Skip to content

Commit 4ec2137

Browse files
kikofernandezkikofernandez
committed
Merge branch 'kiko/sbom/update-spdx-sbom-to-2.3/OTP-19878' into maint
* kiko/sbom/update-spdx-sbom-to-2.3/OTP-19878: add openvex docs update generation of openvex for 26 and 27 link SBOM to OpenVEX update SPDX SBOM to 2.3
2 parents 29124f2 + ea0beba commit 4ec2137

File tree

16 files changed

+2021
-1389
lines changed

16 files changed

+2021
-1389
lines changed

‎.github/scripts/otp-compliance.es‎

Lines changed: 32 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@
8383
-define(spdx_download_location, ~"https://github.com/erlang/otp/releases").
8484
-define(spdx_homepage, ~"https://www.erlang.org").
8585
-define(spdx_purl_meta_data, ~"?vcs_url=git+https://github.com/erlang/otp.git").
86-
-define(spdx_version, ~"SPDX-2.2").
86+
-define(spdx_version, ~"SPDX-2.3").
8787
-define(otp_version, 'OTP_VERSION'). % file name of the OTP version
8888
-define(spdx_project_purl, #{ ~"comment" => ~"",
8989
~"referenceCategory" => ~"PACKAGE-MANAGER",
@@ -551,7 +551,8 @@ sbom_fixing_functions(ScanResults) ->
551551
{fun fix_project_package_version/2, 'OTP_VERSION'},
552552
{fun fix_has_extracted_license_info/2, extracted_license_info()},
553553
{fun fix_project_purl/2, ?spdx_project_purl},
554-
{fun fix_beam_licenses/2, {Licenses, Copyrights}} ].
554+
{fun fix_beam_licenses/2, {Licenses, Copyrights}}
555+
].
555556

556557
fix_project_name(ProjectName, #{ ~"documentDescribes" := [ ProjectName0 ],
557558
~"packages" := Packages}=Sbom) ->
@@ -1172,7 +1173,7 @@ create_spdx_package(Pkg) ->
11721173
Supplier = Pkg#spdx_package.'supplier',
11731174
Purl1 = case Pkg#spdx_package.'purl' of
11741175
false -> [];
1175-
_ -> [Pkg#spdx_package.'purl']
1176+
_ -> Pkg#spdx_package.'purl'
11761177
end,
11771178
#{ ~"SPDXID" => SPDXID,
11781179
~"versionInfo" => VersionInfo,
@@ -1888,7 +1889,8 @@ create_spdx_package_record(PackageName, Vsn, Description, SpdxPackageFiles,
18881889
VerificationCodeValue = generate_verification_code_value(SpdxPackageFiles),
18891890
Purl1 = case Purl of
18901891
false -> false;
1891-
true -> create_externalRef_purl(Description, otp_purl(PackageName, Vsn))
1892+
true -> [create_externalRef_purl(Description, otp_purl(PackageName, Vsn)),
1893+
fix_openvex_reference()]
18921894
end,
18931895
#spdx_package {
18941896
'SPDXID' = SpdxPackageName,
@@ -1911,6 +1913,19 @@ create_spdx_package_record(PackageName, Vsn, Description, SpdxPackageFiles,
19111913
}.
19121914

19131915

1916+
fix_openvex_reference() ->
1917+
OTPMajorVersion = hd(string:split(get_otp_version(), ".")),
1918+
Reference = openvex_iri(OTPMajorVersion),
1919+
#{
1920+
~"referenceCategory" => ~"SECURITY",
1921+
~"referenceLocator" => Reference,
1922+
~"referenceType" => ~"advisory"
1923+
}.
1924+
1925+
%% Branch = ~"28" or similar. just the current version number.
1926+
openvex_iri(Branch) when is_binary(Branch) ->
1927+
<<"https://erlang.org/download/vex/otp-", Branch/binary, ".openvex.json">>.
1928+
19141929
otp_app_license_mapping(Name) ->
19151930
case Name of
19161931
~"edoc" -> ~"Apache-2.0 OR LGPL-2.1-or-later";
@@ -2375,16 +2390,23 @@ test_project_purl(#{~"documentDescribes" := [ProjectName], ~"packages" := Packag
23752390
ok.
23762391

