diff --git a/examples/photon.spdx.json b/examples/photon.spdx.json new file mode 100644 index 0000000..57f0ffe --- /dev/null +++ b/examples/photon.spdx.json @@ -0,0 +1 @@ +{"SPDXID": "SPDXRef-DOCUMENT", "spdxVersion": "SPDX-2.2", "creationInfo": {"created": "2023-01-12T22:06:03Z", "creators": ["Tool: tern-b8e13d1780cd3a02204226bba3d0772d95da24a0"], "licenseListVersion": "3.19"}, "name": "Tern report for photon", "dataLicense": "CC0-1.0", "comment": "This document was generated by the Tern Project: https://github.com/tern-tools/tern", "documentNamespace": "https://spdx.org/spdxdocs/tern-report-b8e13d1780cd3a02204226bba3d0772d95da24a0-photon-21d2cd0a-064e-4198-8bf9-99882f2897aa", "documentDescribes": ["SPDXRef-photon-3.0"], "packages": [{"name": "photon", "SPDXID": "SPDXRef-photon-3.0", "versionInfo": "3.0", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "NOASSERTION", "copyrightText": "NOASSERTION"}, {"name": "ad1f1c6f4fef6e6208ebc53e701bf9937f4e05dce5f601b20c35d8a0ad7fdeff", "SPDXID": "SPDXRef-c8a2baeeb2", "packageFileName": "ad1f1c6f4fef6e6208ebc53e701bf9937f4e05dce5f601b20c35d8a0ad7fdeff", "downloadLocation": "NONE", "filesAnalyzed": false, "checksums": [{"algorithm": "SHA256", "checksumValue": "c8a2baeeb2639816d78c44738c72246632d712195c634ce53e80fb5cbc0a50c8"}], "licenseConcluded": "NOASSERTION", "licenseDeclared": "NOASSERTION", "copyrightText": "NOASSERTION", "comment": "Layer 1:\n\tinfo: Layer created by commands: /bin/sh -c #(nop) ADD file:03f8ed1169e4d338a7b5f3f94b3e25379a063f3718bb062533efa2ce61a21d35 in / \n\tinfo: Found 'VMware Photon OS/Linux' in /etc/os-release.\n\tinfo: Retrieved package metadata using tdnf default method. \n\n"}, {"name": "bash", "SPDXID": "SPDXRef-bash-4.4.18-4.ph3", "versionInfo": "4.4.18-4.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-92fe666", "copyrightText": "NONE", "comment": "bash:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "bzip2-libs", "SPDXID": "SPDXRef-bzip2-libs-1.0.8-2.ph3", "versionInfo": "1.0.8-2.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-f266d93", "copyrightText": "NONE", "comment": "bzip2-libs:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "ca-certificates", "SPDXID": "SPDXRef-ca-certificates-20190521-3.ph3", "versionInfo": "20190521-3.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-e06627e", "copyrightText": "NONE", "comment": "ca-certificates:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "ca-certificates-pki", "SPDXID": "SPDXRef-ca-certificates-pki-20190521-3.ph3", "versionInfo": "20190521-3.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-e06627e", "copyrightText": "NONE", "comment": "ca-certificates-pki:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "curl", "SPDXID": "SPDXRef-curl-7.86.0-3.ph3", "versionInfo": "7.86.0-3.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "MIT", "copyrightText": "NONE", "comment": "curl:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "curl-libs", "SPDXID": "SPDXRef-curl-libs-7.86.0-3.ph3", "versionInfo": "7.86.0-3.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "MIT", "copyrightText": "NONE", "comment": "curl-libs:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "e2fsprogs-libs", "SPDXID": "SPDXRef-e2fsprogs-libs-1.45.5-3.ph3", "versionInfo": "1.45.5-3.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-1e11d9a", "copyrightText": "NONE", "comment": "e2fsprogs-libs:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "elfutils-libelf", "SPDXID": "SPDXRef-elfutils-libelf-0.176-1.ph3", "versionInfo": "0.176-1.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-bba2b1d", "copyrightText": "NONE", "comment": "elfutils-libelf:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "expat", "SPDXID": "SPDXRef-expat-2.2.9-11.ph3", "versionInfo": "2.2.9-11.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "MIT", "copyrightText": "NONE", "comment": "expat:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "expat-libs", "SPDXID": "SPDXRef-expat-libs-2.2.9-11.ph3", "versionInfo": "2.2.9-11.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "MIT", "copyrightText": "NONE", "comment": "expat-libs:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "filesystem", "SPDXID": "SPDXRef-filesystem-1.1-4.ph3", "versionInfo": "1.1-4.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-92fe666", "copyrightText": "NONE", "comment": "filesystem:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "glibc", "SPDXID": "SPDXRef-glibc-2.28-22.ph3", "versionInfo": "2.28-22.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-0a9356a", "copyrightText": "NONE", "comment": "glibc:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "krb5", "SPDXID": "SPDXRef-krb5-1.17-2.ph3", "versionInfo": "1.17-2.