=data.get("documentNamespace"), + describes=data.get("documentDescribes"), creation_info=CreationInfo.from_data(data.get("creationInfo", {})), packages=[ Package.from_data(package_data) From 5f985e264400691148a7398faf19717f8611c0f1 Mon Sep 17 00:00:00 2001 From: tdruez Date: Wed, 10 Sep 2025 08:59:55 +0400 Subject: [PATCH 03/11] Fix unit tests following the documentDescribes refactoring Signed-off-by: tdruez --- .../data/asgiref/asgiref-3.3.0.spdx.json | 30 +++++++++++----- .../tests/data/spdx/dependencies.spdx.json | 34 +++++++++++++++---- scanpipe/tests/pipes/test_output.py | 4 +-- scanpipe/tests/pipes/test_spdx.py | 21 ++++++++++-- 4 files changed, 69 insertions(+), 20 deletions(-) diff --git a/scanpipe/tests/data/asgiref/asgiref-3.3.0.spdx.json b/scanpipe/tests/data/asgiref/asgiref-3.3.0.spdx.json index 50171f475f..e96ee4cc4f 100644 --- a/scanpipe/tests/data/asgiref/asgiref-3.3.0.spdx.json +++ b/scanpipe/tests/data/asgiref/asgiref-3.3.0.spdx.json @@ -4,6 +4,9 @@ "SPDXID": "SPDXRef-DOCUMENT-804c3391-e6f9-415f-bb7a-cb6653853a46", "name": "scancodeio_asgiref", "documentNamespace": "https://scancode.io/spdxdocs/804c3391-e6f9-415f-bb7a-cb6653853a46", + "documentDescribes": [ + "SPDXRef-scancodeio-project-804c3391-e6f9-415f-bb7a-cb6653853a46" + ], "creationInfo": { "created": "2000-01-01T01:02:03Z", "creators": [ @@ -12,6 +15,15 @@ "licenseListVersion": "3.20" }, "packages": [ + { + "name": "asgiref", + "SPDXID": "SPDXRef-scancodeio-project-804c3391-e6f9-415f-bb7a-cb6653853a46", + "downloadLocation": "NOASSERTION", + "licenseConcluded": "NOASSERTION", + "copyrightText": "NOASSERTION", + "filesAnalyzed": true, + "licenseDeclared": "NOASSERTION" + }, { "name": "asgiref", "SPDXID": "SPDXRef-scancodeio-discoveredpackage-9d0bdc32-1117-407a-9908-08d3558dc739", @@ -115,16 +127,18 @@ ] } ], - "documentDescribes": [ - "SPDXRef-scancodeio-discoveredpackage-9d0bdc32-1117-407a-9908-08d3558dc739", - "SPDXRef-scancodeio-discoveredpackage-7969de5e-5589-4441-bffa-a60e12b43280", - "SPDXRef-scancodeio-discovereddependency-4cff8bf8-197c-4698-a43a-5c793586c780", - "SPDXRef-scancodeio-discovereddependency-4c5c1313-3850-4f81-ac27-8d496080d667", - "SPDXRef-scancodeio-discovereddependency-f983278c-22f1-43e1-ba2b-a020d659531b", - "SPDXRef-scancodeio-discovereddependency-98aeddb5-b81a-43d4-ac56-dc873a589fdf" - ], "files": [], "relationships": [ + { + "spdxElementId": "SPDXRef-scancodeio-project-804c3391-e6f9-415f-bb7a-cb6653853a46", + "relatedSpdxElement": "SPDXRef-scancodeio-discoveredpackage-9d0bdc32-1117-407a-9908-08d3558dc739", + "relationshipType": "DEPENDS_ON" + }, + { + "spdxElementId": "SPDXRef-scancodeio-project-804c3391-e6f9-415f-bb7a-cb6653853a46", + "relatedSpdxElement": "SPDXRef-scancodeio-discoveredpackage-7969de5e-5589-4441-bffa-a60e12b43280", + "relationshipType": "DEPENDS_ON" + }, { "spdxElementId": "SPDXRef-scancodeio-discovereddependency-4cff8bf8-197c-4698-a43a-5c793586c780", "relatedSpdxElement": "SPDXRef-scancodeio-discoveredpackage-9d0bdc32-1117-407a-9908-08d3558dc739", diff --git a/scanpipe/tests/data/spdx/dependencies.spdx.json b/scanpipe/tests/data/spdx/dependencies.spdx.json index b88d8248be..d401f14284 100644 --- a/scanpipe/tests/data/spdx/dependencies.spdx.json +++ b/scanpipe/tests/data/spdx/dependencies.spdx.json @@ -4,6 +4,9 @@ "SPDXID": "SPDXRef-DOCUMENT-b74fe5df-e965-415e-ba65-f38421a0695d", "name": "scancodeio_analysis", "documentNamespace": "https://scancode.io/spdxdocs/b74fe5df-e965-415e-ba65-f38421a0695d", + "documentDescribes": [ + "SPDXRef-scancodeio-project-b74fe5df-e965-415e-ba65-f38421a0695d" + ], "creationInfo": { "created": "2000-01-01T01:02:03Z", "creators": [ @@ -12,6 +15,15 @@ "licenseListVersion": "3.20" }, "packages": [ + { + "name": "Analysis", + "SPDXID": "SPDXRef-scancodeio-project-b74fe5df-e965-415e-ba65-f38421a0695d", + "downloadLocation": "NOASSERTION", + "licenseConcluded": "NOASSERTION", + "copyrightText": "NOASSERTION", + "filesAnalyzed": true, + "licenseDeclared": "NOASSERTION" + }, { "name": "a", "SPDXID": "SPDXRef-scancodeio-discoveredpackage-a83a60de-81bc-4bf4-b48c-dc78e0e658a9", @@ -83,14 +95,22 @@ ] } ], - "documentDescribes": [ - "SPDXRef-scancodeio-discoveredpackage-a83a60de-81bc-4bf4-b48c-dc78e0e658a9", - "SPDXRef-scancodeio-discoveredpackage-81147701-285f-485c-ba36-9cd3742790b1", - "SPDXRef-scancodeio-discoveredpackage-e391c33e-d7d0-4a97-a3c3-e947375c53d5", - "SPDXRef-scancodeio-discovereddependency-d0e1eab2-9b8b-449b-b9d1-12147ffdd8a8", - "SPDXRef-scancodeio-discovereddependency-29fbe562-a191-44b4-88e8-a9678071ecee" - ], "relationships": [ + { + "spdxElementId": "SPDXRef-scancodeio-project-b74fe5df-e965-415e-ba65-f38421a0695d", + "relatedSpdxElement": "SPDXRef-scancodeio-discoveredpackage-a83a60de-81bc-4bf4-b48c-dc78e0e658a9", + "relationshipType": "DEPENDS_ON" + }, + { + "spdxElementId": "SPDXRef-scancodeio-project-b74fe5df-e965-415e-ba65-f38421a0695d", + "relatedSpdxElement": "SPDXRef-scancodeio-discoveredpackage-81147701-285f-485c-ba36-9cd3742790b1", + "relationshipType": "DEPENDS_ON" + }, + { + "spdxElementId": "SPDXRef-scancodeio-project-b74fe5df-e965-415e-ba65-f38421a0695d", + "relatedSpdxElement": "SPDXRef-scancodeio-discoveredpackage-e391c33e-d7d0-4a97-a3c3-e947375c53d5", + "relationshipType": "DEPENDS_ON" + }, { "spdxElementId": "SPDXRef-scancodeio-discoveredpackage-81147701-285f-485c-ba36-9cd3742790b1", "relatedSpdxElement": "SPDXRef-scancodeio-discoveredpackage-a83a60de-81bc-4bf4-b48c-dc78e0e658a9", diff --git a/scanpipe/tests/pipes/test_output.py b/scanpipe/tests/pipes/test_output.py index b3354ab230..258dab5296 100644 --- a/scanpipe/tests/pipes/test_output.py +++ b/scanpipe/tests/pipes/test_output.py @@ -507,8 +507,8 @@ def test_scanpipe_pipes_outputs_to_spdx_dependencies(self, mock_uuid4): output_file = output.to_spdx(project=project) results_json = json.loads(output_file.read_text()) - self.assertEqual(5, len(results_json["packages"])) - self.assertEqual(3, len(results_json["relationships"])) + self.assertEqual(6, len(results_json["packages"])) + self.assertEqual(6, len(results_json["relationships"])) # Patch the `created` date and tool version results_json["creationInfo"]["created"] = "2000-01-01T01:02:03Z" diff --git a/scanpipe/tests/pipes/test_spdx.py b/scanpipe/tests/pipes/test_spdx.py index 863850341c..ab19ccb5c4 100644 --- a/scanpipe/tests/pipes/test_spdx.py +++ b/scanpipe/tests/pipes/test_spdx.py @@ -90,6 +90,10 @@ def setUp(self): "https://license1.homepage", ], } + self.project_as_root_package_data = { + "spdx_id": "SPDXRef-project", + "name": "Project", + } self.package_data = { "spdx_id": "SPDXRef-package1", "name": "lxml", @@ -170,7 +174,9 @@ def setUp(self): "name": "Document name", "namespace": "https://[CreatorWebsite]/[DocumentName]-[UUID]", "creation_info": spdx.CreationInfo(**self.creation_info_data), + "describes": [self.project_as_root_package_data["spdx_id"]], "packages": [ + spdx.Package(**self.project_as_root_package_data), spdx.Package(**self.package_data), ], "extracted_licenses": [ @@ -190,6 +196,7 @@ def setUp(self): "SPDXID": "SPDXRef-DOCUMENT", "name": "document_name", "documentNamespace": "https://[CreatorWebsite]/[DocumentName]-[UUID]", + "documentDescribes": ["SPDXRef-project"], "creationInfo": { "created": "2022-09-21T13:50:20Z", "creators": [ @@ -201,6 +208,15 @@ def setUp(self): "comment": "Generated with SPDXCode", }, "packages": [ + { + "name": "Project", + "SPDXID": "SPDXRef-project", + "downloadLocation": "NOASSERTION", + "licenseConcluded": "NOASSERTION", + "copyrightText": "NOASSERTION", + "filesAnalyzed": False, + "licenseDeclared": "NOASSERTION", + }, { "name": "lxml", "SPDXID": "SPDXRef-package1", @@ -228,7 +244,7 @@ def setUp(self): "referenceLocator": "pkg:pypi/lxml@3.3.5", } ], - } + }, ], "files": [ { @@ -247,7 +263,6 @@ def setUp(self): "licenseComments": "license_comments", } ], - "documentDescribes": ["SPDXRef-package1"], "hasExtractedLicensingInfos": [ { "licenseId": "LicenseRef-1", @@ -353,7 +368,7 @@ def test_spdx_relationship_from_data(self): def test_spdx_document_as_dict(self): document = spdx.Document(**self.document_data) - assert self.document_spdx_data == document.as_dict() + assert self.document_spdx_data == document.as_dict(), document.as_dict() def test_spdx_relationship_is_dependency_relationship_property(self): relationship = spdx.Relationship.from_data(self.relationship_spdx_data) From 44217a5c80eeacd44f6fdb5ce9b27da3d3b0b5a3 Mon Sep 17 00:00:00 2001 From: tdruez Date: Wed, 10 Sep 2025 09:33:06 +0400 Subject: [PATCH 04/11] Handle