23772392
test_packages_purl(#{~"documentDescribes" := [ProjectName], ~"packages" := Packages}=_Sbom) ->
2378-
OTPPackages = lists:filter(fun (#{~"SPDXID" := Id, ~"name" := Name}) -> ProjectName =/= Id andalso lists:member(Name, minimum_otp_apps()) end, Packages),
2379-
true = lists:all(fun (#{~"name" := Name, ~"versionInfo" := Version, ~"externalRefs" := [#{~"referenceLocator":= RefLoc}=Ref]}) ->
2393+
OTPPackages = lists:filter(fun (#{~"SPDXID" := Id, ~"name" := Name}) ->
2394+
ProjectName =/= Id andalso lists:member(Name, minimum_otp_apps())
2395+
end, Packages),
2396+
true = lists:all(fun (#{~"name" := Name, ~"versionInfo" := Version,
2397+
~"externalRefs" := [#{~"referenceLocator":= RefLoc}=Ref,
2398+
OpenVex]}) ->
23802399
ExternalRef = create_externalRef_purl(~"", otp_purl(Name, Version)),
23812400
ExternalRef1 = maps:remove(~"comment", ExternalRef),
23822401
Ref1 = maps:remove(~"comment", Ref),
23832402

2403+
ExpectedVEX = fix_openvex_reference(),
2404+
23842405
%% check expected external ref
23852406
ExternalRef1 =:= Ref1 andalso
23862407
%% check metadata is included in purl
2387-
nomatch =/= string:find(RefLoc, ?spdx_purl_meta_data)
2408+
nomatch =/= string:find(RefLoc, ?spdx_purl_meta_data) andalso
2409+
ExpectedVEX == OpenVex
23882410
end, OTPPackages),
23892411
ok.
23902412

@@ -3202,12 +3224,13 @@ fetch_app_from_table(OTPVersion, App0) ->
32023224
convert_range(Version) ->
32033225
string:split(Version, ".", all).
32043226

3205-
3227+
%% Branch = "otp-28"
32063228
init_openvex_file(Branch) ->
32073229
Ts = calendar:system_time_to_rfc3339(erlang:system_time(microsecond), [{unit, microsecond}]),
3230+
[~"otp", Version] = string:split(Branch, ~"-"),
32083231
#{
32093232
~"@context" => ~"https://openvex.dev/ns/v0.2.0",
3210-
~"@id" => <<"https://openvex.dev/docs/public/otp/vex-", Branch/binary>>,
3233+
~"@id" => openvex_iri(Version),
32113234
~"author" => ~"vexctl",
32123235
~"timestamp" => erlang:list_to_binary(Ts),
32133236
~"version" => 1,

‎.github/workflows/main.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -745,7 +745,7 @@ jobs:
745745
runs-on: ubuntu-latest
746746
needs: pack
747747
env:
748-
ORT_VERSION: 58.0.1
748+
ORT_VERSION: 72.0.0
749749
SCAN_RESULT_CACHE_PATH: .ort/scan-result.json
750750

751751
steps:
@@ -807,7 +807,7 @@ jobs:
807807
FROM otp
808808
RUN echo 'export PATH="\$HOME/.local/bin:\$PATH"' >> /home/otptest/.profile
809809
RUN sudo apt-get install -y libicu-dev pip && \
810-
pip install click==8.1.7 scancode-toolkit==${SCANCODE_VERSION} reuse && \
810+
pip install click==8.3.1 scancode-toolkit==${SCANCODE_VERSION} reuse && \
811811
pip install -U ntia-conformance-checker
812812
EOF
813813

‎.ort/config/config.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,3 +36,9 @@ ort:
3636
enabledPackageManagers: [Unmanaged]
3737
# A flag to control whether excluded scopes and paths should be skipped during the analysis.
3838
skipExcluded: true
39+
40+
reporter:
41+
reporters:
42+
SpdxDocument:
43+
options:
44+
spdxVersion: "SPDX-2.3"

‎FILE-HEADERS/MPL-1.1.txt‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
The contents of this file are subject to the Mozilla Public
2+
License Version 1.1 (the "License"); you may not use this file
3+
except in compliance with the License. You may obtain a copy of
4+
the License at http://www.mozilla.org/MPL/
5+
6+
Software distributed under the License is distributed on an "AS IS"
7+
basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
8+
the License for the specific language governing rights and
9+
limitations under the License.

