Skip to content

Commit 5923ac8

Browse files
kikofernandezkikofernandez
committed
Merge branch 'maint'
2 parents 6c5f87c + 4ec2137 commit 5923ac8

File tree

13 files changed

+1886
-1413
lines changed

13 files changed

+1886
-1413
lines changed

‎.github/scripts/otp-compliance.es‎

Lines changed: 32 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@
8383
-define(spdx_download_location, ~"https://github.com/erlang/otp/releases").
8484
-define(spdx_homepage, ~"https://www.erlang.org").
8585
-define(spdx_purl_meta_data, ~"?vcs_url=git+https://github.com/erlang/otp.git").
86-
-define(spdx_version, ~"SPDX-2.2").
86+
-define(spdx_version, ~"SPDX-2.3").
8787
-define(otp_version, 'OTP_VERSION'). % file name of the OTP version
8888
-define(spdx_project_purl, #{ ~"comment" => ~"",
8989
~"referenceCategory" => ~"PACKAGE-MANAGER",
@@ -551,7 +551,8 @@ sbom_fixing_functions(ScanResults) ->
551551
{fun fix_project_package_version/2, 'OTP_VERSION'},
552552
{fun fix_has_extracted_license_info/2, extracted_license_info()},
553553
{fun fix_project_purl/2, ?spdx_project_purl},
554-
{fun fix_beam_licenses/2, {Licenses, Copyrights}} ].
554+
{fun fix_beam_licenses/2, {Licenses, Copyrights}}
555+
].
555556

556557
fix_project_name(ProjectName, #{ ~"documentDescribes" := [ ProjectName0 ],
557558
~"packages" := Packages}=Sbom) ->
@@ -1172,7 +1173,7 @@ create_spdx_package(Pkg) ->
11721173
Supplier = Pkg#spdx_package.'supplier',
11731174
Purl1 = case Pkg#spdx_package.'purl' of
11741175
false -> [];
1175-
_ -> [Pkg#spdx_package.'purl']
1176+
_ -> Pkg#spdx_package.'purl'
11761177
end,
11771178
#{ ~"SPDXID" => SPDXID,
11781179
~"versionInfo" => VersionInfo,
@@ -1888,7 +1889,8 @@ create_spdx_package_record(PackageName, Vsn, Description, SpdxPackageFiles,
18881889
VerificationCodeValue = generate_verification_code_value(SpdxPackageFiles),
18891890
Purl1 = case Purl of
18901891
false -> false;
1891-
true -> create_externalRef_purl(Description, otp_purl(PackageName, Vsn))
1892+
true -> [create_externalRef_purl(Description, otp_purl(PackageName, Vsn)),
1893+
fix_openvex_reference()]
18921894
end,
18931895
#spdx_package {
18941896
'SPDXID' = SpdxPackageName,
@@ -1911,6 +1913,19 @@ create_spdx_package_record(PackageName, Vsn, Description, SpdxPackageFiles,
19111913
}.
19121914

19131915

1916+
fix_openvex_reference() ->
1917+
OTPMajorVersion = hd(string:split(get_otp_version(), ".")),
1918+
Reference = openvex_iri(OTPMajorVersion),
1919+
#{
1920+
~"referenceCategory" => ~"SECURITY",
1921+
~"referenceLocator" => Reference,
1922+
~"referenceType" => ~"advisory"
1923+
}.
1924+
1925+
%% Branch = ~"28" or similar. just the current version number.
1926+
openvex_iri(Branch) when is_binary(Branch) ->
1927+
<<"https://erlang.org/download/vex/otp-", Branch/binary, ".openvex.json">>.
1928+
19141929
otp_app_license_mapping(Name) ->
19151930
case Name of
19161931
~"edoc" -> ~"Apache-2.0 OR LGPL-2.1-or-later";
@@ -2375,16 +2390,23 @@ test_project_purl(#{~"documentDescribes" := [ProjectName], ~"packages" := Packag
23752390
ok.
23762391

23772392
test_packages_purl(#{~"documentDescribes" := [ProjectName], ~"packages" := Packages}=_Sbom) ->
2378-
OTPPackages = lists:filter(fun (#{~"SPDXID" := Id, ~"name" := Name}) -> ProjectName =/= Id andalso lists:member(Name, minimum_otp_apps()) end, Packages),
2379-
true = lists:all(fun (#{~"name" := Name, ~"versionInfo" := Version, ~"externalRefs" := [#{~"referenceLocator":= RefLoc}=Ref]}) ->
2393+
OTPPackages = lists:filter(fun (#{~"SPDXID" := Id, ~"name" := Name}) ->
2394+
ProjectName =/= Id andalso lists:member(Name, minimum_otp_apps())
2395+
end, Packages),
2396+
true = lists:all(fun (#{~"name" := Name, ~"versionInfo" := Version,
2397+
~"externalRefs" := [#{~"referenceLocator":= RefLoc}=Ref,
2398+
OpenVex]}) ->
23802399
ExternalRef = create_externalRef_purl(~"", otp_purl(Name, Version)),
23812400
ExternalRef1 = maps:remove(~"comment", ExternalRef),
23822401
Ref1 = maps:remove(~"comment", Ref),
23832402

2403+
ExpectedVEX = fix_openvex_reference(),
2404+
23842405
%% check expected external ref
23852406
ExternalRef1 =:= Ref1 andalso
23862407
%% check metadata is included in purl
2387-
nomatch =/= string:find(RefLoc, ?spdx_purl_meta_data)
2408+
nomatch =/= string:find(RefLoc, ?spdx_purl_meta_data) andalso
2409+
ExpectedVEX == OpenVex
23882410
end, OTPPackages),
23892411
ok.
23902412

@@ -3202,12 +3224,13 @@ fetch_app_from_table(OTPVersion, App0) ->
32023224
convert_range(Version) ->
32033225
string:split(Version, ".", all).
32043226

3205-
3227+
%% Branch = "otp-28"
32063228
init_openvex_file(Branch) ->
32073229
Ts = calendar:system_time_to_rfc3339(erlang:system_time(microsecond), [{unit, microsecond}]),
3230+
[~"otp", Version] = string:split(Branch, ~"-"),
32083231
#{
32093232
~"@context" => ~"https://openvex.dev/ns/v0.2.0",
3210-
~"@id" => <<"https://openvex.dev/docs/public/otp/vex-", Branch/binary>>,
3233+
~"@id" => openvex_iri(Version),
32113234
~"author" => ~"vexctl",
32123235
~"timestamp" => erlang:list_to_binary(Ts),
32133236
~"version" => 1,

‎.github/workflows/main.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -796,7 +796,7 @@ jobs:
796796
runs-on: ubuntu-latest
797797
needs: pack
798798
env:
799-
ORT_VERSION: 58.0.1
799+
ORT_VERSION: 72.0.0
800800
SCAN_RESULT_CACHE_PATH: .ort/scan-result.json
801801

802802
steps:
@@ -858,7 +858,7 @@ jobs:
858858
FROM otp
859859
RUN echo 'export PATH="\$HOME/.local/bin:\$PATH"' >> /home/otptest/.profile
860860
RUN sudo apt-get install -y libicu-dev pip && \
861-
pip install click==8.1.7 scancode-toolkit==${SCANCODE_VERSION} reuse && \
861+
pip install click==8.3.1 scancode-toolkit==${SCANCODE_VERSION} reuse && \
862862
pip install -U ntia-conformance-checker
863863
EOF
864864

‎.ort/config/config.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,3 +36,9 @@ ort:
3636
enabledPackageManagers: [Unmanaged]
3737
# A flag to control whether excluded scopes and paths should be skipped during the analysis.
3838
skipExcluded: true
39+
40+
reporter:
41+
reporters:
42+
SpdxDocument:
43+
options:
44+
spdxVersion: "SPDX-2.3"

‎lib/dialyzer/test/opaque_SUITE_data/results/ewgi‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,13 @@
11

2-
ewgi_api.erl:55:31: The call gb_trees:to_list({non_neg_integer(),'nil' | {_,_,_,_}}) does not have an opaque term of type gb_trees:tree(_,_) as 1st argument
3-
ewgi_testapp.erl:35:91: The call ewgi_testapp:htmlise_data("request_data",{non_neg_integer(),'nil' | {_,_,_,_}}) does not have a term of type [{_,_}] | gb_trees:tree(_,_) (with opaque subterms) as 2nd argument
4-
ewgi_testapp.erl:43:27: The call gb_trees:to_list(T::{non_neg_integer(),'nil' | {_,_,_,_}}) does not have an opaque term of type gb_trees:tree(_,_) as 1st argument
2+
ewgi_api.erl:47:31: The call gb_trees:to_list({non_neg_integer(),'nil' | {_,_,_,_}}) does not have an opaque term of type gb_trees:tree(_,_) as 1st argument
3+
ewgi_testapp.erl:26:91: The call ewgi_testapp:htmlise_data("request_data",{non_neg_integer(),'nil' | {_,_,_,_}}) does not have a term of type [{_,_}] | gb_trees:tree(_,_) (with opaque subterms) as 2nd argument
4+
ewgi_testapp.erl:34:27: The call gb_trees:to_list(T::{non_neg_integer(),'nil' | {_,_,_,_}}) does not have an opaque term of type gb_trees:tree(_,_) as 1st argument
5+
6+
%% %CopyrightBegin%
7+
%%
8+
%% SPDX-License-Identifier: MPL-1.1
9+
%%
10+
%% SPDX-FileCopyrightText: Copyright 2007 S.G. Consulting s.r.l. Filippo Pacini <[email protected]>
11+
%% SPDX-FileCopyrightText: Copyright 2007 S.G. Consulting s.r.l. Hunter Morris <[email protected]>
12+
%%
13+
%% %CopyrightEnd%

