Skip to content

Commit 33b9d8e

Browse files
DmitriyLewenDmitriyLewen
authored
fix(sbom): add NOASSERTION for licenseDeclared/licenseConcluded in SPDX non-library packages (aquasecurity#10368)
1 parent e5da6de commit 33b9d8e

4 files changed

Lines changed: 56 additions & 13 deletions

File tree

‎integration/testdata/conda-spdx.json.golden‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,8 @@
7575
"SPDXID": "SPDXRef-Filesystem-2e2426fd0f2580ef",
7676
"downloadLocation": "NONE",
7777
"filesAnalyzed": false,
78+
"licenseConcluded": "NOASSERTION",
79+
"licenseDeclared": "NOASSERTION",
7880
"primaryPackagePurpose": "SOURCE",
7981
"annotations": [
8082
{

‎integration/testdata/julia-spdx.json.golden‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,8 @@
1717
"SPDXID": "SPDXRef-Application-c39d15beb6bdf085",
1818
"downloadLocation": "NONE",
1919
"filesAnalyzed": false,
20+
"licenseConcluded": "NOASSERTION",
21+
"licenseDeclared": "NOASSERTION",
2022
"primaryPackagePurpose": "APPLICATION",
2123
"annotations": [
2224
{
@@ -137,6 +139,8 @@
137139
"SPDXID": "SPDXRef-Filesystem-1be792dd0077c431",
138140
"downloadLocation": "NONE",
139141
"filesAnalyzed": false,
142+
"licenseConcluded": "NOASSERTION",
143+
"licenseDeclared": "NOASSERTION",
140144
"primaryPackagePurpose": "SOURCE",
141145
"annotations": [
142146
{

‎pkg/sbom/spdx/marshal.go‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -277,9 +277,12 @@ func (m *Marshaler) rootSPDXPackage(root *core.Component, timeNow, pkgDownloadLo
277277
}
278278

279279
return &spdx.Package{
280-
PackageName: root.Name,
281-
PackageSPDXIdentifier: elementID(camelCase(string(root.Type)), pkgID),
282-
PackageDownloadLocation: pkgDownloadLocation,
280+
PackageName: root.Name,
281+
PackageSPDXIdentifier: elementID(camelCase(string(root.Type)), pkgID),
282+
PackageDownloadLocation: pkgDownloadLocation,
283+
// Licenses are only available for library packages, not for root packages.
284+
PackageLicenseConcluded: noAssertionField,
285+
PackageLicenseDeclared: noAssertionField,
283286
Annotations: m.spdxAnnotations(root, timeNow),
284287
PackageExternalReferences: externalReferences,
285288
PrimaryPackagePurpose: pkgPurpose,
@@ -405,7 +408,7 @@ func (m *Marshaler) spdxAnnotations(c *core.Component, timeNow string) []spdx.An
405408
func (m *Marshaler) spdxLicense(c *core.Component) (string, []*spdx.OtherLicense) {
406409
// Only library components contain licenses
407410
if c.Type != core.TypeLibrary {
408-
return "", nil
411+
return noAssertionField, nil
409412
}
410413
if len(c.Licenses) == 0 {
411414
return noAssertionField, nil