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "MIT", "copyrightText": "NONE", "comment": "krb5:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "libcap", "SPDXID": "SPDXRef-libcap-2.25-8.ph3", "versionInfo": "2.25-8.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-1e11d9a", "copyrightText": "NONE", "comment": "libcap:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "libdb", "SPDXID": "SPDXRef-libdb-5.3.28-2.ph3", "versionInfo": "5.3.28-2.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-88cb263", "copyrightText": "NONE", "comment": "libdb:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "libgcc", "SPDXID": "SPDXRef-libgcc-7.3.0-5.ph3", "versionInfo": "7.3.0-5.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-1e11d9a", "copyrightText": "NONE", "comment": "libgcc:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "libmetalink", "SPDXID": "SPDXRef-libmetalink-0.1.3-2.ph3", "versionInfo": "0.1.3-2.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "MIT", "copyrightText": "NONE", "comment": "libmetalink:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "libsolv", "SPDXID": "SPDXRef-libsolv-0.6.35-8.ph3", "versionInfo": "0.6.35-8.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-f266d93", "copyrightText": "NONE", "comment": "libsolv:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "libssh2", "SPDXID": "SPDXRef-libssh2-1.9.0-2.ph3", "versionInfo": "1.9.0-2.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-f266d93", "copyrightText": "NONE", "comment": "libssh2:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "lua", "SPDXID": "SPDXRef-lua-5.3.5-4.ph3", "versionInfo": "5.3.5-4.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "MIT", "copyrightText": "NONE", "comment": "lua:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "ncurses-libs", "SPDXID": "SPDXRef-ncurses-libs-6.1-5.ph3", "versionInfo": "6.1-5.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "MIT", "copyrightText": "NONE", "comment": "ncurses-libs:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "nspr", "SPDXID": "SPDXRef-nspr-4.21-1.ph3", "versionInfo": "4.21-1.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-4afa27a", "copyrightText": "NONE", "comment": "nspr:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "nss-libs", "SPDXID": "SPDXRef-nss-libs-3.44-8.ph3", "versionInfo": "3.44-8.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-4afa27a", "copyrightText": "NONE", "comment": "nss-libs:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "openssl", "SPDXID": "SPDXRef-openssl-1.0.2ze-3.ph3", "versionInfo": "1.0.2ze-3.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "OpenSSL", "copyrightText": "NONE", "comment": "openssl:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "photon-release", "SPDXID": "SPDXRef-photon-release-3.0-6.ph3", "versionInfo": "3.0-6.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-f124779", "copyrightText": "NONE", "comment": "photon-release:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "photon-repos", "SPDXID": "SPDXRef-photon-repos-3.0-8.ph3", "versionInfo": "3.0-8.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-f124779", "copyrightText": "NONE", "comment": "photon-repos:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "popt", "SPDXID": "SPDXRef-popt-1.16-5.ph3", "versionInfo": "1.16-5.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "MIT", "copyrightText": "NONE", "comment": "popt:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "readline", "SPDXID": "SPDXRef-readline-7.0-2.ph3", "versionInfo": "7.0-2.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-d953b10", "copyrightText": "NONE", "comment": "readline:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "rpm-libs", "SPDXID": "SPDXRef-rpm-libs-4.14.3-6.ph3", "versionInfo": "4.14.3-6.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-1e11d9a", "copyrightText": "NONE", "comment": "rpm-libs:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "sqlite-libs", "SPDXID": "SPDXRef-sqlite-libs-3.35.5-1.ph3", "versionInfo": "3.35.5-1.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-116ca55", "copyrightText": "NONE", "comment": "sqlite-libs:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "tdnf", "SPDXID": "SPDXRef-tdnf-3.1.10-1.ph3", "versionInfo": "3.1.10-1.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-b5ef29a", "copyrightText": "NONE", "comment": "tdnf:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "tdnf-cli-libs", "SPDXID": "SPDXRef-tdnf-cli-libs-3.1.10-1.ph3", "versionInfo": "3.1.10-1.