‎lib/dialyzer/test/opaque_SUITE_data/src/ewgi/ewgi_api.erl‎

Lines changed: 17 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,20 @@
1-
%%% %CopyrightBegin%
2-
%%%
3-
%%% SPDX-License-Identifier: MPL-1.1
4-
%%%
5-
%%% Copyright 2007 S.G. Consulting srl
6-
%%%
7-
%%% The contents of this file are subject to the Mozilla Public
8-
%%% License Version 1.1 (the "License"); you may not use this file
9-
%%% except in compliance with the License. You may obtain a copy of
10-
%%% the License at http://www.mozilla.org/MPL/
11-
%%%
12-
%%% Software distributed under the License is distributed on an "AS IS"
13-
%%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
14-
%%% the License for the specific language governing rights and
15-
%%% limitations under the License.
16-
%%%
17-
%%% %CopyrightEnd%
18-
%%%
19-
%%% Authors : Filippo Pacini <[email protected]>
20-
%%% Hunter Morris <[email protected]>
21-
%%%
22-
%%% The Initial Developer of the Original Code is S.G. Consulting
23-
%%% srl. Portions created by S.G. Consulting s.r.l. are Copyright (C)
24-
%%% 2007 S.G. Consulting srl. All Rights Reserved.
25-
%%%
1+
%% %CopyrightBegin%
2+
%%
3+
%% SPDX-License-Identifier: MPL-1.1
4+
%%
5+
%% SPDX-FileCopyrightText: Copyright 2007 S.G. Consulting s.r.l. Filippo Pacini <[email protected]>
6+
%% SPDX-FileCopyrightText: Copyright 2007 S.G. Consulting s.r.l. Hunter Morris <[email protected]>
7+
%%
8+
%% %CopyrightEnd%
9+
10+
%%% -------------------------------------------------------------------
11+
%%% @doc
12+
%%% <p>ewgi API. Defines a low level CGI like API.</p>
13+
%%%
14+
%%% @end
15+
%%%
16+
%%% Created : 10 Oct 2007 by Filippo Pacini <[email protected]>
17+
%%%-------------------------------------------------------------------
2618
-module(ewgi_api).
2719

2820
-include("ewgi.hrl").

‎lib/dialyzer/test/opaque_SUITE_data/src/ewgi/ewgi_testapp.erl‎

Lines changed: 13 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,18 @@
1-
%%% %CopyrightBegin%
2-
%%%
3-
%%% SPDX-License-Identifier: MPL-1.1
4-
%%%
5-
%%% Copyright 2007 S.G. Consulting srl
6-
%%%
7-
%%% The contents of this file are subject to the Mozilla Public
8-
%%% License Version 1.1 (the "License"); you may not use this file
9-
%%% except in compliance with the License. You may obtain a copy of
10-
%%% the License at http://www.mozilla.org/MPL/
11-
%%%
12-
%%% Software distributed under the License is distributed on an "AS IS"
13-
%%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
14-
%%% the License for the specific language governing rights and
15-
%%% limitations under the License.
16-
%%%
17-
%%% %CopyrightEnd%
18-
%%%
19-
%%% Authors : Hunter Morris <[email protected]>
1+
%% %CopyrightBegin%
2+
%%
3+
%% SPDX-License-Identifier: MPL-1.1
4+
%%
5+
%% SPDX-FileCopyrightText: Copyright 2007 S.G. Consulting s.r.l. Hunter Morris <[email protected]>
6+
%%
7+
%% %CopyrightEnd%
8+
9+
%%% @doc
10+
%%% <p>ewgi test applications</p>
2011
%%%
21-
%%% The Initial Developer of the Original Code is S.G. Consulting
22-
%%% srl. Portions created by S.G. Consulting s.r.l. are Copyright (C)
23-
%%% 2007 S.G. Consulting srl. All Rights Reserved.
12+
%%% @end
2413
%%%
14+
%%% Created : 05 July 2009 by Hunter Morris <[email protected]>
15+
%%%-------------------------------------------------------------------
2516
-module(ewgi_testapp).
2617

2718
-export([htmlise/1]).

