Skip to content

fix: use "contents" field and remove "fullText" license field #3857

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
spiffcs merged 4 commits into from
May 5, 2025
Merged

fix: use "contents" field and remove "fullText" license field #3857

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
d8cdbee
chore: remove FullText and only use Contents for all license
spiffcs May 5, 2025
ed5c0dd
fix: remove reference to fullText in favor of contents
spiffcs May 5, 2025
5613ab7
chore: add test for unique licenses with only content in set
spiffcs May 5, 2025
4622178
chore: comment
spiffcs May 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions syft/format/internal/spdxutil/helpers/license.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,7 +80,7 @@ func ParseLicenses(raw []pkg.License) (concluded, declared []SPDXLicense) {
func createSPDXLicense(l pkg.License) SPDXLicense {
candidate := SPDXLicense{
ID: generateLicenseID(l),
FullText: l.FullText,
FullText: l.Contents,
}

if l.SPDXExpression == "" {
Expand All @@ -96,7 +96,7 @@ func generateLicenseID(l pkg.License) string {
if l.Value != "" {
return spdxlicense.LicenseRefPrefix + SanitizeElementID(l.Value)
}
return licenseSum(l.FullText)
return licenseSum(l.Contents)
}

func licenseSum(s string) string {
Expand Down
6 changes: 3 additions & 3 deletions syft/format/internal/spdxutil/helpers/license_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,7 +116,7 @@ func TestGenerateLicenseID(t *testing.T) {
license: pkg.License{
SPDXExpression: "Apache-2.0",
Value: "SomeValue",
FullText: "Some text",
Contents: "Some text",
},
expected: "Apache-2.0",
},
Expand All @@ -136,9 +136,9 @@ func TestGenerateLicenseID(t *testing.T) {
"LGPLv2--and-LGPLv2--with-exceptions-and-GPLv2--and-GPLv2--with-exceptions-and-BSD-and-Inner-Net-and-ISC-and-Public-Domain-and-GFDL",
},
{
name: "Uses hash of fullText when nothing else is provided",
name: "Uses hash of contents when nothing else is provided",
license: pkg.License{
FullText: "This is a very long custom license text that should be hashed because it's more than 64 characters long.",
Contents: "This is a very long custom license text that should be hashed because it's more than 64 characters long.",
},
expected: "", // We'll verify it starts with the correct prefix
},
Expand Down
4 changes: 2 additions & 2 deletions syft/format/spdxjson/test-fixtures/snapshot/TestSPDXJSONDirectoryEncoder.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@
"packages": [
{
"name": "package-1",
"SPDXID": "SPDXRef-Package-python-package-1-cf21bacaa74c8c08",
"SPDXID": "SPDXRef-Package-python-package-1-4dd25c6ee16b729a",
"versionInfo": "1.0.1",
"supplier": "NOASSERTION",
"downloadLocation": "NOASSERTION",
Expand Down Expand Up @@ -76,7 +76,7 @@
"relationships": [
{
"spdxElementId": "SPDXRef-DocumentRoot-Directory-some-path",
"relatedSpdxElement": "SPDXRef-Package-python-package-1-cf21bacaa74c8c08",
"relatedSpdxElement": "SPDXRef-Package-python-package-1-4dd25c6ee16b729a",
"relationshipType": "CONTAINS"
},
{
Expand Down
4 changes: 2 additions & 2 deletions syft/format/spdxjson/test-fixtures/snapshot/TestSPDXJSONImageEncoder.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@
"packages": [
{
"name": "package-1",
"SPDXID": "SPDXRef-Package-python-package-1-2d8996d6f81313df",
"SPDXID": "SPDXRef-Package-python-package-1-72567175418f73f8",
"versionInfo": "1.0.1",
"supplier": "NOASSERTION",
"downloadLocation": "NOASSERTION",
Expand Down Expand Up @@ -90,7 +90,7 @@
"relationships": [
{
"spdxElementId": "SPDXRef-DocumentRoot-Image-user-image-input",
"relatedSpdxElement": "SPDXRef-Package-python-package-1-2d8996d6f81313df",
"relatedSpdxElement": "SPDXRef-Package-python-package-1-72567175418f73f8",
"relationshipType": "CONTAINS"
},
{
Expand Down
16 changes: 8 additions & 8 deletions syft/format/spdxjson/test-fixtures/snapshot/TestSPDXRelationshipOrder.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@
"packages": [
{
"name": "package-1",
"SPDXID": "SPDXRef-Package-python-package-1-2d8996d6f81313df",
"SPDXID": "SPDXRef-Package-python-package-1-72567175418f73f8",
"versionInfo": "1.0.1",
"supplier": "NOASSERTION",
"downloadLocation": "NOASSERTION",
Expand Down Expand Up @@ -199,38 +199,38 @@
],
"relationships": [
{
"spdxElementId": "SPDXRef-Package-python-package-1-2d8996d6f81313df",
"spdxElementId": "SPDXRef-Package-python-package-1-72567175418f73f8",
"relatedSpdxElement": "SPDXRef-File-f1-5265a4dde3edbf7c",
"relationshipType": "CONTAINS"
},
{
"spdxElementId": "SPDXRef-Package-python-package-1-2d8996d6f81313df",
"spdxElementId": "SPDXRef-Package-python-package-1-72567175418f73f8",
"relatedSpdxElement": "SPDXRef-File-z1-f5-839d99ee67d9d174",
"relationshipType": "CONTAINS"
},
{
"spdxElementId": "SPDXRef-Package-python-package-1-2d8996d6f81313df",
"spdxElementId": "SPDXRef-Package-python-package-1-72567175418f73f8",
"relatedSpdxElement": "SPDXRef-File-a1-f6-9c2f7510199b17f6",
"relationshipType": "CONTAINS"
},
{
"spdxElementId": "SPDXRef-Package-python-package-1-2d8996d6f81313df",
"spdxElementId": "SPDXRef-Package-python-package-1-72567175418f73f8",
"relatedSpdxElement": "SPDXRef-File-d2-f4-c641caa71518099f",
"relationshipType": "CONTAINS"
},
{
"spdxElementId": "SPDXRef-Package-python-package-1-2d8996d6f81313df",
"spdxElementId": "SPDXRef-Package-python-package-1-72567175418f73f8",
"relatedSpdxElement": "SPDXRef-File-d1-f3-c6f5b29dca12661f",
"relationshipType": "CONTAINS"
},
{
"spdxElementId": "SPDXRef-Package-python-package-1-2d8996d6f81313df",
"spdxElementId": "SPDXRef-Package-python-package-1-72567175418f73f8",
"relatedSpdxElement": "SPDXRef-File-f2-f9e49132a4b96ccd",
"relationshipType": "CONTAINS"
},
{
"spdxElementId": "SPDXRef-DocumentRoot-Image-user-image-input",
"relatedSpdxElement": "SPDXRef-Package-python-package-1-2d8996d6f81313df",
"relatedSpdxElement": "SPDXRef-Package-python-package-1-72567175418f73f8",
"relationshipType": "CONTAINS"
},
{
Expand Down
16 changes: 8 additions & 8 deletions syft/format/spdxtagvalue/test-fixtures/snapshot/TestSPDXRelationshipOrder.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,7 +91,7 @@ ExternalRef: PACKAGE-MANAGER purl pkg:deb/debian/package-2@2.0.1
##### Package: package-1

PackageName: package-1
SPDXID: SPDXRef-Package-python-package-1-2d8996d6f81313df
SPDXID: SPDXRef-Package-python-package-1-72567175418f73f8
PackageVersion: 1.0.1
PackageSupplier: NOASSERTION
PackageDownloadLocation: NOASSERTION
Expand All @@ -105,13 +105,13 @@ ExternalRef: PACKAGE-MANAGER purl a-purl-1

##### Relationships

Relationship: SPDXRef-Package-python-package-1-2d8996d6f81313df CONTAINS SPDXRef-File-f1-5265a4dde3edbf7c
Relationship: SPDXRef-Package-python-package-1-2d8996d6f81313df CONTAINS SPDXRef-File-z1-f5-839d99ee67d9d174
Relationship: SPDXRef-Package-python-package-1-2d8996d6f81313df CONTAINS SPDXRef-File-a1-f6-9c2f7510199b17f6
Relationship: SPDXRef-Package-python-package-1-2d8996d6f81313df CONTAINS SPDXRef-File-d2-f4-c641caa71518099f
Relationship: SPDXRef-Package-python-package-1-2d8996d6f81313df CONTAINS SPDXRef-File-d1-f3-c6f5b29dca12661f
Relationship: SPDXRef-Package-python-package-1-2d8996d6f81313df CONTAINS SPDXRef-File-f2-f9e49132a4b96ccd
Relationship: SPDXRef-DocumentRoot-Image-user-image-input CONTAINS SPDXRef-Package-python-package-1-2d8996d6f81313df
Relationship: SPDXRef-Package-python-package-1-72567175418f73f8 CONTAINS SPDXRef-File-f1-5265a4dde3edbf7c
Relationship: SPDXRef-Package-python-package-1-72567175418f73f8 CONTAINS SPDXRef-File-z1-f5-839d99ee67d9d174
Relationship: SPDXRef-Package-python-package-1-72567175418f73f8 CONTAINS SPDXRef-File-a1-f6-9c2f7510199b17f6
Relationship: SPDXRef-Package-python-package-1-72567175418f73f8 CONTAINS SPDXRef-File-d2-f4-c641caa71518099f
Relationship: SPDXRef-Package-python-package-1-72567175418f73f8 CONTAINS SPDXRef-File-d1-f3-c6f5b29dca12661f
Relationship: SPDXRef-Package-python-package-1-72567175418f73f8 CONTAINS SPDXRef-File-f2-f9e49132a4b96ccd
Relationship: SPDXRef-DocumentRoot-Image-user-image-input CONTAINS SPDXRef-Package-python-package-1-72567175418f73f8
Relationship: SPDXRef-DocumentRoot-Image-user-image-input CONTAINS SPDXRef-Package-deb-package-2-4b756c6f6fb127a3
Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-DocumentRoot-Image-user-image-input

4 changes: 2 additions & 2 deletions syft/format/spdxtagvalue/test-fixtures/snapshot/TestSPDXTagValueDirectoryEncoder.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ ExternalRef: PACKAGE-MANAGER purl pkg:deb/debian/package-2@2.0.1
##### Package: package-1

PackageName: package-1
SPDXID: SPDXRef-Package-python-package-1-cf21bacaa74c8c08
SPDXID: SPDXRef-Package-python-package-1-4dd25c6ee16b729a
PackageVersion: 1.0.1
PackageSupplier: NOASSERTION
PackageDownloadLocation: NOASSERTION
Expand All @@ -52,7 +52,7 @@ ExternalRef: PACKAGE-MANAGER purl a-purl-2

##### Relationships

Relationship: SPDXRef-DocumentRoot-Directory-some-path CONTAINS SPDXRef-Package-python-package-1-cf21bacaa74c8c08
Relationship: SPDXRef-DocumentRoot-Directory-some-path CONTAINS SPDXRef-Package-python-package-1-4dd25c6ee16b729a
Relationship: SPDXRef-DocumentRoot-Directory-some-path CONTAINS SPDXRef-Package-deb-package-2-39392bb5e270f669
Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-DocumentRoot-Directory-some-path

4 changes: 2 additions & 2 deletions syft/format/spdxtagvalue/test-fixtures/snapshot/TestSPDXTagValueImageEncoder.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ ExternalRef: PACKAGE-MANAGER purl pkg:deb/debian/package-2@2.0.1
##### Package: package-1

PackageName: package-1
SPDXID: SPDXRef-Package-python-package-1-2d8996d6f81313df
SPDXID: SPDXRef-Package-python-package-1-72567175418f73f8
PackageVersion: 1.0.1
PackageSupplier: NOASSERTION
PackageDownloadLocation: NOASSERTION
Expand All @@ -55,7 +55,7 @@ ExternalRef: PACKAGE-MANAGER purl a-purl-1

##### Relationships

Relationship: SPDXRef-DocumentRoot-Image-user-image-input CONTAINS SPDXRef-Package-python-package-1-2d8996d6f81313df
Relationship: SPDXRef-DocumentRoot-Image-user-image-input CONTAINS SPDXRef-Package-python-package-1-72567175418f73f8
Relationship: SPDXRef-DocumentRoot-Image-user-image-input CONTAINS SPDXRef-Package-deb-package-2-4b756c6f6fb127a3
Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-DocumentRoot-Image-user-image-input

2 changes: 1 addition & 1 deletion syft/format/syftjson/test-fixtures/snapshot/TestDirectoryEncoder.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"artifacts": [
{
"id": "cf21bacaa74c8c08",
"id": "4dd25c6ee16b729a",
"name": "package-1",
"version": "1.0.1",
"type": "python",
Expand Down
2 changes: 1 addition & 1 deletion syft/format/syftjson/test-fixtures/snapshot/TestEncodeFullJSONDocument.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"artifacts": [
{
"id": "783177db0211edb6",
"id": "fba4ca04d4906f25",
"name": "package-1",
"version": "1.0.1",
"type": "python",
Expand Down
2 changes: 1 addition & 1 deletion syft/format/syftjson/test-fixtures/snapshot/TestImageEncoder.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"artifacts": [
{
"id": "2d8996d6f81313df",
"id": "72567175418f73f8",
"name": "package-1",
"version": "1.0.1",
"type": "python",
Expand Down
3 changes: 1 addition & 2 deletions syft/format/syftjson/to_format_model.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -230,12 +230,11 @@ func toLicenseModel(pkgLicenses []pkg.License) (modelLicenses []model.License) {

modelLicenses = append(modelLicenses, model.License{
Value: l.Value,
FullText: l.FullText,
SPDXExpression: l.SPDXExpression,
Contents: l.Contents,
Type: l.Type,
URLs: urls,
Locations: locations,
Contents: l.Contents,
})
}
return
Expand Down
9 changes: 4 additions & 5 deletions syft/pkg/license.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,17 +27,16 @@ var _ sort.Interface = (*Licenses)(nil)
// of where a license was declared/concluded for a given package
// If a license is given as it's full text in the metadata rather than it's value or SPDX expression

// The FullText field is used to represent this data
// The Contents field is used to represent this data
// A Concluded License type is the license the SBOM creator believes governs the package (human crafted or altered SBOM)
// The Declared License is what the authors of a project believe govern the package. This is the default type syft declares.
type License struct {
SPDXExpression string
Value string
FullText string
Type license.Type
Contents string
URLs []string `hash:"ignore"`
Locations file.LocationSet `hash:"ignore"`
Contents string `hash:"ignore"` // The optional binary contents of the license file
}

type Licenses []License
Expand Down Expand Up @@ -93,7 +92,7 @@ func NewLicenseFromType(value string, t license.Type) License {

if fullText != "" {
return License{
FullText: fullText,
Contents: fullText,
Type: t,
Locations: file.NewLocationSet(),
}
Expand Down Expand Up @@ -180,7 +179,7 @@ func NewLicenseFromFields(value, url string, location *file.Location) License {
}

func (s License) Empty() bool {
return s.Value == "" && s.SPDXExpression == "" && s.FullText == ""
return s.Value == "" && s.SPDXExpression == "" && s.Contents == ""
}

// Merge two licenses into a new license object. If the merge is not possible due to unmergeable fields
Expand Down
26 changes: 26 additions & 0 deletions syft/pkg/license_set_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
package pkg

import (
"os"
"testing"

"github.com/google/go-cmp/cmp"
Expand Down Expand Up @@ -125,6 +126,23 @@ func TestLicenseSet_Add(t *testing.T) {
},
},
},
{
name: "licenses that are unknown with different contents can exist in the same set",
licenses: []License{
NewLicense(readFileAsString("../../internal/licenses/test-fixtures/nvidia-software-and-cuda-supplement")),
NewLicense(readFileAsString("../../internal/licenses/test-fixtures/apache-license-2.0")),
},
want: []License{
{
Contents: readFileAsString("../../internal/licenses/test-fixtures/apache-license-2.0"),
Type: license.Declared,
},
{
Contents: readFileAsString("../../internal/licenses/test-fixtures/nvidia-software-and-cuda-supplement"),
Type: license.Declared,
},
},
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
Expand Down Expand Up @@ -160,3 +178,11 @@ func defaultLicenseComparer(x, y License) bool {
},
))
}

func readFileAsString(filepath string) string {
data, err := os.ReadFile(filepath) // Alternatively, ioutil.ReadFile in older Go versions
Comment thread
spiffcs marked this conversation as resolved.
Outdated
if err != nil {
panic(err)
}
return string(data)
}
2 changes: 1 addition & 1 deletion syft/pkg/license_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -240,7 +240,7 @@ func TestFullText(t *testing.T) {
want: License{
Value: "",
Type: license.Declared,
FullText: fullText,
Contents: fullText,
},
},
}
Expand Down