-
Notifications
You must be signed in to change notification settings - Fork 6
Open
Description
Problem
When creating a tree output from a blackduck project with Golang components, the tree output does generate github and generic packages.
Package-url spec
https://github.com/package-url/purl-spec/blob/master/PURL-TYPES.rst#golang
Both tree and spdx outputs are wrong
tree output
Command
spdx-builder blackduck --tree project version
Example part of the tree output
TREE start ----------8<----------
pkg:generic/project@version
pkg:github/golang/mock@v1.4.4 [dynamic]
pkg:github/google/uuid@v1.1.2 [dynamic]
pkg:github/kubernetes-sigs/controller-runtime@v0.6.1 [dynamic]
pkg:generic/spf13-afero@v1.2.2 [dynamic]
pkg:generic/uber-go%2Fatomic@v1.4.0 [dynamic]
pkg:github/beorn7/perks@v1.0.1 [dynamic]
...
Expected tree output
TREE start ----------8<----------
pkg:golang/project@versoin
pkg:golang/github.com/golang/mock@v1.4.4 [dynamic]
pkg:golang/github.com/google/uuid@v1.1.2 [dynamic]
pkg:golang/github.com/kubernetes-sigs/controller-runtime@v0.6.1 [dynamic]
pkg:golang/google.golang.org/spf13-afero@v1.2.2 [dynamic]
pkg:golang/google.golang.org/uber-go%2Fatomic@v1.4.0 [dynamic]
pkg:golang/google.golang.org/beorn7/perks@v1.0.1 [dynamic]
...
spdx output
Command
spdx-builder blackduck -o output.spdx project version
Example part of the spdx output
## Start of package pkg:github/golang/mock@v1.4.4
PackageName: golang/mock
SPDXID: SPDXRef-7
PackageVersion: v1.4.4
PackageSummary: golang-mock
PackageDescription: GoMock is a mocking framework for the Go programming language.
PackageHomePage: https://github.com/golang/mock
ExternalRef: PACKAGE-MANAGER purl pkg:github/golang/mock@v1.4.4
PackageDownloadLocation: NOASSERTION
PackageLicenseConcluded: Apache-2.0
PackageLicenseDeclared: NOASSERTION
FilesAnalyzed: false
PackageCopyrightText: NOASSERTION
...
Expected spdx output
## Start of package pkg:golang/github.com/golang/mock@v1.4.4
PackageName: golang/mock
SPDXID: SPDXRef-7
PackageVersion: v1.4.4
PackageSummary: golang-mock
PackageDescription: GoMock is a mocking framework for the Go programming language.
PackageHomePage: https://github.com/golang/mock
ExternalRef: PACKAGE-MANAGER purl pkg:golang/github.com/golang/mock@v1.4.4
PackageDownloadLocation: NOASSERTION
PackageLicenseConcluded: Apache-2.0
PackageLicenseDeclared: NOASSERTION
FilesAnalyzed: false
PackageCopyrightText: NOASSERTION
...
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels