Skip to content

Commit 6e81893

Browse files
maennchenmaennchen
committed
Expose Packages in SBoM
1 parent 0bc8a60 commit 6e81893

File tree

5 files changed

+220
-12
lines changed

5 files changed

+220
-12
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -147,5 +147,7 @@ jobs:
147147
with:
148148
upload-reports: true
149149
fail-on-violation: true
150-
report-formats: "WebApp"
150+
# TODO: only webapp
151+
# report-formats: "WebApp"
152+
report-formats: "WebApp,CycloneDx,SpdxDocument"
151153
version: "${{ github.sha }}"

‎.github/workflows/ort/action.yml‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -54,14 +54,22 @@ runs:
5454
mkdir -p "/$HOME/.ort/"
5555
5656
# Move Fetched Default Config into Place
57-
mv .ort-config "/$HOME/.ort/config"
57+
mv .ort-config "$HOME/.ort/config"
5858
5959
# Append Global ORT Config
6060
cat .ort/config/config.yml >> "$HOME/.ort/config/config.yml"
6161
6262
# Override Default Evaluator Rules
6363
cp .ort/config/evaluator.rules.kts "$HOME/.ort/config/evaluator.rules.kts"
6464
65+
# Set Version in SPDX & Config
66+
sed -i "s/# elixir-version-insert/versionInfo: '${ELIXIR_VERSION}'/" project.spdx.yml
67+
sed -i -E "s/(\"SpdxDocumentFile:The Elixir Team:.+:)\"/\1${ELIXIR_VERSION}\"/" .ort.yml
68+
sed -i "s|https://github.com/elixir-lang/elixir.git|${ELIXIR_REPO}@${ELIXIR_VERSION}|" project.spdx.yml
69+
env:
70+
ELIXIR_VERSION: "${{ inputs.version }}"
71+
ELIXIR_REPO: "${{ github.server_url }}/${{ github.repository }}.git"
72+
6573
- name: "Cache ScanCode"
6674
uses: actions/cache@v4
6775
with:
@@ -74,10 +82,10 @@ runs:
7482
# * https://github.com/oss-review-toolkit/ort-ci-github-action/issues/37
7583
# * https://github.com/oss-review-toolkit/ort-ci-github-action/pull/41
7684
# * https://github.com/oss-review-toolkit/ort-ci-github-action/pull/43
77-
uses: maennchen/ort-ci-github-action@action-output
85+
uses: oss-review-toolkit/ort-ci-github-action@2cda885c8eefaf92bab9f3e979b5d5a42970dfa4 # main
7886
with:
79-
image: ghcr.io/oss-review-toolkit/ort-minimal:latest
80-
run: >
87+
image: ghcr.io/oss-review-toolkit/ort-minimal:51.1.0
88+
run: >-
8189
labels,
8290
cache-dependencies,
8391
cache-scan-results,
@@ -89,5 +97,7 @@ runs:
8997
${{ inputs.upload-reports == 'true' && 'upload-results' || '' }}
9098
fail-on: "${{ inputs.fail-on-violation == 'true' && 'violations,issues' || '' }}"
9199
report-formats: "${{ inputs.report-formats }}"
92-
ort-cli-report-args: '-O CycloneDX=output.file.formats=json,xml -O SpdxDocument=outputFileFormats=JSON,YAML'
100+
ort-cli-report-args: >-
101+
-O CycloneDX=output.file.formats=json,xml
102+
-O SpdxDocument=outputFileFormats=JSON,YAML
93103
sw-version: "${{ inputs.version }}"

‎.ort.yml‎

Lines changed: 32 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,14 +18,15 @@ excludes:
1818
- pattern: "man/*"
1919
reason: "DOCUMENTATION_OF"
2020
comment: "Documentation"
21-
- pattern: ".github/*"
21+
- pattern: ".github/**/*"
2222
reason: "BUILD_TOOL_OF"
2323
comment: "Documentation"
24-
- pattern: ".ort/*"
24+
- pattern: ".ort/**/*"
2525
reason: "BUILD_TOOL_OF"
2626
comment: "Documentation"
2727