‎lib/dialyzer/test/opaque_SUITE_data/results/ewgi‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,13 @@
11

2-
ewgi_api.erl:55:31: The call gb_trees:to_list({non_neg_integer(),'nil' | {_,_,_,_}}) does not have an opaque term of type gb_trees:tree(_,_) as 1st argument
3-
ewgi_testapp.erl:35:91: The call ewgi_testapp:htmlise_data("request_data",{non_neg_integer(),'nil' | {_,_,_,_}}) does not have a term of type [{_,_}] | gb_trees:tree(_,_) (with opaque subterms) as 2nd argument
4-
ewgi_testapp.erl:43:27: The call gb_trees:to_list(T::{non_neg_integer(),'nil' | {_,_,_,_}}) does not have an opaque term of type gb_trees:tree(_,_) as 1st argument
2+
ewgi_api.erl:47:31: The call gb_trees:to_list({non_neg_integer(),'nil' | {_,_,_,_}}) does not have an opaque term of type gb_trees:tree(_,_) as 1st argument
3+
ewgi_testapp.erl:26:91: The call ewgi_testapp:htmlise_data("request_data",{non_neg_integer(),'nil' | {_,_,_,_}}) does not have a term of type [{_,_}] | gb_trees:tree(_,_) (with opaque subterms) as 2nd argument
4+
ewgi_testapp.erl:34:27: The call gb_trees:to_list(T::{non_neg_integer(),'nil' | {_,_,_,_}}) does not have an opaque term of type gb_trees:tree(_,_) as 1st argument
5+
6+
%% %CopyrightBegin%
7+
%%
8+
%% SPDX-License-Identifier: MPL-1.1
9+
%%
10+
%% SPDX-FileCopyrightText: Copyright 2007 S.G. Consulting s.r.l. Filippo Pacini <[email protected]>
11+
%% SPDX-FileCopyrightText: Copyright 2007 S.G. Consulting s.r.l. Hunter Morris <[email protected]>
12+
%%
13+
%% %CopyrightEnd%

‎lib/dialyzer/test/opaque_SUITE_data/src/ewgi/ewgi_api.erl‎

Lines changed: 10 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,13 @@
1-
%%%-------------------------------------------------------------------
2-
%%% File : ewgi_api.erl
3-
%%% Authors : Filippo Pacini <[email protected]>
4-
%%% Hunter Morris <[email protected]>
5-
%%% License :
6-
%%% The contents of this file are subject to the Mozilla Public
7-
%%% License Version 1.1 (the "License"); you may not use this file
8-
%%% except in compliance with the License. You may obtain a copy of
9-
%%% the License at http://www.mozilla.org/MPL/
10-
%%%
11-
%%% Software distributed under the License is distributed on an "AS IS"
12-
%%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
13-
%%% the License for the specific language governing rights and
14-
%%% limitations under the License.
15-
%%% The Initial Developer of the Original Code is S.G. Consulting
16-
%%% srl. Portions created by S.G. Consulting s.r.l. are Copyright (C)
17-
%%% 2007 S.G. Consulting srl. All Rights Reserved.
18-
%%%
1+
%% %CopyrightBegin%
2+
%%
3+
%% SPDX-License-Identifier: MPL-1.1
4+
%%
5+
%% SPDX-FileCopyrightText: Copyright 2007 S.G. Consulting s.r.l. Filippo Pacini <[email protected]>
6+
%% SPDX-FileCopyrightText: Copyright 2007 S.G. Consulting s.r.l. Hunter Morris <[email protected]>
7+
%%
8+
%% %CopyrightEnd%
9+
10+
%%% -------------------------------------------------------------------
1911
%%% @doc
2012
%%% <p>ewgi API. Defines a low level CGI like API.</p>
2113
%%%