licenses with empty license test in SPDX library Signed-off-by: tdruez --- scanpipe/pipes/spdx.py | 7 ++++++- scanpipe/tests/pipes/test_spdx.py | 9 +++++++++ 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/scanpipe/pipes/spdx.py b/scanpipe/pipes/spdx.py index 8134fb9081..9e509f83f4 100644 --- a/scanpipe/pipes/spdx.py +++ b/scanpipe/pipes/spdx.py @@ -280,9 +280,14 @@ class ExtractedLicensingInfo: def as_dict(self): """Return the data as a serializable dict.""" + if self.extracted_text.strip(): + extracted_text = self.extracted_text + else: + extracted_text = "NOASSERTION" + required_data = { "licenseId": self.license_id, - "extractedText": self.extracted_text, + "extractedText": extracted_text, } optional_data = { diff --git a/scanpipe/tests/pipes/test_spdx.py b/scanpipe/tests/pipes/test_spdx.py index ab19ccb5c4..e6ea183073 100644 --- a/scanpipe/tests/pipes/test_spdx.py +++ b/scanpipe/tests/pipes/test_spdx.py @@ -318,6 +318,15 @@ def test_spdx_extracted_licensing_info_as_dict(self): licensing_info = spdx.ExtractedLicensingInfo(**self.licensing_info_data) assert self.licensing_info_spdx_data == licensing_info.as_dict() + def test_spdx_extracted_licensing_info_empty_extracted_text(self): + licensing_info = spdx.ExtractedLicensingInfo( + **{ + "license_id": "LicenseRef-1", + "extracted_text": " ", + } + ) + assert "NOASSERTION" == licensing_info.as_dict()["extractedText"] + def test_spdx_extracted_licensing_info_from_data(self): assert spdx.ExtractedLicensingInfo.from_data({}) licensing_info = spdx.ExtractedLicensingInfo.from_data( From 1179b18d34c94819bc428bdec2d40620ab2c37b3 Mon Sep 17 00:00:00 2001 From: tdruez Date: Wed, 10 Sep 2025 09:47:59 +0400 Subject: [PATCH 05/11] Add comments and explanation about the documentDescribes changes Signed-off-by: tdruez --- scanpipe/pipes/output.py | 11 ++++++++++- scanpipe/pipes/spdx.py | 9 +++++++++ 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/scanpipe/pipes/output.py b/scanpipe/pipes/output.py index 8ab002fbe2..9b5f95a23b 100644 --- a/scanpipe/pipes/output.py +++ b/scanpipe/pipes/output.py @@ -744,11 +744,20 @@ def to_spdx(project, include_files=False): for resource in get_queryset(project, "codebaseresource").files() ] + # Use the Project (top-level package) as the root element that the SPDX document + # describes. + # This ensures "documentDescribes" points only to the main subject of the SBOM, + # not to every dependency or file in the project. + # See https://github.com/spdx/spdx-spec/issues/395 and + # https://github.com/aboutcode-org/scancode.io/issues/564#issuecomment-3269296563 + # for detailed context. + describes = [project_as_root_package.spdx_id] + document = spdx.Document( spdx_id=document_spdx_id, name=f"scancodeio_{project.name}", namespace=f"https://scancode.io/spdxdocs/{project.uuid}", - describes=[project_as_root_package.spdx_id], + describes=describes, creation_info=spdx.CreationInfo(tool=f"ScanCode.io-{scancodeio_version}"), packages=packages_as_spdx, files=files_as_spdx, diff --git a/scanpipe/pipes/spdx.py b/scanpipe/pipes/spdx.py index 9e509f83f4..4040825773 100644 --- a/scanpipe/pipes/spdx.py +++ b/scanpipe/pipes/spdx.py @@ -552,6 +552,15 @@ class Document: name: str namespace: str + # "documentDescribes" identifies the root element(s) that this SPDX document + # describes. + # In most SBOM cases, this will be a single SPDX ID representing the top-level + # package or project (e.g., the root manifest in a repository or the main + # distribution artifact). + # Although defined as an array, it should NOT list every package, file, or snippet. + # Multiple entries are only expected in special, non-SBOM cases + # (e.g., SPDX license lists). + # See https://github.com/spdx/spdx-spec/issues/395 for discussion and clarification. describes: list creation_info: CreationInfo packages: list[Package] From 80c090fb76c214174887d3a23c4b0d8b583da291 Mon Sep 17 00:00:00 2001 From: tdruez Date: Thu, 11 Sep 2025 11:42:13 +0400 Subject: [PATCH 06/11] Use Project inputs as root elements that the SPDX document describes Signed-off-by: tdruez --- scanpipe/models.py | 7 +- scanpipe/pipes/output.py | 61 +++++++++++----- scanpipe/pipes/spdx.py | 1 + scanpipe/tests/pipes/test_output.py | 103 +++++++++++++++++++++++++++- 4 files changed, 154 insertions(+), 18 deletions(-) diff --git a/scanpipe/models.py b/scanpipe/models.py index 178a9409ab..26d74303cb 100644 --- a/scanpipe/models.py +++ b/scanpipe/models.py @@ -1248,7 +1248,12 @@ def add_upload(self, uploaded_file, tag=""): adds the `input_source`. """ self.write_input_file(uploaded_file) - self.add_input_source(filename=uploaded_file.name, is_uploaded=True, tag=tag) + input_source = self.add_input_source( + filename=uploaded_file.name, + is_uploaded=True, + tag=tag, + ) + return input_source def add_uploads(self, uploads): """ diff --git a/scanpipe/pipes/output.py b/scanpipe/pipes/output.py index 9b5f95a23b..94504b596b 100644 --- a/scanpipe/pipes/output.py +++ b/scanpipe/pipes/output.py @@ -25,6 +25,7 @@ import io import json import re +import uuid from operator import attrgetter from pathlib import Path @@ -693,6 +694,25 @@ def get_dependency_as_spdx_relationship(dependency, document_spdx_id, packages_a return spdx_relationship +def get_inputs_as_spdx_packages(project): + """Return the Project's inputs as SPDX package to be used as root elements.""" + inputs_as_spdx_packages = [] + + for input_source in project.get_inputs_with_source(): + input_uuid = input_source.get("uuid") or uuid.uuid4() + + input_as_spdx_package = spdx.Package( + spdx_id=f"SPDXRef-scancodeio-input-{input_uuid}", + name=input_source.get("filename"), + filename=input_source.get("filename"), + download_location=input_source.get("download_url"), + files_analyzed=True, + ) + inputs_as_spdx_packages.append(input_as_spdx_package) + + return inputs_as_spdx_packages + + def to_spdx(project, include_files=False): """ Generate output for the provided ``project`` in SPDX document format. @@ -705,13 +725,31 @@ def to_spdx(project, include_files=False): discoveredpackage_qs = get_queryset(project, "discoveredpackage") discovereddependency_qs = get_queryset(project, "discovereddependency") - project_as_root_package = spdx.Package( - spdx_id=f"SPDXRef-scancodeio-project-{project.uuid}", - name=project.name, - files_analyzed=True, - ) + project_inputs_as_spdx_packages = get_inputs_as_spdx_packages(project) + + # Use the Project's input(s) as the root element(s) that the SPDX document + # describes. + # This ensures "documentDescribes" points only to the main subject of the SBOM, + # not to every dependency or file in the project. + # See https://github.com/spdx/spdx-spec/issues/395 and + # https://github.com/aboutcode-org/scancode.io/issues/564#issuecomment-3269296563 + # for detailed context. + describes = [ + input_as_spdx_package.spdx_id + for input_as_spdx_package in project_inputs_as_spdx_packages + ] + packages_as_spdx = project_inputs_as_spdx_packages + + # Fallback to the Project as the SPDX root element for the "documentDescribes" + if not project_inputs_as_spdx_packages: + project_as_root_package = spdx.Package( + spdx_id=f"SPDXRef-scancodeio-project-{project.uuid}", + name=project.name, + files_analyzed=True, + ) + packages_as_spdx = [project_as_root_package] + describes = [project_as_root_package.spdx_id] - packages_as_spdx = [project_as_root_package] license_expressions = [] relationships = [] @@ -723,7 +761,7 @@ def to_spdx(project, include_files=False): license_expressions.append(license_expression) spdx_relationship = spdx.Relationship( - spdx_id=project_as_root_package.spdx_id, + spdx_id=describes[0], related_spdx_id=spdx_package.spdx_id, relationship="DEPENDS_ON", ) @@ -744,15 +782,6 @@ def to_spdx(project, include_files=False): for resource in get_queryset(project, "codebaseresource").files() ] - # Use the Project (top-level package) as the root element that the SPDX document - # describes. - # This ensures "documentDescribes" points only to the main subject of the SBOM, - # not to every dependency or file in the project. - # See https://github.com/spdx/spdx-spec/issues/395 and - # https://github.com/aboutcode-org/scancode.io/issues/564#issuecomment-3269296563 - # for detailed context. - describes = [project_as_root_package.spdx_id] - document = spdx.Document( spdx_id=document_spdx_id, name=f"scancodeio_{project.name}", diff --git a/scanpipe/pipes/spdx.py b/scanpipe/pipes/spdx.py index 4040825773..02df41ba26 100644 --- a/scanpipe/pipes/spdx.py +++ b/scanpipe/pipes/spdx.py @@ -362,6 +362,7 @@ def as_dict(self): optional_data = { "versionInfo": self.version, + "packageFileName": self.filename, "licenseDeclared": self.license_declared, "supplier": self.supplier, "originator": self.originator, diff --git a/scanpipe/tests/pipes/test_output.py b/scanpipe/tests/pipes/test_output.py index 258dab5296..d1b6c88868 100644 --- a/scanpipe/tests/pipes/test_output.py +++ b/scanpipe/tests/pipes/test_output.py @@ -31,6 +31,7 @@ from unittest import mock from django.conf import settings +from django.core.files.uploadedfile import SimpleUploadedFile from django.core.management import call_command from django.test import TestCase @@ -417,7 +418,7 @@ def test_scanpipe_pipes_outputs_to_spdx(self): call_command("loaddata", fixtures, **{"verbosity": 0}) project = Project.objects.get(name="asgiref") - with self.assertNumQueries(8): + with self.assertNumQueries(9): output_file = output.to_spdx(project=project, include_files=True) self.assertIn(output_file.name, project.output_root) @@ -520,6 +521,106 @@ def test_scanpipe_pipes_outputs_to_spdx_dependencies(self, mock_uuid4): expected_file = self.data / "spdx" / "dependencies.spdx.json" self.assertResultsEqual(expected_file, results) + @mock.patch("uuid.uuid4") + def test_scanpipe_pipes_outputs_to_spdx_get_inputs_as_spdx_packages( + self, mock_uuid4 + ): + forced_uuid = "b74fe5df-e965-415e-ba65-f38421a0695d" + mock_uuid4.return_value = forced_uuid + + # 1. Input manually copied to Project's inputs + project = make_project(name="Copied") + copied_input = project.input_path / "input_filename" + copied_input.touch() + inputs_as_spdx_packages = output.get_inputs_as_spdx_packages(project) + expected = [ + { + "name": "input_filename", + "SPDXID": f"SPDXRef-scancodeio-input-{forced_uuid}", + "packageFileName": "input_filename", + "licenseConcluded": "NOASSERTION", + "copyrightText": "NOASSERTION", + "downloadLocation": "NOASSERTION", + "filesAnalyzed": True, + "licenseDeclared": "NOASSERTION", + } + ] + inputs_spdx_as_dict = [package.as_dict() for package in inputs_as_spdx_packages] + self.assertEqual(expected, inputs_spdx_as_dict) + + # 2. Input uploaded to Project's inputs + project = make_project(name="Uploaded") + uploaded_file = SimpleUploadedFile("filename.ext", content=b"content") + input_source = project.add_upload( + uploaded_file=uploaded_file, + ) + inputs_as_spdx_packages = output.get_inputs_as_spdx_packages(project) + expected = [ + { + "name": "filename.ext", + "SPDXID": f"SPDXRef-scancodeio-input-{input_source.uuid}", + "packageFileName": "filename.ext", + "licenseConcluded": "NOASSERTION", + "copyrightText": "NOASSERTION", + "downloadLocation": "NOASSERTION", + "filesAnalyzed": True, + "licenseDeclared": "NOASSERTION", + } + ] + inputs_spdx_as_dict = [package.as_dict() for package in inputs_as_spdx_packages] + self.assertEqual(expected, inputs_spdx_as_dict) + + # 3. Fetched (download_url, purl, docker, git, ...) + project = make_project(name="Fetched") + input_from_download_url = project.add_input_source( + download_url="https://download.url/archive.zip", + filename="archive.zip", + ) + input_from_purl = project.add_input_source( + download_url="pkg:npm/dnd-core@7.0.2", + filename="dnd-core-7.0.2.tgz", + ) + input_from_docker = project.add_input_source( + download_url="docker://registry.com/debian:10.9", + filename="debian_10.9.tar", + ) + inputs_as_spdx_packages = output.get_inputs_as_spdx_packages(project) + inputs_spdx_as_dict = [package.as_dict() for package in inputs_as_spdx_packages] + self.maxDiff = None + expected = [ + { + "name": "archive.zip", + "SPDXID": f"SPDXRef-scancodeio-input-{input_from_download_url.uuid}", + "downloadLocation": "https://download.url/archive.zip", + "licenseConcluded": "NOASSERTION", + "copyrightText": "NOASSERTION", + "filesAnalyzed": True, + "packageFileName": "archive.zip", + "licenseDeclared": "NOASSERTION", + }, + { + "name": "debian_10.9.tar", + "SPDXID": f"SPDXRef-scancodeio-input-{input_from_docker.uuid}", + "downloadLocation": "docker://registry.com/debian:10.9", + "licenseConcluded": "NOASSERTION", + "copyrightText": "NOASSERTION", + "filesAnalyzed": True, + "packageFileName": "debian_10.9.tar", + "licenseDeclared": "NOASSERTION", + }, + { + "name": "dnd-core-7.0.2.tgz", + "SPDXID": f"SPDXRef-scancodeio-input-{input_from_purl.uuid}", + "downloadLocation": "pkg:npm/dnd-core@7.0.2", + "licenseConcluded": "NOASSERTION", + "copyrightText": "NOASSERTION", + "filesAnalyzed": True, + "packageFileName": "dnd-core-7.0.2.tgz", + "licenseDeclared": "NOASSERTION", + }, + ] + self.assertEqual(expected, inputs_spdx_as_dict) + def test_scanpipe_pipes_outputs_make_unknown_license_object(self): licensing = get_licensing() parsed_expression = licensing.parse("some-unknown-license") From 9746835be4487b3705c6586f157a648e4027c494 Mon Sep 17 00:00:00 2001 From: tdruez Date: Thu, 11 Sep 2025 16:17:24 +0400 Subject: [PATCH 07/11] Fallback to the Project as the SPDX root element when needed Signed-off-by: tdruez --- scanpipe/pipes/output.py | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-) diff --git a/scanpipe/pipes/output.py b/scanpipe/pipes/output.py index 94504b596b..6a3f6cbd6c 100644 --- a/scanpipe/pipes/output.py +++ b/scanpipe/pipes/output.py @@ -725,6 +725,10 @@ def to_spdx(project, include_files=False): discoveredpackage_qs = get_queryset(project, "discoveredpackage") discovereddependency_qs = get_queryset(project, "discovereddependency") + packages_as_spdx = [] + license_expressions = [] + relationships = [] + project_inputs_as_spdx_packages = get_inputs_as_spdx_packages(project) # Use the Project's input(s) as the root element(s) that the SPDX document @@ -734,25 +738,24 @@ def to_spdx(project, include_files=False): # See https://github.com/spdx/spdx-spec/issues/395 and # https://github.com/aboutcode-org/scancode.io/issues/564#issuecomment-3269296563 # for detailed context. - describes = [ - input_as_spdx_package.spdx_id - for input_as_spdx_package in project_inputs_as_spdx_packages - ] - packages_as_spdx = project_inputs_as_spdx_packages + if project_inputs_as_spdx_packages: + packages_as_spdx.extend(project_inputs_as_spdx_packages) + describes = [ + input_as_spdx_package.spdx_id + for input_as_spdx_package in project_inputs_as_spdx_packages + ] - # Fallback to the Project as the SPDX root element for the "documentDescribes" - if not project_inputs_as_spdx_packages: + # Fallback to the Project as the SPDX root element for the "documentDescribes", + # if not inputs are available. + else: project_as_root_package = spdx.Package( spdx_id=f"SPDXRef-scancodeio-project-{project.uuid}", name=project.name, files_analyzed=True, ) - packages_as_spdx = [project_as_root_package] + packages_as_spdx.append(project_as_root_package) describes = [project_as_root_package.spdx_id] - license_expressions = [] - relationships = [] - for package in discoveredpackage_qs: spdx_package = package.as_spdx() packages_as_spdx.append(spdx_package) From 3752d1ef446d8c8de7a35bf62262cf6a1f710d4a Mon Sep 17 00:00:00 2001 From: tdruez Date: Thu, 11 Sep 2025 21:22:20 +0400 Subject: [PATCH 08/11] Add full support for SPDX 2.2 spec version Signed-off-by: tdruez --- scanpipe/api/views.py | 7 +- scanpipe/management/commands/output.py | 2 +- scanpipe/pipes/output.py | 6 +- scanpipe/pipes/schemas/spdx-schema-2.2.json | 721 ++++++++++++++++++ .../pipes/schemas/spdx-schema-2.2.json.ABOUT | 15 + scanpipe/pipes/spdx.py | 54 +- .../dropdowns/project_download_dropdown.html | 10 +- .../scanpipe/includes/project_downloads.html | 23 +- .../data/asgiref/asgiref-3.3.0.spdx.json | 16 +- .../tests/data/spdx/dependencies.spdx.json | 13 +- scanpipe/tests/pipes/test_spdx.py | 10 +- scanpipe/tests/test_pipelines.py | 5 +- scanpipe/views.py | 7 +- 13 files changed, 839 insertions(+), 50 deletions(-) create mode 100644 scanpipe/pipes/schemas/spdx-schema-2.2.json create mode 100644 scanpipe/pipes/schemas/spdx-schema-2.2.json.ABOUT diff --git a/scanpipe/api/views.py b/scanpipe/api/views.py index d5d91189cb..c20a40d483 100644 --- a/scanpipe/api/views.py +++ b/scanpipe/api/views.py @@ -153,18 +153,19 @@ def results_download(self, request, *args, **kwargs): """Return the results in the provided `output_format` as an attachment.""" project = self.get_object() format = request.query_params.get("output_format", "json") + version = request.query_params.get("version") output_kwargs = {} + if version: + output_kwargs["version"] = version if format == "json": return project_results_json_response(project, as_attachment=True) elif