2828
curations:
29+
# All curations must be defined for both the project (here) and the relevant package
2930
license_findings:
3031
# Logos
3132
- path: "lib/elixir/pages/images/logo.png"
@@ -109,3 +110,32 @@ curations:
109110
comment: "Ignored by ScanCode"
110111
detected_license: "NONE"
111112
concluded_license: "Apache-2.0"
113+
114+
packages:
115+
- id: "SpdxDocumentFile:The Elixir Team:elixir-lang:"
116+
curations:
117+
concluded_license: "Apache-2.0 AND LicenseRef-scancode-unicode"
118+
- id: "SpdxDocumentFile:The Elixir Team:eex:"
119+
curations:
120+
concluded_license: "Apache-2.0"
121+
is_metadata_only: true
122+
- id: "SpdxDocumentFile:The Elixir Team:elixir:"
123+
curations:
124+
concluded_license: "Apache-2.0 AND LicenseRef-scancode-unicode"
125+
is_metadata_only: true
126+
- id: "SpdxDocumentFile:The Elixir Team:exunit:"
127+
curations:
128+
concluded_license: "Apache-2.0"
129+
is_metadata_only: true
130+
- id: "SpdxDocumentFile:The Elixir Team:iex:"
131+
curations:
132+
concluded_license: "Apache-2.0"
133+
is_metadata_only: true
134+
- id: "SpdxDocumentFile:The Elixir Team:logger:"
135+
curations:
136+
concluded_license: "Apache-2.0"
137+
is_metadata_only: true
138+
- id: "SpdxDocumentFile:The Elixir Team:mix:"
139+
curations:
140+
concluded_license: "Apache-2.0"
141+
is_metadata_only: true

‎.ort/config/config.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22
# SPDX-FileCopyrightText: 2021 The Elixir Team
33

44
ort:
5+
enableRepositoryPackageCurations: true
6+
57
scanner:
68
skipConcluded: false
79
includeFilesWithoutFindings: true