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-b5ef29a", "copyrightText": "NONE", "comment": "tdnf-cli-libs:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "toybox", "SPDXID": "SPDXRef-toybox-0.8.6-2.ph3", "versionInfo": "0.8.6-2.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-f266d93", "copyrightText": "NONE", "comment": "toybox:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "xz-libs", "SPDXID": "SPDXRef-xz-libs-5.2.4-2.ph3", "versionInfo": "5.2.4-2.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-bd8fbda", "copyrightText": "NONE", "comment": "xz-libs:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "zlib", "SPDXID": "SPDXRef-zlib-1.2.11-3.ph3", "versionInfo": "1.2.11-3.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "zlib", "copyrightText": "NONE", "comment": "zlib:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "zstd-libs", "SPDXID": "SPDXRef-zstd-libs-1.4.5-2.ph3", "versionInfo": "1.4.5-2.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-d935702", "copyrightText": "NONE", "comment": "zstd-libs:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}], "relationships": [{"spdxElementId": "SPDXRef-DOCUMENT", "relatedSpdxElement": "SPDXRef-photon-3.0", "relationshipType": "DESCRIBES"}, {"spdxElementId": "SPDXRef-photon-3.0", "relatedSpdxElement": "SPDXRef-c8a2baeeb2", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-bash-4.4.18-4.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-bzip2-libs-1.0.8-2.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-ca-certificates-20190521-3.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-ca-certificates-pki-20190521-3.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-curl-7.86.0-3.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-curl-libs-7.86.0-3.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-e2fsprogs-libs-1.45.5-3.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-elfutils-libelf-0.176-1.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-expat-2.2.9-11.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-expat-libs-2.2.9-11.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-filesystem-1.1-4.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-glibc-2.28-22.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-krb5-1.17-2.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-libcap-2.25-8.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-libdb-5.3.28-2.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-libgcc-7.3.0-5.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-libmetalink-0.1.3-2.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-libsolv-0.6.35-8.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-libssh2-1.9.0-2.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-lua-5.3.5-4.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-ncurses-libs-6.1-5.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-nspr-4.21-1.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-nss-libs-3.44-8.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-openssl-1.0.2ze-3.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-photon-release-3.0-6.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-photon-repos-3.0-8.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-popt-1.16-5.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-readline-7.0-2.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-rpm-libs-4.14.3-6.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-sqlite-libs-3.35.5-1.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-tdnf-3.1.10-1.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-tdnf-cli-libs-3.1.10-1.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-toybox-0.8.6-2.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-xz-libs-5.2.4-2.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-zlib-1.2.11-3.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-zstd-libs-1.4.5-2.ph3", "relationshipType": "CONTAINS"}], "hasExtractedLicensingInfos": [{"extractedText": "BSD and GPLv2", "licenseId": "LicenseRef-d935702"}, {"extractedText": "MPLv2.0", "licenseId": "LicenseRef-4afa27a"}, {"extractedText": "GPLv3", "licenseId": "LicenseRef-92fe666"}, {"extractedText": "GPLv2+", "licenseId": "LicenseRef-1e11d9a"}, {"extractedText": "BSD", "licenseId": "LicenseRef-f266d93"}, {"extractedText": "GPLv2+ or LGPLv3+", "licenseId": "LicenseRef-bba2b1d"}, {"extractedText": "LGPLv2.1,GPLv2", "licenseId": "LicenseRef-b5ef29a"}, {"extractedText": "LGPLv2+", "licenseId": "LicenseRef-0a9356a"}, {"extractedText": "Apache License", "licenseId": "LicenseRef-f124779"}, {"extractedText": "Public Domain", "licenseId": "LicenseRef-116ca55"}, {"extractedText": "Custom", "licenseId": "LicenseRef-e06627e"}, {"extractedText": "GPLv2+ and GPLv3+ and LGPLv2+", "licenseId": "LicenseRef-bd8fbda"}, {"extractedText": "GPLv3+", "licenseId": "LicenseRef-d953b10"}, {"extractedText": "BSD and LGPLv2 and Sleepycat", "licenseId": "LicenseRef-88cb263"}]} \ No newline at end of file diff --git a/go.mod b/go.mod index 2308c31..00ca8a6 100644 --- a/go.mod +++ b/go.mod @@ -8,6 +8,7 @@ require ( github.com/davecgh/go-spew v1.1.1 // indirect github.com/inconshreveable/mousetrap v1.0.1 // indirect github.com/pmezard/go-difflib v1.0.0 // indirect + github.com/spdx/gordf v0.0.0-20201111095634-7098f93598fb // indirect github.com/spf13/pflag v1.0.5 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect ) diff --git a/go.sum b/go.sum index d0cc155..291c309 100644 --- a/go.sum +++ b/go.sum @@ -12,6 +12,7 @@ github.com/inconshreveable/mousetrap v1.0.1/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLf github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= +github.com/spdx/gordf v0.0.0-20201111095634-7098f93598fb h1:bLo8hvc8XFm9J47r690TUKBzcjSWdJDxmjXJZ+/f92U= github.com/spdx/gordf v0.0.0-20201111095634-7098f93598fb/go.mod h1:uKWaldnbMnjsSAXRurWqqrdyZen1R7kxl8TkmWk2OyM= github.com/spdx/tools-golang v0.3.1-0.20221108182156-8a01147e6342 h1:6uvaOTv4GeRqQV6O1/znbpziqhctMRLTy3OGeZrNMic= github.com/spdx/tools-golang v0.3.1-0.20221108182156-8a01147e6342/go.mod h1:VHzvNsKAfAGqs4ZvwRL+7a0dNsL20s7lGui4K9C0xQM= diff --git a/pkg/spdx/spdx_report.go b/pkg/spdx/spdx_report.go index ab599bc..4ba2c5b 100644 --- a/pkg/spdx/spdx_report.go +++ b/pkg/spdx/spdx_report.go @@ -79,7 +79,7 @@ func (r *SpdxReport) PackageVersions() scorecard.ReportValue { } } return scorecard.ReportValue{ - Ratio: float32(r.hasPackVer / r.totalPackages), + Ratio: float32(r.hasPackVer) / float32(r.totalPackages), } } @@ -91,7 +91,7 @@ func (r *SpdxReport) PackageLicenses() scorecard.ReportValue { } } return scorecard.ReportValue{ - Ratio: float32(r.hasLicense / r.totalPackages), + Ratio: float32(r.hasLicense) / float32(r.totalPackages), } } diff --git a/pkg/spdx/spdx_report_test.go b/pkg/spdx/spdx_report_test.go index 85c2d09..ecf3fde 100644 --- a/pkg/spdx/spdx_report_test.go +++ b/pkg/spdx/spdx_report_test.go @@ -7,11 +7,11 @@ import ( "github.com/ebay/sbom-scorecard/pkg/scorecard" ) -func TestSpdxE2eReport(t *testing.T) { - r := GetSpdxReport("../../examples/julia.spdx.json") - report_text := r.Report() - - if strings.Trim(report_text, " \n") != `34 total packages +var report_tests = []struct { + path string + expected string +}{ + {"../../examples/julia.spdx.json", `34 total packages 0 total files 100% have licenses. 0% have package digest. @@ -20,25 +20,55 @@ func TestSpdxE2eReport(t *testing.T) { 0% have CPEs. 0% have file digest. Spec valid? true -Has creation info? false` { - t.Log("Incorrect report results generated.\n" + - "Got this: \n" + report_text) - t.Fail() - } +Has creation info? false`}, + {"../../examples/photon.spdx.json", `38 total packages +0 total files +94% have licenses. +2% have package digest. +97% have package versions. +0% have purls. +0% have CPEs. +0% have file digest. +Spec valid? true +Has creation info? true`}, } -func TestSpdxE2eGrade(t *testing.T) { - r := GetSpdxReport("../../examples/julia.spdx.json") - report_text := scorecard.Grade(r) +func TestSpdxE2eReport(t *testing.T) { + for _, e := range report_tests { + res := GetSpdxReport(e.path) + report_text := res.Report() + if strings.Trim(report_text, " \n") != e.expected { + t.Errorf("GetSpdxReport(%v) = %v, expected %v", + e.path, strings.Trim(report_text, " \n"), e.expected) + } + } +} - if strings.Trim(report_text, " \n") != `Spec Compliance: 25/25 +var grade_tests = []struct { + path string + expected string +}{ + {"../../examples/julia.spdx.json", `Spec Compliance: 25/25 Package ID: 0/20 (0% have purls and 0% have CPEs) Package Versions: 0/20 Package Licenses: 20/20 Creation Info: 0/15 (No tool was used to create the sbom) -Total points: 45/100 or 45%` { - t.Log("Incorrect report results generated.\n" + - "Got this: \n" + report_text) - t.Fail() +Total points: 45/100 or 45%`}, + {"../../examples/photon.spdx.json", `Spec Compliance: 25/25 +Package ID: 0/20 (0% have purls and 0% have CPEs) +Package Versions: 19/20 +Package Licenses: 18/20 +Creation Info: 15/15 +Total points: 78/100 or 78%`}, +} + +func TestSpdxE2eGrade(t *testing.T) { + for _, e := range grade_tests { + res := GetSpdxReport(e.path) + report_text := scorecard.Grade(res) + if strings.Trim(report_text, " \n") != e.expected { + t.Errorf("GetSpdxReport(%v) = %v, expected %v", + e.path, strings.Trim(report_text, " \n"), e.expected) + } } }