format == "xlsx": output_file = output.to_xlsx(project) elif format == "spdx": - output_file = output.to_spdx(project) + output_file = output.to_spdx(project, **output_kwargs) elif format == "cyclonedx": - if version: - output_kwargs["version"] = version output_file = output.to_cyclonedx(project, **output_kwargs) elif format == "attribution": output_file = output.to_attribution(project) diff --git a/scanpipe/management/commands/output.py b/scanpipe/management/commands/output.py index 5e6f3e74cc..951712a3a8 100644 --- a/scanpipe/management/commands/output.py +++ b/scanpipe/management/commands/output.py @@ -71,7 +71,7 @@ def handle_output(self, output_format): output_kwargs = {} if ":" in output_format: output_format, version = output_format.split(":", maxsplit=1) - if output_format != "cyclonedx": + if output_format not in ["cyclonedx", "spdx"]: raise CommandError( 'The ":" version syntax is only supported for the cyclonedx format.' ) diff --git a/scanpipe/pipes/output.py b/scanpipe/pipes/output.py index 6a3f6cbd6c..8df3b38677 100644 --- a/scanpipe/pipes/output.py +++ b/scanpipe/pipes/output.py @@ -713,12 +713,15 @@ def get_inputs_as_spdx_packages(project): return inputs_as_spdx_packages -def to_spdx(project, include_files=False): +def to_spdx(project, version=spdx.SPDX_SPEC_VERSION_2_3, include_files=False): """ Generate output for the provided ``project`` in SPDX document format. The output file is created in the ``project`` "output/" directory. Return the path of the generated output file. """ + if version not in [spdx.SPDX_SPEC_VERSION_2_2, spdx.SPDX_SPEC_VERSION_2_3]: + raise ValueError(f"SPDX {version} is not supported.") + output_file = project.get_output_file_path("results", "spdx.json") document_spdx_id = f"SPDXRef-DOCUMENT-{project.uuid}" @@ -786,6 +789,7 @@ def to_spdx(project, include_files=False): ] document = spdx.Document( + version=version, spdx_id=document_spdx_id, name=f"scancodeio_{project.name}", namespace=f"https://scancode.io/spdxdocs/{project.uuid}", diff --git a/scanpipe/pipes/schemas/spdx-schema-2.2.json b/scanpipe/pipes/schemas/spdx-schema-2.2.json new file mode 100644 index 0000000000..9abf467472 --- /dev/null +++ b/scanpipe/pipes/schemas/spdx-schema-2.2.json @@ -0,0 +1,721 @@ +{ + "$schema" : "http://json-schema.org/draft-07/schema#", + "$id" : "http://spdx.org/rdf/terms", + "title" : "SPDX 2.2", + "type" : "object", + "properties" : { + "SPDXID" : { + "type" : "string", + "description" : "Uniquely identify any element in an SPDX document which may be referenced by other elements." + }, + "revieweds" : { + "description" : "Reviewed", + "type" : "array", + "items" : { + "type" : "object", + "properties" : { + "reviewer" : { + "description" : "The name and, optionally, contact information of the person who performed the review. Values of this property must conform to the agent and tool syntax.", + "type" : "string" + }, + "comment" : { + "type" : "string" + }, + "reviewDate" : { + "description" : "The date and time at which the SpdxDocument was reviewed. This value must be in UTC and have 'Z' as its timezone indicator.", + "type" : "string" + } + }, + "required" : [ "reviewDate" ], + "additionalProperties" : false + } + }, + "hasExtractedLicensingInfos" : { + "description" : "Indicates that a particular ExtractedLicensingInfo was defined in the subject SpdxDocument.", + "type" : "array", + "items" : { + "type" : "object", + "properties" : { + "seeAlsos" : { + "type" : "array", + "items" : { + "type" : "string" + } + }, + "name" : { + "description" : "Identify name of this SpdxElement.", + "type" : "string" + }, + "comment" : { + "type" : "string" + }, + "crossRefs" : { + "description" : "Cross Reference Detail for a license SeeAlso URL", + "type" : "array", + "items" : { + "type" : "object", + "properties" : { + "isWayBackLink" : { + "description" : "True if the License SeeAlso URL points to a Wayback archive", + "type" : "boolean" + }, + "match" : { + "description" : "Status of a License List SeeAlso URL reference if it refers to a website that matches the license text.", + "type" : "string" + }, + "timestamp" : { + "description" : "Timestamp", + "type" : "string" + }, + "order" : { + "description" : "The ordinal order of this element within a list", + "type" : "integer" + }, + "url" : { + "description" : "URL Reference", + "type" : "string" + }, + "isLive" : { + "description" : "Indicate a URL is still a live accessible location on the public internet", + "type" : "boolean" + }, + "isValid" : { + "description" : "True if the URL is a valid well formed URL", + "type" : "boolean" + } + }, + "required" : [ "url" ], + "additionalProperties" : false, + "description" : "Cross reference details for the a URL reference" + } + }, + "licenseId" : { + "description" : "A human readable short form license identifier for a license. The license ID is iether on the standard license oist or the form \"LicenseRef-\"[idString] where [idString] is a unique string containing letters, numbers, \".\", \"-\" or \"+\".", + "type" : "string" + }, + "extractedText" : { + "description" : "Verbatim license or licensing notice text that was discovered.", + "type" : "string" + } + }, + "required" : [ "licenseId", "extractedText" ], + "additionalProperties" : false, + "description" : "An ExtractedLicensingInfo represents a license or licensing notice that was found in the package. Any license text that is recognized as a license may be represented as a License rather than an ExtractedLicensingInfo." + } + }, + "name" : { + "description" : "Identify name of this SpdxElement.", + "type" : "string" + }, + "comment" : { + "type" : "string" + }, + "spdxVersion" : { + "description" : "Provide a reference number that can be used to understand how to parse and interpret the rest of the file. It will enable both future changes to the specification and to support backward compatibility. The version number consists of a major and minor version indicator. The major field will be incremented when incompatible changes between versions are made (one or more sections are created, modified or deleted). The minor field will be incremented when backwards compatible changes are made.", + "type" : "string" + }, + "annotations" : { + "description" : "Provide additional information about an SpdxElement.", + "type" : "array", + "items" : { + "type" : "object", + "properties" : { + "annotationDate" : { + "description" : "Identify when the comment was made. This is to be specified according to the combined date and time in the UTC format, as specified in the ISO 8601 standard.", + "type" : "string" + }, + "comment" : { + "type" : "string" + }, + "annotator" : { + "description" : "This field identifies the person, organization or tool that has commented on a file, package, or the entire document.", + "type" : "string" + }, + "annotationType" : { + "description" : "Type of the annotation.", + "type" : "string", + "enum" : [ "OTHER", "REVIEW" ] + } + }, + "required" : [ "annotationDate", "comment", "annotator", "annotationType" ], + "additionalProperties" : false, + "description" : "An Annotation is a comment on an SpdxItem by an agent." + } + }, + "dataLicense" : { + "description" : "License expression for dataLicense. Compliance with the SPDX specification includes populating the SPDX fields therein with data related to such fields (\"SPDX-Metadata\"). The SPDX specification contains numerous fields where an SPDX document creator may provide relevant explanatory text in SPDX-Metadata. Without opining on the lawfulness of \"database rights\" (in jurisdictions where applicable), such explanatory text is copyrightable subject matter in most Berne Convention countries. By using the SPDX specification, or any portion hereof, you hereby agree that any copyright rights (as determined by your jurisdiction) in any SPDX-Metadata, including without limitation explanatory text, shall be subject to the terms of the Creative Commons CC0 1.0 Universal license. For SPDX-Metadata not containing any copyright rights, you hereby agree and acknowledge that the SPDX-Metadata is provided to you \"as-is\" and without any representations or warranties of any kind concerning the SPDX-Metadata, express, implied, statutory or otherwise, including without limitation warranties of title, merchantability, fitness for a particular purpose, non-infringement, or the absence of latent or other defects, accuracy, or the presence or absence of errors, whether or not discoverable, all to the greatest extent