‎lib/dialyzer/test/opaque_SUITE_data/src/ewgi/ewgi_testapp.erl‎

Lines changed: 8 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,11 @@
1-
%%%-------------------------------------------------------------------
2-
%%% File : ewgi_testapp.erl
3-
%%% Authors : Hunter Morris <[email protected]>
4-
%%% License :
5-
%%% The contents of this file are subject to the Mozilla Public
6-
%%% License Version 1.1 (the "License"); you may not use this file
7-
%%% except in compliance with the License. You may obtain a copy of
8-
%%% the License at http://www.mozilla.org/MPL/
9-
%%%
10-
%%% Software distributed under the License is distributed on an "AS IS"
11-
%%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
12-
%%% the License for the specific language governing rights and
13-
%%% limitations under the License.
14-
%%% The Initial Developer of the Original Code is S.G. Consulting
15-
%%% srl. Portions created by S.G. Consulting s.r.l. are Copyright (C)
16-
%%% 2007 S.G. Consulting srl. All Rights Reserved.
17-
%%%
1+
%% %CopyrightBegin%
2+
%%
3+
%% SPDX-License-Identifier: MPL-1.1
4+
%%
5+
%% SPDX-FileCopyrightText: Copyright 2007 S.G. Consulting s.r.l. Hunter Morris <[email protected]>
6+
%%
7+
%% %CopyrightEnd%
8+
189
%%% @doc
1910
%%% <p>ewgi test applications</p>
2011
%%%

‎lib/dialyzer/test/opaque_SUITE_data/src/ewgi2/ewgi_api.erl‎

Lines changed: 9 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,12 @@
1-
%%%-------------------------------------------------------------------
2-
%%% File : ewgi_api.erl
3-
%%% Authors : Filippo Pacini <[email protected]>
4-
%%% Hunter Morris <[email protected]>
5-
%%% License :
6-
%%% The contents of this file are subject to the Mozilla Public
7-
%%% License Version 1.1 (the "License"); you may not use this file
8-
%%% except in compliance with the License. You may obtain a copy of
9-
%%% the License at http://www.mozilla.org/MPL/
10-
%%%
11-
%%% Software distributed under the License is distributed on an "AS IS"
12-
%%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
13-
%%% the License for the specific language governing rights and
14-
%%% limitations under the License.
15-
%%% The Initial Developer of the Original Code is S.G. Consulting
16-
%%% srl. Portions created by S.G. Consulting s.r.l. are Copyright (C)
17-
%%% 2007 S.G. Consulting srl. All Rights Reserved.
1+
%% %CopyrightBegin%
2+
%%
3+
%% SPDX-License-Identifier: MPL-1.1
4+
%%
5+
%% SPDX-FileCopyrightText: Copyright 2007 S.G. Consulting s.r.l. Filippo Pacini <[email protected]>
6+
%% SPDX-FileCopyrightText: Copyright 2007 S.G. Consulting s.r.l. Hunter Morris <[email protected]>
7+
%%
8+
%% %CopyrightEnd%
9+
1810
%%%
1911
%%% @doc
2012
%%% <p>ewgi API. Defines a low level CGI like API.</p>

‎lib/dialyzer/test/opaque_SUITE_data/src/ewgi2/ewgi_testapp.erl‎

Lines changed: 8 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,11 @@
1-
%%%-------------------------------------------------------------------
2-
%%% File : ewgi_testapp.erl
3-
%%% Authors : Hunter Morris <[email protected]>
4-
%%% License :
5-
%%% The contents of this file are subject to the Mozilla Public
6-
%%% License Version 1.1 (the "License"); you may not use this file
7-
%%% except in compliance with the License. You may obtain a copy of
8-
%%% the License at http://www.mozilla.org/MPL/
9-
%%%
10-
%%% Software distributed under the License is distributed on an "AS IS"
11-
%%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
12-
%%% the License for the specific language governing rights and
13-
%%% limitations under the License.
14-
%%% The Initial Developer of the Original Code is S.G. Consulting
15-
%%% srl. Portions created by S.G. Consulting s.r.l. are Copyright (C)
16-
%%% 2007 S.G. Consulting srl. All Rights Reserved.
17-
%%%
1+
%% %CopyrightBegin%
2+
%%
3+
%% SPDX-License-Identifier: MPL-1.1
4+
%%
5+
%% SPDX-FileCopyrightText: Copyright 2007 S.G. Consulting s.r.l. Hunter Morris <[email protected]>
6+
%%
7+
%% %CopyrightEnd%
8+
189
%%% @doc
1910
%%% <p>ewgi test applications</p>
2011
%%%

‎system/doc/README.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,3 +44,6 @@ to use Erlang/OTP and different aspects of working with Erlang/OTP. The guides a
4444
interoperability between Erlang and C.
4545
* [Embedded Systems User's Guide](embedded/embedded.md) -
4646
This section describes the issues that are specific for running Erlang on an embedded system.
47+
* [VEX Statements](vex/vulnerabilities.md) -
48+
This section describes how Erlang/OTP reports OpenVex statements and their meaning
49+
towards third parties.

0 commit comments

Comments
 (0)