‎project.spdx.yml‎

Lines changed: 168 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,20 +9,184 @@ name: "elixir"
99
dataLicense: "CC0-1.0"
1010
documentNamespace: "https://github.com/elixir-lang/elixir"
1111
documentDescribes:
12-
- "SPDXRef-Package-elixir"
12+
- "SPDXRef-Project-elixir-lang"
1313
packages:
14-
- SPDXID: "SPDXRef-Package-elixir"
14+
- SPDXID: "SPDXRef-Project-elixir-lang"
1515
summary: "About Elixir is a dynamic, functional language for building scalable and maintainable applications"
1616
copyrightText: "Copyright (c) 2012 Plataformatec. Copyright (c) 2021 The Elixir Team. All Rights Reserved."
1717
downloadLocation: "git+https://github.com/elixir-lang/elixir.git"
1818
filesAnalyzed: false
1919
homepage: "https://elixir-lang.org/"
20+
licenseConcluded: "Apache-2.0 AND LicenseRef-scancode-unicode AND LicenseRef-elixir-trademark-policy"
21+
licenseDeclared: "Apache-2.0 AND LicenseRef-scancode-unicode AND LicenseRef-elixir-trademark-policy"
22+
name: "elixir-lang"
23+
originator: "Organization: The Elixir Team"
24+
supplier: "Organization: The Elixir Team"
25+
packageFileName: "."
26+
externalRefs:
27+
- referenceCategory: PACKAGE-MANAGER
28+
referenceType: "purl"
29+
referenceLocator: "pkg:github/elixir-lang/elixir"
30+
comment: "GitHub PURL"
31+
# elixir-version-insert
32+
- SPDXID: "SPDXRef-Package-eex"
33+
summary: "About Elixir is a dynamic, functional language for building scalable and maintainable applications"
34+
copyrightText: "Copyright (c) 2012 Plataformatec. Copyright (c) 2021 The Elixir Team. All Rights Reserved."
35+
downloadLocation: "git+https://github.com/elixir-lang/elixir.git#lib/eex"
36+
filesAnalyzed: false
37+
homepage: "https://elixir-lang.org/"
38+
licenseConcluded: "Apache-2.0"
39+
licenseDeclared: "Apache-2.0"
40+
name: "eex"
41+
originator: "Organization: The Elixir Team"
42+
supplier: "Organization: The Elixir Team"
43+
packageFileName: "./lib/eex"
44+
externalRefs:
45+
- referenceCategory: PACKAGE-MANAGER
46+
referenceType: "purl"
47+
referenceLocator: "pkg:otp/eex"
48+
comment: "OTP PURL"
49+
# elixir-version-insert
50+
- SPDXID: "SPDXRef-Package-elixir"
51+
summary: "About Elixir is a dynamic, functional language for building scalable and maintainable applications"
52+
copyrightText: "Copyright (c) 2012 Plataformatec. Copyright (c) 2021 The Elixir Team. All Rights Reserved."
53+
downloadLocation: "git+https://github.com/elixir-lang/elixir.git#lib/elixir"
54+
filesAnalyzed: false
55+
homepage: "https://elixir-lang.org/"
2056
licenseConcluded: "Apache-2.0 AND LicenseRef-scancode-unicode"
2157
licenseDeclared: "Apache-2.0 AND LicenseRef-scancode-unicode"
2258
name: "elixir"
23-
packageFileName: "./"
59+
originator: "Organization: The Elixir Team"
60+
supplier: "Organization: The Elixir Team"
61+
packageFileName: "./lib/elixir"
2462
externalRefs:
2563
- referenceCategory: PACKAGE-MANAGER
2664
referenceType: "purl"
27-
referenceLocator: "pkg:github/elixir-lang/elixir"
65+
referenceLocator: "pkg:otp/elixir"
66+
comment: "OTP PURL"
67+
# elixir-version-insert
68+
- SPDXID: "SPDXRef-Package-exunit"
69+
summary: "About Elixir is a dynamic, functional language for building scalable and maintainable applications"
70+
copyrightText: "Copyright (c) 2012 Plataformatec. Copyright (c) 2021 The Elixir Team. All Rights Reserved."
71+
downloadLocation: "git+https://github.com/elixir-lang/elixir.git#lib/ex_unit"
72+
filesAnalyzed: false
73+
homepage: "https://elixir-lang.org/"
74+
licenseConcluded: "Apache-2.0"
75+
licenseDeclared: "Apache-2.0"
76+
name: "exunit"
77+
originator: "Organization: The Elixir Team"
78+
supplier: "Organization: The Elixir Team"
79+
packageFileName: "./lib/ex_unit"
80+
externalRefs:
81+
- referenceCategory: PACKAGE-MANAGER
82+
referenceType: "purl"
83+
referenceLocator: "pkg:otp/ex_unit"
84+
comment: "OTP PURL"
85+
# elixir-version-insert
86+
- SPDXID: "SPDXRef-Package-iex"
87+
summary: "About Elixir is a dynamic, functional language for building scalable and maintainable applications"
88+
copyrightText: "Copyright (c) 2012 Plataformatec. Copyright (c) 2021 The Elixir Team. All Rights Reserved."
89+
downloadLocation: "git+https://github.com/elixir-lang/elixir.git#lib/iex"
90+
filesAnalyzed: false
91+
homepage: "https://elixir-lang.org/"
92+
licenseConcluded: "Apache-2.0"
93+
licenseDeclared: "Apache-2.0"
94+
name: "iex"
95+
originator: "Organization: The Elixir Team"
96+
supplier: "Organization: The Elixir Team"
97+
packageFileName: "./lib/iex"