‎pkg/sbom/spdx/marshal_test.go‎

Lines changed: 43 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -189,6 +189,8 @@ func TestMarshaler_Marshal(t *testing.T) {
189189
PackageDownloadLocation: "NONE",
190190
PackageName: "app/Gemfile.lock",
191191
PrimaryPackagePurpose: tspdx.PackagePurposeApplication,
192+
PackageLicenseConcluded: "NOASSERTION",
193+
PackageLicenseDeclared: "NOASSERTION",
192194
Annotations: []spdx.Annotation{
193195
annotation(t, "Class: lang-pkgs"),
194196
annotation(t, "Type: bundler"),
@@ -199,6 +201,8 @@ func TestMarshaler_Marshal(t *testing.T) {
199201
PackageDownloadLocation: "NONE",
200202
PackageName: "app/subproject/Gemfile.lock",
201203
PrimaryPackagePurpose: tspdx.PackagePurposeApplication,
204+
PackageLicenseConcluded: "NOASSERTION",
205+
PackageLicenseDeclared: "NOASSERTION",
202206
Annotations: []spdx.Annotation{
203207
annotation(t, "Class: lang-pkgs"),
204208
annotation(t, "Type: bundler"),
@@ -224,7 +228,9 @@ func TestMarshaler_Marshal(t *testing.T) {
224228
annotation(t, "SchemaVersion: 2"),
225229
annotation(t, "Size: 1024"),
226230
},
227-
PrimaryPackagePurpose: tspdx.PackagePurposeContainer,
231+
PrimaryPackagePurpose: tspdx.PackagePurposeContainer,
232+
PackageLicenseConcluded: "NOASSERTION",
233+
PackageLicenseDeclared: "NOASSERTION",
228234
},
229235
{
230236
PackageSPDXIdentifier: spdx.ElementID("Package-b8d4663e6d412e7"),
@@ -325,6 +331,8 @@ func TestMarshaler_Marshal(t *testing.T) {
325331
PackageName: "centos",
326332
PackageVersion: "8.3.2011",
327333
PrimaryPackagePurpose: tspdx.PackagePurposeOS,
334+
PackageLicenseConcluded: "NOASSERTION",
335+
PackageLicenseDeclared: "NOASSERTION",
328336
Annotations: []spdx.Annotation{
329337
annotation(t, "Class: os-pkgs"),
330338
annotation(t, "Type: centos"),
@@ -516,7 +524,9 @@ func TestMarshaler_Marshal(t *testing.T) {
516524
annotation(t, "SchemaVersion: 2"),
517525
annotation(t, "Size: 1024"),
518526
},
519-
PrimaryPackagePurpose: tspdx.PackagePurposeContainer,
527+
PrimaryPackagePurpose: tspdx.PackagePurposeContainer,
528+
PackageLicenseConcluded: "NOASSERTION",
529+
PackageLicenseDeclared: "NOASSERTION",
520530
},
521531
{
522532
PackageSPDXIdentifier: spdx.ElementID("Package-40c4059fe08523bf"),
@@ -601,6 +611,8 @@ func TestMarshaler_Marshal(t *testing.T) {
601611
PackageName: "centos",
602612
PackageVersion: "8.3.2011",
603613
PrimaryPackagePurpose: tspdx.PackagePurposeOS,
614+
PackageLicenseConcluded: "NOASSERTION",
615+
PackageLicenseDeclared: "NOASSERTION",
604616
Annotations: []spdx.Annotation{
605617
annotation(t, "Class: os-pkgs"),
606618
annotation(t, "Type: centos"),
@@ -744,6 +756,8 @@ func TestMarshaler_Marshal(t *testing.T) {
744756
PackageDownloadLocation: "NONE",
745757
PackageName: "Gemfile.lock",
746758
PrimaryPackagePurpose: tspdx.PackagePurposeApplication,
759+
PackageLicenseConcluded: "NOASSERTION",
760+
PackageLicenseDeclared: "NOASSERTION",
747761
Annotations: []spdx.Annotation{
748762
annotation(t, "Class: lang-pkgs"),
749763
annotation(t, "Type: bundler"),
@@ -754,6 +768,8 @@ func TestMarshaler_Marshal(t *testing.T) {
754768
PackageDownloadLocation: "NONE",
755769
PackageName: "pom.xml",
756770
PrimaryPackagePurpose: tspdx.PackagePurposeApplication,
771+
PackageLicenseConcluded: "NOASSERTION",
772+
PackageLicenseDeclared: "NOASSERTION",
757773
Annotations: []spdx.Annotation{
758774
annotation(t, "Class: lang-pkgs"),
759775
annotation(t, "Type: pom"),
@@ -809,7 +825,9 @@ func TestMarshaler_Marshal(t *testing.T) {
809825
Annotations: []spdx.Annotation{
810826
annotation(t, "SchemaVersion: 2"),
811827
},
812-
PrimaryPackagePurpose: tspdx.PackagePurposeSource,
828+