permissible under applicable law.", + "type" : "string" + }, + "externalDocumentRefs" : { + "description" : "Identify any external SPDX documents referenced within this SPDX document.", + "type" : "array", + "items" : { + "type" : "object", + "properties" : { + "externalDocumentId" : { + "description" : "externalDocumentId is a string containing letters, numbers, ., - and/or + which uniquely identifies an external document within this document.", + "type" : "string" + }, + "checksum" : { + "type" : "object", + "properties" : { + "algorithm" : { + "description" : "Identifies the algorithm used to produce the subject Checksum. Currently, SHA-1 is the only supported algorithm. It is anticipated that other algorithms will be supported at a later time.", + "type" : "string", + "enum" : [ "SHA256", "SHA1", "SHA384", "MD2", "MD4", "SHA512", "MD6", "MD5", "SHA224" ] + }, + "checksumValue" : { + "description" : "The checksumValue property provides a lower case hexidecimal encoded digest value produced using a specific algorithm.", + "type" : "string" + } + }, + "required" : [ "algorithm", "checksumValue" ], + "additionalProperties" : false, + "description" : "A Checksum is value that allows the contents of a file to be authenticated. Even small changes to the content of the file will change its checksum. This class allows the results of a variety of checksum and cryptographic message digest algorithms to be represented." + }, + "spdxDocument" : { + "description" : "SPDX ID for SpdxDocument. A propoerty containing an SPDX document.", + "type" : "string" + } + }, + "required" : [ "externalDocumentId", "checksum", "spdxDocument" ], + "additionalProperties" : false, + "description" : "Information about an external SPDX document reference including the checksum. This allows for verification of the external references." + } + }, + "creationInfo" : { + "type" : "object", + "properties" : { + "comment" : { + "type" : "string" + }, + "created" : { + "description" : "Identify when the SPDX file was originally created. The date is to be specified according to combined date and time in UTC format as specified in ISO 8601 standard. This field is distinct from the fields in section 8, which involves the addition of information during a subsequent review.", + "type" : "string" + }, + "creators" : { + "description" : "Identify who (or what, in the case of a tool) created the SPDX file. If the SPDX file was created by an individual, indicate the person's name. If the SPDX file was created on behalf of a company or organization, indicate the entity name. If the SPDX file was created using a software tool, indicate the name and version for that tool. If multiple participants or tools were involved, use multiple instances of this field. Person name or organization name may be designated as “anonymous” if appropriate.", + "minItems" : 1, + "type" : "array", + "items" : { + "description" : "Identify who (or what, in the case of a tool) created the SPDX file. If the SPDX file was created by an individual, indicate the person's name. If the SPDX file was created on behalf of a company or organization, indicate the entity name. If the SPDX file was created using a software tool, indicate the name and version for that tool. If multiple participants or tools were involved, use multiple instances of this field. Person name or organization name may be designated as “anonymous” if appropriate.", + "type" : "string" + } + }, + "licenseListVersion" : { + "description" : "An optional field for creators of the SPDX file to provide the version of the SPDX License List used when the SPDX file was created.", + "type" : "string" + } + }, + "required" : [ "created" ], + "additionalProperties" : false, + "description" : "One instance is required for each SPDX file produced. It provides the necessary information for forward and backward compatibility for processing tools." + }, + "documentNamespace" : { + "type" : "string", + "description" : "The URI provides an unambiguous mechanism for other SPDX documents to reference SPDX elements within this SPDX document." + }, + "documentDescribes" : { + "description" : "Packages, files and/or Snippets described by this SPDX document", + "type" : "array", + "items" : { + "type" : "string" + } + }, + "packages" : { + "description" : "Packages referenced in the SPDX document", + "type" : "array", + "items" : { + "type" : "object", + "properties" : { + "SPDXID" : { + "type" : "string", + "description" : "Uniquely identify any element in an SPDX document which may be referenced by other elements." + }, + "attributionTexts" : { + "description" : "This field provides a place for the SPDX data creator to record acknowledgements that may be required to be communicated in some contexts. This is not meant to include theactual complete license text (see licenseConculded and licenseDeclared), and may or may not include copyright notices (see also copyrightText). The SPDX data creator may use this field to record other acknowledgements, such as particular clauses from license texts, which may be necessary or desirable to reproduce.", + "type" : "array", + "items" : { + "description" : "This field provides a place for the SPDX data creator to record acknowledgements that may be required to be communicated in some contexts. This is not meant to include theactual complete license text (see licenseConculded and licenseDeclared), and may or may not include copyright notices (see also copyrightText). The SPDX data creator may use this field to record other acknowledgements, such as particular clauses from license texts, which may be necessary or desirable to reproduce.", + "type" : "string" + } + }, + "annotations" : { + "description" : "Provide additional information about an SpdxElement.", + "type" : "array", + "items" : { + "type" : "object", + "properties" : { + "annotationDate" : { + "description" : "Identify when the comment was made. This is to be specified according to the combined date and time in the UTC format, as specified in the ISO 8601 standard.", + "type" : "string" + }, + "comment" : { + "type" : "string" + }, + "annotator" : { + "description" : "This field identifies the person, organization or tool that has commented on a file, package, or the entire document.", + "type" : "string" + }, + "annotationType" : { + "description" : "Type of the annotation.", + "type" : "string", + "enum" : [ "OTHER", "REVIEW" ] + } + }, + "required" : [ "annotationDate", "comment", "annotator", "annotationType" ], + "additionalProperties" : false, + "description" : "An Annotation is a comment on an SpdxItem by an agent." + } + }, + "supplier" : { + "description" : "The name and, optionally, contact information of the person or organization who was the immediate supplier of this package to the recipient. The supplier may be different than originator when the software has been repackaged. Values of this property must conform to the agent and tool syntax.", + "type" : "string" + }, + "homepage" : { + "type" : "string" + }, + "licenseDeclared" : { + "description" : "License expression for licenseDeclared. The licensing that the creators of the software in the package, or the packager, have declared. Declarations by the original software creator should be preferred, if they exist.", + "type" : "string" + }, + "packageVerificationCode" : { + "type" : "object", + "properties" : { + "packageVerificationCodeValue" : { + "description" : "The actual package verification code as a hex encoded value.", + "type" : "string" + }, + "packageVerificationCodeExcludedFiles" : { + "description" : "A file that was excluded when calculating the package verification code. This is usually a file containing SPDX data regarding the package. If a package contains more than one SPDX file all SPDX files must be excluded from the package verification code. If this is not done it would be impossible to correctly calculate the verification codes in both files.", + "type" : "array", + "items" : { + "description" : "A file that was excluded when calculating the package verification code. This is usually a file containing SPDX data regarding the package. If a package contains more than one SPDX file all SPDX files must be excluded from the package verification code. If this is not done it would be impossible to correctly calculate the verification codes in both files.", + "type" : "string" + } + } + }, + "required" : [ "packageVerificationCodeValue" ], + "additionalProperties" : false, + "description" : "A manifest based verification code (the algorithm is defined in section 4.7 of the full specification) of the SPDX Item. This allows consumers of this data and/or database to determine if an SPDX item they have in hand is identical to the SPDX item from which the data was produced. This algorithm works even if the SPDX document is included in the SPDX item." + }, + "checksums" : { + "description" : "The checksum property provides a mechanism that can be used to verify that the contents of a File or Package have not changed.", + "type" : "array", + "items" : { + "type" : "object", + "properties" : { + "algorithm" : { + "description" : "Identifies the algorithm used to produce the subject Checksum. Currently, SHA-1 is the only supported algorithm. It is anticipated that other algorithms will be supported at a later time.", + "type" : "string", + "enum" : [ "SHA256", "SHA1", "SHA384", "MD2", "MD4", "SHA512", "MD6", "MD5", "SHA224" ] + }, + "checksumValue" : { + "description" : "The checksumValue property provides a lower case hexidecimal encoded digest value produced using a specific algorithm.", + "type" : "string" + } + }, + "required" : [ "algorithm", "checksumValue" ], + "additionalProperties" : false, + "description" : "A Checksum is value that allows the contents of a file to be authenticated. Even small changes to the content of the file will change its checksum. This class allows the results of a variety of checksum and cryptographic message digest algorithms to be represented." + } + }, + "downloadLocation" : { + "description" : "The URI at which this package is available for download. Private (i.e., not publicly reachable) URIs are acceptable as values of this property. The values http://spdx.org/rdf/terms#none and http://spdx.org/rdf/terms#noassertion may be used to specify that the package is not downloadable or that no attempt was made to determine its download location, respectively.", + "type" : "string" + }, + "filesAnalyzed" : { + "description" : "Indicates whether the file content of this package has been available for or subjected to analysis when creating the SPDX document. If false indicates packages that represent metadata or URI references to a project, product, artifact, distribution or a component. If set to false, the package must not contain any files.", + "type" : "boolean" + }, + "externalRefs" : { + "description" : "An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package.", + "type" : "array", + "items" : { + "type" : "object", + "properties" : { + "comment" : { + "type" : "string" + }, + "referenceCategory" : { + "description" : "Category for the external reference", + "type" : "string", + "enum" : [ "OTHER", "SECURITY", "PACKAGE_MANAGER" ] + }, + "referenceLocator" : { + "description" : "The unique string with no spaces necessary to access the package-specific information, metadata, or content within the target location. The format of the locator is subject to constraints defined by the .", + "type" : "string" + }, + "referenceType" : { + "description" : "Type of the external reference. These are definined in an appendix in the SPDX specification.", + "type" : "string" + } + }, + "required" : [ "referenceCategory", "referenceLocator", "referenceType" ], + "additionalProperties" : false, + "description" : "An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package." + } + }, + "licenseComments" : { + "description" : "The licenseComments property allows the preparer of the SPDX document to describe why the licensing in spdx:licenseConcluded was chosen.", + "type" : "string" + }, + "name" : { + "description" : "Identify name of this SpdxElement.", + "type" : "string" + }, + "hasFiles" : { + "description" : "Indicates that a particular file belongs to a package.", + "type" : "array", + "items" : { + "description" : "SPDX ID for File. Indicates that a particular file belongs to a package.", + "type" : "string" + } + }, + "comment" : { + "type" : "string" + }, + "copyrightText" : { + "description" : "The text of copyright declarations recited in the Package or File.", + "type" : "string" + }, + "summary" : { + "description" : "Provides a short description of the package.", + "type" : "string" + }, + "originator" : { + "description" : "The name and, optionally, contact information of the person or organization that originally created the package. Values of this property must conform to the agent and tool syntax.", + "type" : "string" + }, + "packageFileName" : { + "description" : "The base name of the package file name. For example, zlib-1.2.5.tar.gz.", + "type" : "string" + }, + "licenseInfoFromFiles" : { + "description" : "The licensing information that was discovered directly within the package. There will be an instance of this property for each distinct value of alllicenseInfoInFile properties of all files contained in the package.", + "type" : "array", + "items" : { + "description" : "License expression for licenseInfoFromFiles. The licensing information that was discovered directly within the package. There will be an instance of this property for each distinct value of alllicenseInfoInFile properties of all files contained in the package.", + "type" : "string" + } + }, + "licenseConcluded" : { + "description" : "License expression for licenseConcluded. The licensing that the preparer of this SPDX document has concluded, based on the evidence, actually applies to the package.", + "type" : "string" + }, + "versionInfo" : { + "description" : "Provides an indication of the version of the package that is described by this SpdxDocument.", + "type" : "string" + }, + "sourceInfo" : { + "description" : "Allows the producer(s) of the SPDX document to describe how the package was acquired and/or changed from the original source.", + "type" : "string" + }, + "description" : { + "description" : "Provides a detailed description of the package.", + "type" : "string" + } + }, + "required" : [ "SPDXID", "licenseDeclared", "downloadLocation", "name", "copyrightText", "licenseConcluded" ], + "additionalProperties" : false + } + }, + "files" : { + "description" : "Files referenced in the SPDX document", + "type" : "array", + "items" : { + "type" : "object", + "properties" : { + "SPDXID" : { + "type" : "string", + "description" : "Uniquely identify any element in an SPDX document which may be referenced by other elements." + }, + "fileTypes" : { + "description" : "The type of the file.", + "type" : "array", + "items" : { + "description" : "The type of the file.", + "type" : "string", + "enum" : [ "OTHER", "DOCUMENTATION", "IMAGE", "VIDEO", "ARCHIVE", "SPDX", "APPLICATION", "SOURCE", "BINARY", "TEXT", "AUDIO" ] + } + }, + "attributionTexts" : { + "description" : "This field provides a place for the SPDX data creator to record acknowledgements that may be required to be communicated in some contexts. This is not meant to include theactual complete license text (see licenseConculded and licenseDeclared), and may or may not include copyright notices (see also copyrightText). The SPDX data creator may use this field to record other acknowledgements, such as particular clauses from license texts, which may be necessary or desirable to reproduce.", + "type" : "array", + "items" : { + "description" : "This field provides a place for the SPDX data creator to record acknowledgements that may be required to be communicated in some contexts. This is not meant to include theactual complete license text (see licenseConculded and licenseDeclared), and may or may not include copyright notices (see also copyrightText). The SPDX data creator may use this field to record other acknowledgements, such as particular clauses from license texts, which may be necessary or desirable to reproduce.", + "type" : "string" + } + }, + "annotations" : { + "description" : "Provide additional information about an SpdxElement.", + "type" : "array", + "items" : { + "type" : "object", + "properties" : { + "annotationDate" : { + "description" : "Identify when the comment was made. This is to be specified according to the combined date and time in the UTC format, as specified in the ISO 8601 standard.", + "type" : "string" + }, + "comment" : { + "type" : "string" + }, + "annotator" : { + "description" : "This field identifies the person, organization or tool that has commented on a file, package, or the entire document.", + "type" : "string" + }, + "annotationType" : { + "description" : "Type of the annotation.", + "type" : "string", + "enum" : [ "OTHER", "REVIEW" ] + } + }, + "required" : [ "annotationDate", "comment", "annotator", "annotationType" ], + "additionalProperties" : false, + "description" : "An Annotation is a comment on an SpdxItem by an agent." + } + }, + "checksums" : { + "description" : "The checksum property provides a mechanism that can be used to verify that the contents of a File or Package have not changed.", + "minItems" : 1, + "type" : "array", + "items" : { + "type" : "object", + "properties" : { + "algorithm" : { + "description" : "Identifies the algorithm used to produce the subject Checksum. Currently, SHA-1 is the only supported algorithm. It is anticipated that other algorithms will be supported at a later time.", + "type" : "string", + "enum" : [ "SHA256", "SHA1", "SHA384", "MD2", "MD4", "SHA512", "MD6", "MD5", "SHA224" ] + }, + "checksumValue" : { + "description" : "The checksumValue property provides a lower case hexidecimal encoded digest value produced using a specific algorithm.", + "type" : "string" + } + }, + "required" : [ "algorithm", "checksumValue" ], + "additionalProperties" : false, + "description" : "A Checksum is value that allows the contents of a file to be authenticated. Even small changes to the content of the file will change its checksum. This class allows the results of a variety of checksum and cryptographic message digest algorithms to be represented." + } + }, + "noticeText" : { + "description" : "This field provides a place for the SPDX file creator to record potential legal notices found in the file. This may or may not include copyright statements.", + "type" : "string" + }, + "artifactOfs" : { + "description" : "Indicates the project in which the SpdxElement originated. Tools must preserve doap:homepage and doap:name properties and the URI (if one is known) of doap:Project resources that are values of this property. All other properties of doap:Projects are not directly supported by SPDX and may be dropped when translating to or from some SPDX formats.", + "type" : "array", + "items" : { + "type" : "object" + } + }, + "licenseComments" : { + "description" : "The licenseComments property allows the preparer of the SPDX document to describe why the licensing in spdx:licenseConcluded was chosen.", + "type" : "string" + }, + "fileName" : { + "description" : "The name of the file relative to the root of the package.", + "type" : "string" + }, + "comment" : { + "type" : "string" + }, + "copyrightText" : { + "description" : "The text of copyright declarations recited in the Package or File.", + "type" : "string" + }, + "fileContributors" : { + "description" : "This field provides a place for the SPDX file creator to record file contributors. Contributors could include names of copyright holders and/or authors who may not be copyright holders yet contributed to the file content.", + "type" : "array", + "items" : { + "description" : "This field provides a place for the SPDX file creator to record file contributors. Contributors could include names of copyright holders and/or authors who may not be copyright holders yet contributed to the file content.", + "type" : "string" + } + }, + "licenseInfoInFiles" : { + "description" : "Licensing information that was discovered directly in the subject file. This is also considered a declared license for the file.", + "minItems" : 1, + "type" : "array", + "items" : { + "description" : "License expression for licenseInfoInFile. Licensing information that was discovered directly in the subject file. This is also considered a declared license for the file.", + "type" : "string" + } + }, + "licenseConcluded" : { + "description" : "License expression for licenseConcluded. The licensing that the preparer of this SPDX document has concluded, based on the evidence, actually applies to the package.", + "type" : "string" + }, + "fileDependencies" : { + "type" : "array", + "items" : { + "description" : "SPDX ID for File", + "type" : "string" + } + } + }, + "required" : [ "SPDXID", "fileName", "copyrightText", "licenseConcluded" ], + "additionalProperties" : false + } + }, + "snippets" : { + "description" : "Snippets referenced in the SPDX document", + "type" : "array", + "items" : { + "type" : "object", + "properties" : { + "SPDXID" : { + "type" : "string", + "description" : "Uniquely identify any element in an SPDX document which may be referenced by other elements." + }, + "ranges" : { + "description" : "This field defines the byte range in the original host file (in X.2) that the snippet information applies to", + "minItems" : 1, + "type" : "array", + "items" : { + "type" : "object", + "properties" : { + "startPointer" : { + "type" : "object", + "properties" : { + "reference" : { + "description" : "SPDX ID for File", + "type" : "string" + }, + "offset" : { + "type" : "integer", + "description" : "Byte offset in the file" + }, + "lineNumber" : { + "type" : "integer", + "description" : "line number offset in the file" + } + }, + "required" : [ "reference" ], + "additionalProperties" : false + }, + "endPointer" : { + "type" : "object", + "properties" : { + "reference" : { + "description" : "SPDX ID for File", + "type" : "string" + }, + "offset" : { + "type" : "integer", + "description" : "Byte offset in the file" + }, + "lineNumber" : { + "type" : "integer", + "description" : "line number offset in the file" + } + }, + "required" : [ "reference" ], + "additionalProperties" : false + } + }, + "required" : [ "startPointer", "endPointer" ], + "additionalProperties" : false + } + }, + "licenseComments" : { + "description" : "The licenseComments property allows the preparer of the SPDX document to describe why the licensing in spdx:licenseConcluded was chosen.", + "type" : "string" + }, + "attributionTexts" : { + "description" : "This field provides a place for the SPDX data creator to record acknowledgements that may be required to be communicated in some contexts. This is not meant to include theactual complete license text (see licenseConculded and licenseDeclared), and may or may not include copyright notices (see also copyrightText). The SPDX data creator may use this field to record other acknowledgements, such as particular clauses from license texts, which may be necessary or desirable to reproduce.", + "type" : "array", + "items" : { + "description" : "This field provides a place for the SPDX data creator to record acknowledgements that may be required to be communicated in some contexts. This is not meant to include theactual complete license text (see licenseConculded and licenseDeclared), and may or may not include copyright notices (see also copyrightText). The SPDX data creator may use this field to record other acknowledgements, such as particular clauses from license texts, which may be necessary or desirable to reproduce.", + "type" : "string" + } + }, + "name" : { + "description" : "Identify name of this SpdxElement.", + "type" : "string" + }, + "snippetFromFile" : { + "description" : "SPDX ID for File. File containing the SPDX element (e.g. the file contaning a snippet).", + "type" : "string" + }, + "comment" : { + "type" : "string" + }, + "copyrightText" : { + "description" : "The text of copyright declarations recited in the Package or File.", + "type" : "string" + }, + "licenseInfoInSnippets" : { + "description" : "Licensing information that was discovered directly in the subject snippet. This is also considered a declared license for the snippet.", + "type" : "array", + "items" : { + "description" : "License expression for licenseInfoInSnippet. Licensing information that was discovered directly in the subject snippet. This is also considered a declared license for the snippet.", + "type" : "string" + } + }, + "annotations" : { + "description" : "Provide additional information about an SpdxElement.", + "type" : "array", + "items" : { + "type" : "object", + "properties" : { + "annotationDate" : { + "description" : "Identify when the comment was made. This is to be specified according to the combined date and time in the UTC format, as specified in the ISO 8601 standard.", + "type" : "string" + }, + "comment" : { + "type" : "string" + }, + "annotator" : { + "description" : "This field identifies the person, organization or tool that has commented on a file, package, or the entire document.", + "type" : "string" + }, + "annotationType" : { + "description" : "Type of the annotation.", + "type" : "string", + "enum" : [ "OTHER", "REVIEW" ] + } + }, + "required" : [ "annotationDate", "comment", "annotator", "annotationType" ], + "additionalProperties" : false, + "description" : "An Annotation is a comment on an SpdxItem by an agent." + } + }, + "licenseConcluded" : { + "description" : "License expression for licenseConcluded. The licensing that the preparer of this SPDX document has concluded, based on the evidence, actually applies to the package.", + "type" : "string" + } + }, + "required" : [ "SPDXID", "name", "snippetFromFile", "copyrightText", "licenseConcluded" ], + "additionalProperties" : false + } + }, + "relationships" : { + "description" : "Relationships referenced in the SPDX document", + "type" : "array", + "items" : { + "type" : "object", + "properties" : { + "spdxElementId" : { + "type" : "string", + "description" : "Id to which the SPDX element is related" + }, + "comment" : { + "type" : "string" + }, + "relationshipType" : { + "description" : "Describes the type of relationship between two SPDX elements.", + "type" : "string", + "enum" : [ "VARIANT_OF", "COPY_OF", "PATCH_FOR", "TEST_DEPENDENCY_OF", "CONTAINED_BY", "DATA_FILE_OF", "OPTIONAL_COMPONENT_OF", "ANCESTOR_OF", "GENERATES", "CONTAINS", "OPTIONAL_DEPENDENCY_OF", "FILE_ADDED", "DEV_DEPENDENCY_OF", "DEPENDENCY_OF", "BUILD_DEPENDENCY_OF", "DESCRIBES", "PREREQUISITE_FOR", "HAS_PREREQUISITE", "PROVIDED_DEPENDENCY_OF", "DYNAMIC_LINK", "DESCRIBED_BY", "METAFILE_OF", "DEPENDENCY_MANIFEST_OF", "PATCH_APPLIED", "RUNTIME_DEPENDENCY_OF", "TEST_OF", "TEST_TOOL_OF", "DEPENDS_ON", "FILE_MODIFIED", "DISTRIBUTION_ARTIFACT", "DOCUMENTATION_OF", "GENERATED_FROM", "STATIC_LINK", "OTHER", "BUILD_TOOL_OF", "TEST_CASE_OF", "PACKAGE_OF", "DESCENDANT_OF", "FILE_DELETED", "EXPANDED_FROM_ARCHIVE", "DEV_TOOL_OF", "EXAMPLE_OF" ] + }, + "relatedSpdxElement" : { + "description" : "SPDX ID for SpdxElement. A related SpdxElement.", + "type" : "string" + } + }, + "required" : [ "spdxElementId", "relationshipType", "relatedSpdxElement" ], + "additionalProperties" : false + } + } + }, + "required" : [ "SPDXID", "name", "spdxVersion", "dataLicense", "creationInfo" ], + "additionalProperties" : false +} \ No newline at end of file diff --git a/scanpipe/pipes/schemas/spdx-schema-2.2.json.ABOUT b/scanpipe/pipes/schemas/spdx-schema-2.2.json.ABOUT new file mode 100644 index 0000000000..78169dada4 --- /dev/null +++ b/scanpipe/pipes/schemas/spdx-schema-2.2.json.ABOUT @@ -0,0 +1,15 @@ +about_resource: spdx-schema-2.2.json +name: spdx-spec +version: 2.2 +download_url: https://github.com/spdx/spdx-spec/raw/development/v2.2/schemas/spdx-schema.json +description: The Software Package Data Exchange® (SPDX®) specification is a standard format + for communicating the components, licenses and copyrights associated with software packages. +homepage_url: https://spdx.org +package_url: pkg:github/spdx/spdx-spec@2.2?version_prefix=v#schemas/spdx-schema.json +license_expression: cc-by-3.0 +copyright: Copyright (c) SPDX project contributors +attribute: yes +track_changes: yes +licenses: + - key: cc-by-3.0 + name: Creative Commons Attribution License 3.0 diff --git a/scanpipe/pipes/spdx.py b/scanpipe/pipes/spdx.py index 02df41ba26..a62fbb1374 100644 --- a/scanpipe/pipes/spdx.py +++ b/scanpipe/pipes/spdx.py @@ -29,14 +29,21 @@ from datetime import timezone from pathlib import Path -SPDX_SPEC_VERSION = "2.3" +SCHEMAS_LOCATION = Path(__file__).parent / "schemas" SPDX_LICENSE_LIST_VERSION = "3.20" -SPDX_SCHEMA_NAME = "spdx-schema-2.3.json" -SPDX_SCHEMA_PATH = Path(__file__).parent / "schemas" / SPDX_SCHEMA_NAME -SPDX_SCHEMA_URL = ( + +SPDX_SPEC_VERSION_2_3 = "2.3" +SPDX_SCHEMA_2_3_PATH = SCHEMAS_LOCATION / "spdx-schema-2.3.json" +SPDX_SCHEMA_2_3_URL = ( "https://github.com/spdx/spdx-spec/raw/development/v2.3.1/schemas/spdx-schema.json" ) +SPDX_SPEC_VERSION_2_2 = "2.2" +SPDX_SCHEMA_2_2_PATH = SCHEMAS_LOCATION / "spdx-schema-2.2.json" +SPDX_SCHEMA_2_2_URL = ( + "https://github.com/spdx/spdx-spec/raw/development/v2.2/schemas/spdx-schema.json" +) + """ Generate SPDX Documents. Spec documentation: https://spdx.github.io/spdx-spec/v2.3/ @@ -98,7 +105,7 @@ print(document.as_json()) # Validate document - schema = spdx.SPDX_SCHEMA_PATH.read_text() + schema = spdx.SPDX_SCHEMA_2_3_PATH.read_text() document.validate(schema) # Write document to a file: @@ -233,14 +240,22 @@ class ExternalRef: downloadable content believed to be relevant to the Package. """ - category: str # Supported values: OTHER, SECURITY, PERSISTENT-ID, PACKAGE-MANAGER + # Supported values: + # v2.3: OTHER, SECURITY, PERSISTENT-ID, PACKAGE-MANAGER + # v2.2: OTHER, SECURITY, PACKAGE_MANAGER + category: str type: str locator: str comment: str = "" - def as_dict(self): + def as_dict(self, spec_version=SPDX_SPEC_VERSION_2_3): """Return the data as a serializable dict.""" + + if spec_version == SPDX_SPEC_VERSION_2_2: + if self.category == "PACKAGE-MANAGER": + self.category = "PACKAGE_MANAGER" + data = { "referenceCategory": self.category, "referenceType": self.type, @@ -345,7 +360,7 @@ class Package: external_refs: list[ExternalRef] = field(default_factory=list) attribution_texts: list[str] = field(default_factory=list) - def as_dict(self): + def as_dict(self, spec_version=SPDX_SPEC_VERSION_2_3): """Return the data as a serializable dict.""" spdx_id = str(self.spdx_id) if not spdx_id.startswith("SPDXRef-"): @@ -355,6 +370,7 @@ def as_dict(self): "name": self.name, "SPDXID": spdx_id, "downloadLocation": self.download_location or "NOASSERTION", + "licenseDeclared": self.license_declared or "NOASSERTION", "licenseConcluded": self.license_concluded or "NOASSERTION", "copyrightText": self.copyright_text or "NOASSERTION", "filesAnalyzed": self.files_analyzed, @@ -363,24 +379,28 @@ def as_dict(self): optional_data = { "versionInfo": self.version, "packageFileName": self.filename, - "licenseDeclared": self.license_declared, "supplier": self.supplier, "originator": self.originator, "homepage": self.homepage, "description": self.description, "summary": self.summary, "sourceInfo": self.source_info, - "releaseDate": self.date_to_iso(self.release_date), - "builtDate": self.date_to_iso(self.built_date), - "validUntilDate": self.date_to_iso(self.valid_until_date), - "primaryPackagePurpose": self.primary_package_purpose, "comment": self.comment, "licenseComments": self.license_comments, "checksums": [checksum.as_dict() for checksum in self.checksums], - "externalRefs": [ref.as_dict() for ref in self.external_refs], + "externalRefs": [ref.as_dict(spec_version) for ref in self.external_refs], "attributionTexts": self.attribution_texts, } + # Fields only valid in 2.3 + if spec_version == SPDX_SPEC_VERSION_2_3: + optional_data.update({ + "releaseDate": self.date_to_iso(self.release_date), + "builtDate": self.date_to_iso(self.built_date), + "validUntilDate": self.date_to_iso(self.valid_until_date), + "primaryPackagePurpose": self.primary_package_purpose, + }) + optional_data = {key: value for key, value in optional_data.items() if value} return {**required_data, **optional_data} @@ -567,7 +587,7 @@ class Document: packages: list[Package] spdx_id: str = "SPDXRef-DOCUMENT" - version: str = SPDX_SPEC_VERSION + version: str = SPDX_SPEC_VERSION_2_3 data_license: str = "CC0-1.0" comment: str = "" @@ -585,7 +605,7 @@ def as_dict(self): "documentNamespace": self.namespace, "documentDescribes": self.describes, "creationInfo": self.creation_info.as_dict(), - "packages": [package.as_dict() for package in self.packages], + "packages": [package.as_dict(self.version) for package in self.packages], } if self.files: @@ -646,7 +666,7 @@ def validate(self, schema): return validate_document(document=self.as_dict(), schema=schema) -def validate_document(document, schema=SPDX_SCHEMA_PATH): +def validate_document(document, schema=SPDX_SCHEMA_2_3_PATH): """ SPDX document validation. Requires the `jsonschema` library. diff --git a/scanpipe/templates/scanpipe/dropdowns/project_download_dropdown.html b/scanpipe/templates/scanpipe/dropdowns/project_download_dropdown.html index 4fdf083c01..3f183802d9 100644 --- a/scanpipe/templates/scanpipe/dropdowns/project_download_dropdown.html +++ b/scanpipe/templates/scanpipe/dropdowns/project_download_dropdown.html @@ -15,9 +15,15 @@ XLSX - +
SPDX - +
+
+ 2.3 + 2.2 +
+
+
CycloneDX
diff --git a/scanpipe/templates/scanpipe/includes/project_downloads.html b/scanpipe/templates/scanpipe/includes/project_downloads.html index d02c747c2d..4c95462f9a 100644 --- a/scanpipe/templates/scanpipe/includes/project_downloads.html +++ b/scanpipe/templates/scanpipe/includes/project_downloads.html @@ -7,9 +7,26 @@ XLSX - - SPDX - +
+
+ +
+ +