Also report detected main licenses as part of SPDX's licenseDeclared field
#9301
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #9301 +/- ##
=========================================
Coverage 67.67% 67.67%
Complexity 1223 1223
=========================================
Files 244 244
Lines 8626 8626
Branches 911 911
=========================================
Hits 5838 5838
Misses 2413 2413
Partials 375 375
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
fviernau
requested changes
Oct 17, 2024
sschuberth
force-pushed
the
go-with-spdx-licenses
branch
4 times, most recently
from
6830e6a to
26fa09c
Compare
sschuberth
changed the title
licenseDeclared fieldlicenseDeclared field
sschuberth
force-pushed
the
go-with-spdx-licenses
branch
2 times, most recently
from
715e3ee to
d333bf6
Compare
fviernau
requested changes
Oct 31, 2024
plugins/reporters/spdx/src/funTest/kotlin/SpdxDocumentReporterFunTest.kt
Show resolved
Hide resolved
sschuberth
force-pushed
the
go-with-spdx-licenses
branch
2 times, most recently
from
43a62c1 to
dd744ba
Compare
sschuberth
force-pushed
the
go-with-spdx-licenses
branch
from
dd744ba to
65564d2
Compare
This comment was marked as outdated.
This comment was marked as outdated.
sschuberth
force-pushed
the
go-with-spdx-licenses
branch
from
65564d2 to
5d60e8e
Compare
sschuberth
commented
Nov 5, 2024
| val patterns = LicenseFilePatterns.getInstance() | ||
| val detectedPackageLicenses = resolvedLicenseExpressions.filterTo(mutableSetOf()) { licenseInfo -> | ||
| licenseInfo.locations.any { | ||
| FileMatcher.match(patterns.allLicenseFilenames, it.location.path, ignoreCase = true) |
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
Because probably being the most natural string representation for an `SpdxExpression`, it makes sense to move that function to `spdx-utils`. Note that in order to continue working for `null`, it needs to stay an extension function and not just override `toString()` in `SpdxExpression`. Signed-off-by: Sebastian Schuberth <[email protected]>
Go projects are a bit special in that their dependencies are just links to Git repositories that have no metadata associated, and thus have no declared licenses in the ORT sense. Also, ORT and the purl specification treat Go dependencies differently with respect to whether they have namespaces, so it is good to have additional test coverage here as the SPDX document contains external purl references. Signed-off-by: Sebastian Schuberth <[email protected]>
Reduce the diff when introducing an upcoming feature. Signed-off-by: Sebastian Schuberth <[email protected]>
sschuberth
force-pushed
the
go-with-spdx-licenses
branch
from
5d60e8e to
e644284
Compare
The SPDX `licenseDeclared` field for a package [1] is not a declared license in the ORT sense (which means that it must originate from package metadata only), but should list any "licenses that have been declared by the authors of the package" in any way, including as part of a `LICENSE` file, which in the ORT sense would be a detected license. To account for that, also use licenses detected in root license files as licenses "declared" for the package. This solves the concrete case for Go packages that so far did not have any `licenseDeclared` set, as they are just pointers to Git repositories which have no metadata associated. Note that the overly complex SPDX expressions will get simplified in a later PR. [1]: https://spdx.github.io/spdx-spec/v2.2.2/package-information/#715-declared-license-field Signed-off-by: Sebastian Schuberth <[email protected]>
Signed-off-by: Sebastian Schuberth <[email protected]>
sschuberth
force-pushed
the
go-with-spdx-licenses
branch
from
e644284 to
f63243d
Compare
fviernau
reviewed
Nov 5, 2024
fviernau
approved these changes
Nov 5, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Please have a look at the individual commit messages for the details.
Things to note:
BSD-3-Clause AND BSD-3-Clause#8714.