98+
externalRefs:
99+
- referenceCategory: PACKAGE-MANAGER
100+
referenceType: "purl"
101+
referenceLocator: "pkg:otp/iex"
102+
comment: "OTP PURL"
103+
# elixir-version-insert
104+
- SPDXID: "SPDXRef-Package-logger"
105+
summary: "About Elixir is a dynamic, functional language for building scalable and maintainable applications"
106+
copyrightText: "Copyright (c) 2012 Plataformatec. Copyright (c) 2021 The Elixir Team. All Rights Reserved."
107+
downloadLocation: "git+https://github.com/elixir-lang/elixir.git/lib/logger"
108+
filesAnalyzed: false
109+
homepage: "https://elixir-lang.org/"
110+
licenseConcluded: "Apache-2.0"
111+
licenseDeclared: "Apache-2.0"
112+
name: "logger"
113+
originator: "Organization: The Elixir Team"
114+
supplier: "Organization: The Elixir Team"
115+
packageFileName: "./lib/logger"
116+
externalRefs:
117+
- referenceCategory: PACKAGE-MANAGER
118+
referenceType: "purl"
119+
referenceLocator: "pkg:otp/logger"
120+
comment: "OTP PURL"
121+
# elixir-version-insert
122+
- SPDXID: "SPDXRef-Package-mix"
123+
summary: "About Elixir is a dynamic, functional language for building scalable and maintainable applications"
124+
copyrightText: "Copyright (c) 2012 Plataformatec. Copyright (c) 2021 The Elixir Team. All Rights Reserved."
125+
downloadLocation: "git+https://github.com/elixir-lang/elixir.git#lib/mix"
126+
filesAnalyzed: false
127+
homepage: "https://elixir-lang.org/"
128+
licenseConcluded: "Apache-2.0"
129+
licenseDeclared: "Apache-2.0"
130+
name: "mix"
131+
originator: "Organization: The Elixir Team"
132+
supplier: "Organization: The Elixir Team"
133+
packageFileName: "./lib/mix"
134+
externalRefs:
135+
- referenceCategory: PACKAGE-MANAGER
136+
referenceType: "purl"
137+
referenceLocator: "pkg:otp/mix"
138+
comment: "OTP PURL"
139+
# elixir-version-insert
140+
- SPDXID: "SPDXRef-Project-erlang"
141+
description: "Erlang is a programming language and runtime system for building massively scalable soft real-time systems with requirements on high availability."
142+
copyrightText: "Copyright Ericsson AB 2010-2024. All Rights Reserved."
143+
downloadLocation: "git+https://github.com/erlang/otp.git"
144+
filesAnalyzed: false
145+
homepage: "https://www.erlang.org/"
146+
licenseConcluded: "Apache-2.0"
147+
licenseDeclared: "Apache-2.0"
148+
name: "erlang"
149+
originator: "Organization: Ericsson AB"
150+
supplier: "Organization: Ericsson AB"
151+
externalRefs:
152+
- referenceCategory: PACKAGE-MANAGER
153+
referenceType: "purl"
154+
referenceLocator: "pkg:github/erlang/otp"
28155
comment: "GitHub PURL"
156+
relationships:
157+
- spdxElementId: "SPDXRef-Project-elixir-lang"
158+
relatedSpdxElement: "SPDXRef-Package-eex"
159+
relationshipType: "STATIC_LINK" # Should be CONTAINS, issue with ORT
160+
- spdxElementId: "SPDXRef-Project-elixir-lang"
161+
relatedSpdxElement: "SPDXRef-Package-elixir"
162+
relationshipType: "STATIC_LINK" # Should be CONTAINS, issue with ORT
163+
- spdxElementId: "SPDXRef-Project-elixir-lang"
164+
relatedSpdxElement: "SPDXRef-Package-exunit"
165+
relationshipType: "STATIC_LINK" # Should be CONTAINS, issue with ORT
166+
- spdxElementId: "SPDXRef-Project-elixir-lang"
167+
relatedSpdxElement: "SPDXRef-Package-iex"
168+
relationshipType: "STATIC_LINK" # Should be CONTAINS, issue with ORT
169+
- spdxElementId: "SPDXRef-Project-elixir-lang"
170+
relatedSpdxElement: "SPDXRef-Package-logger"
171+
relationshipType: "STATIC_LINK" # Should be CONTAINS, issue with ORT
172+
- spdxElementId: "SPDXRef-Project-elixir-lang"
173+
relatedSpdxElement: "SPDXRef-Package-mix"
174+
relationshipType: "STATIC_LINK" # Should be CONTAINS, issue with ORT
175+
- spdxElementId: "SPDXRef-Package-elixir"
176+
relatedSpdxElement: "SPDXRef-Project-erlang"
177+
relationshipType: "RUNTIME_DEPENDENCY_OF"
178+
- spdxElementId: "SPDXRef-Package-eex"
179+
relatedSpdxElement: "SPDXRef-Package-elixir"
180+
relationshipType: "STATIC_LINK"
181+
- spdxElementId: "SPDXRef-Package-exunit"
182+
relatedSpdxElement: "SPDXRef-Package-elixir"
183+
relationshipType: "STATIC_LINK"
184+
- spdxElementId: "SPDXRef-Package-iex"
185+
relatedSpdxElement: "SPDXRef-Package-elixir"
186+
relationshipType: "STATIC_LINK"
187+
- spdxElementId: "SPDXRef-Package-logger"
188+
relatedSpdxElement: "SPDXRef-Package-elixir"
189+
relationshipType: "STATIC_LINK"
190+
- spdxElementId: "SPDXRef-Package-mix"
191+
relatedSpdxElement: "SPDXRef-Package-elixir"
192+
relationshipType: "STATIC_LINK"

0 commit comments

Comments
 (0)