‎lib/dialyzer/test/opaque_SUITE_data/src/ewgi2/ewgi_api.erl‎

Lines changed: 9 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,12 @@
1-
%%% %CopyrightBegin%
2-
%%%
3-
%%% SPDX-License-Identifier: MPL-1.1
4-
%%%
5-
%%% Copyright 2007 S.G. Consulting srl
6-
%%%
7-
%%% The contents of this file are subject to the Mozilla Public
8-
%%% License Version 1.1 (the "License"); you may not use this file
9-
%%% except in compliance with the License. You may obtain a copy of
10-
%%% the License at http://www.mozilla.org/MPL/
11-
%%%
12-
%%% Software distributed under the License is distributed on an "AS IS"
13-
%%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
14-
%%% the License for the specific language governing rights and
15-
%%% limitations under the License.
16-
%%%
17-
%%% %CopyrightEnd%
18-
%%%
19-
%%% Authors : Filippo Pacini <[email protected]>
20-
%%% Hunter Morris <[email protected]>
21-
%%%
22-
%%% The Initial Developer of the Original Code is S.G. Consulting
23-
%%% srl. Portions created by S.G. Consulting s.r.l. are Copyright (C)
24-
%%% 2007 S.G. Consulting srl. All Rights Reserved.
1+
%% %CopyrightBegin%
2+
%%
3+
%% SPDX-License-Identifier: MPL-1.1
4+
%%
5+
%% SPDX-FileCopyrightText: Copyright 2007 S.G. Consulting s.r.l. Filippo Pacini <[email protected]>
6+
%% SPDX-FileCopyrightText: Copyright 2007 S.G. Consulting s.r.l. Hunter Morris <[email protected]>
7+
%%
8+
%% %CopyrightEnd%
9+
2510
%%%
2611
-module(ewgi_api).
2712

‎lib/dialyzer/test/opaque_SUITE_data/src/ewgi2/ewgi_testapp.erl‎

Lines changed: 13 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,18 @@
1-
%%% %CopyrightBegin%
2-
%%%
3-
%%% SPDX-License-Identifier: MPL-1.1
4-
%%%
5-
%%% Copyright 2007 S.G. Consulting srl
6-
%%%
7-
%%% The contents of this file are subject to the Mozilla Public
8-
%%% License Version 1.1 (the "License"); you may not use this file
9-
%%% except in compliance with the License. You may obtain a copy of
10-
%%% the License at http://www.mozilla.org/MPL/
11-
%%%
12-
%%% Software distributed under the License is distributed on an "AS IS"
13-
%%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
14-
%%% the License for the specific language governing rights and
15-
%%% limitations under the License.
16-
%%%
17-
%%% %CopyrightEnd%
18-
%%%
19-
%%% Authors : Hunter Morris <[email protected]>
1+
%% %CopyrightBegin%
2+
%%
3+
%% SPDX-License-Identifier: MPL-1.1
4+
%%
5+
%% SPDX-FileCopyrightText: Copyright 2007 S.G. Consulting s.r.l. Hunter Morris <[email protected]>
6+
%%
7+
%% %CopyrightEnd%
8+
9+
%%% @doc
10+
%%% <p>ewgi test applications</p>
2011
%%%
21-
%%% The Initial Developer of the Original Code is S.G. Consulting
22-
%%% srl. Portions created by S.G. Consulting s.r.l. are Copyright (C)
23-
%%% 2007 S.G. Consulting srl. All Rights Reserved.
12+
%%% @end
2413
%%%
14+
%%% Created : 05 July 2009 by Hunter Morris <[email protected]>
15+
%%%-------------------------------------------------------------------
2516
-module(ewgi_testapp).
2617

2718
-export([htmlise/1]).

‎system/doc/docs.exs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@
3333
"system_principles/misc.md": [],
3434
"vulnerabilities/vulnerabilities.md": [],
3535
"sbom/sbom.md": [],
36+
"vulnerabilities/vulnerabilities.md": [],
3637
"embedded/embedded.md": [],
3738
"getting_started/getting_started.md": [],
3839
"getting_started/seq_prog.md": [],

‎system/doc/vulnerabilities/vulnerabilities.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -137,3 +137,4 @@ your project has now a new build and runtime dependency and may be subject to `C
137137

138138
For the time being, Erlang/OTP Windows binaries are not reported in the OpenVEX
139139
specification.
140+

0 commit comments

Comments
 (0)