PrimaryPackagePurpose: tspdx.PackagePurposeSource,
829+
PackageLicenseConcluded: "NOASSERTION",
830+
PackageLicenseDeclared: "NOASSERTION",
813831
},
814832
},
815833
Relationships: []*spdx.Relationship{
@@ -903,6 +921,8 @@ func TestMarshaler_Marshal(t *testing.T) {
903921
PackageDownloadLocation: "NONE",
904922
PackageName: "pom.xml",
905923
PrimaryPackagePurpose: tspdx.PackagePurposeApplication,
924+
PackageLicenseConcluded: "NOASSERTION",
925+
PackageLicenseDeclared: "NOASSERTION",
906926
Annotations: []spdx.Annotation{
907927
annotation(t, "Class: lang-pkgs"),
908928
annotation(t, "Type: pom"),
@@ -937,7 +957,9 @@ func TestMarshaler_Marshal(t *testing.T) {
937957
Annotations: []spdx.Annotation{
938958
annotation(t, "SchemaVersion: 2"),
939959
},
940-
PrimaryPackagePurpose: tspdx.PackagePurposeSource,
960+
PrimaryPackagePurpose: tspdx.PackagePurposeSource,
961+
PackageLicenseConcluded: "NOASSERTION",
962+
PackageLicenseDeclared: "NOASSERTION",
941963
},
942964
},
943965
Relationships: []*spdx.Relationship{
@@ -1072,7 +1094,9 @@ func TestMarshaler_Marshal(t *testing.T) {
10721094
Annotations: []spdx.Annotation{
10731095
annotation(t, "SchemaVersion: 2"),
10741096
},
1075-
PrimaryPackagePurpose: tspdx.PackagePurposeSource,
1097+
PrimaryPackagePurpose: tspdx.PackagePurposeSource,
1098+
PackageLicenseConcluded: "NOASSERTION",
1099+
PackageLicenseDeclared: "NOASSERTION",
10761100
},
10771101
},
10781102
Relationships: []*spdx.Relationship{
@@ -1174,7 +1198,9 @@ func TestMarshaler_Marshal(t *testing.T) {
11741198
Annotations: []spdx.Annotation{
11751199
annotation(t, "SchemaVersion: 2"),
11761200
},
1177-
PrimaryPackagePurpose: tspdx.PackagePurposeSource,
1201+
PrimaryPackagePurpose: tspdx.PackagePurposeSource,
1202+
PackageLicenseConcluded: "NOASSERTION",
1203+
PackageLicenseDeclared: "NOASSERTION",
11781204
},
11791205
},
11801206
Files: []*spdx.File{
@@ -1244,7 +1270,9 @@ func TestMarshaler_Marshal(t *testing.T) {
12441270
Annotations: []spdx.Annotation{
12451271
annotation(t, "SchemaVersion: 2"),
12461272
},
1247-
PrimaryPackagePurpose: tspdx.PackagePurposeSource,
1273+
PrimaryPackagePurpose: tspdx.PackagePurposeSource,
1274+
PackageLicenseConcluded: "NOASSERTION",
1275+
PackageLicenseDeclared: "NOASSERTION",
12481276
},
12491277
},
12501278
Relationships: []*spdx.Relationship{
@@ -1306,7 +1334,9 @@ func TestMarshaler_Marshal(t *testing.T) {
13061334
Annotations: []spdx.Annotation{
13071335
annotation(t, "SchemaVersion: 2"),
13081336
},
1309-
PrimaryPackagePurpose: tspdx.PackagePurposeSource,
1337+
PrimaryPackagePurpose: tspdx.PackagePurposeSource,
1338+
PackageLicenseConcluded: "NOASSERTION",
1339+
PackageLicenseDeclared: "NOASSERTION",
13101340
},
13111341
},
13121342
Relationships: []*spdx.Relationship{
@@ -1376,6 +1406,8 @@ func TestMarshaler_Marshal(t *testing.T) {
13761406
PackageDownloadLocation: "NONE",
13771407
PackageName: "/usr/local/bin/test",
13781408
PrimaryPackagePurpose: tspdx.PackagePurposeApplication,
1409+
PackageLicenseConcluded: "NOASSERTION",
1410+
PackageLicenseDeclared: "NOASSERTION",
13791411
Annotations: []spdx.Annotation{
13801412
annotation(t, "Class: lang-pkgs"),
13811413
annotation(t, "Type: gobinary"),
@@ -1422,7 +1454,9 @@ func TestMarshaler_Marshal(t *testing.T) {
14221454
Annotations: []spdx.Annotation{
14231455
annotation(t, "SchemaVersion: 2"),
14241456
},
1425-
PrimaryPackagePurpose: tspdx.PackagePurposeSource,
1457+
PrimaryPackagePurpose: tspdx.PackagePurposeSource,
1458+
PackageLicenseConcluded: "NOASSERTION",
1459+
PackageLicenseDeclared: "NOASSERTION",
14261460
},
14271461
},
14281462
Relationships: []*spdx.Relationship{

0 commit comments

Comments
 (0)