[pull] master from erlang:master

[pull]

See Commits and Changes for more details.

---

Created by pull[bot] (v2.0.0-alpha.1)

Can you help keep this open source service alive? 💖 Please sponsor : )

[sourcery-ai]

Reviewer's Guide by Sourcery

This pull request introduces an escript for generating and testing SPDX SBOMs, updates the sofs module to improve documentation and fix minor issues, removes redundant code and improves DNS lookup configuration, and adds a license header to crypto_ec_curves.erl.

Sequence diagram for SBOM generation and verification

sequenceDiagram
    participant GH as GitHub Actions
    participant ORT as OSS Review Toolkit
    participant OTP as otp-compliance.es

    GH->>ORT: Runs ORT analyzer
    activate ORT
    ORT-->>GH: Analyzer result
    deactivate ORT
    GH->>ORT: Runs ORT scanner
    activate ORT
    ORT-->>GH: Scanner result
    deactivate ORT
    GH->>OTP: Executes otp-compliance.es sbom otp-info
    activate OTP
    OTP-->>GH: Fixed SBOM
    deactivate OTP
    GH->>OTP: Executes otp-compliance.es sbom test-file
    activate OTP
    OTP-->>GH: SBOM verification result
    deactivate OTP

Loading

Entity Relationship Diagram for vendor.info

erDiagram
    vendor_info {
        string ID PK
        string description
        string copyrightText
        string downloadLocation
        string homepage
        string licenseDeclared
        string name
        string versionInfo
        string path
        string supplier
    }
    note for vendor_info "Represents metadata for a vendor dependency."

Loading

Updated class diagram for spdx_package record

classDiagram
    class spdx_package {
        -SPDXID
        -versionInfo
        -description
        -name
        -copyrightText
        -filesAnalyzed
        -hasFiles
        -homepage
        -licenseConcluded
        -licenseDeclared
        -licenseInfoFromFiles
        -downloadLocation
        -packageVerificationCode
        -supplier
        -relationships
    }
    note for spdx_package "Represents an SPDX package with detailed metadata."

Loading

Class diagram for app_info record

classDiagram
    class app_info {
        -description
        -id
        -vsn
        -modules
        -applications
        -included_applications
        -optional_applications
    }
    note for app_info "Represents information about an Erlang application."

Loading

File-Level Changes

Change	Details	Files
Introduces a new escript, otp-compliance.es, for generating and testing SPDX SBOMs, enhancing license and copyright compliance.	Adds commands for generating, fixing, and testing SPDX SBOMs. Improves SBOM data with license and copyright information from scan results. Splits SPDX by app and adds vendor dependencies. Includes functions for generating SPDX mappings, packages, and vendor packages. Adds functions for creating relationships between OTP and vendor packages. Introduces test functions for verifying the generated SBOM. Adds functions for extracting license information and handling snippets. Updates the OTP compliance script to improve SPDX generation and testing. Adds a new github action to verify the SBOM.	.github/scripts/otp-compliance.es .github/workflows/main.yaml .ort.yml erts/emulator/ryu/d2s.c lib/stdlib/test/sofs_SUITE.erl scripts/scan-code.escript lib/wx/src/wx.erl HOWTO/SBOM.md erts/autoconf/vendor.info erts/emulator/asmjit/vendor.info erts/emulator/beam/vendor.info erts/emulator/openssl/vendor.info erts/emulator/pcre/vendor.info erts/emulator/ryu/vendor.info erts/emulator/zlib/vendor.info erts/emulator/zstd/vendor.info lib/common_test/priv/vendor.info lib/common_test/test_server/vendor.info lib/erl_interface/src/openssl/vendor.info lib/stdlib/test/json_SUITE_data/vendor.info lib/wx/vendor.info make/autoconf/vendor.info
Updates the sofs module to improve documentation and fix minor issues.	Adds documentation to functions. Fixes types in documentation. Adds examples to functions. Fixes minor issues.	lib/stdlib/src/sofs.erl lib/stdlib/doc/src/sofs.md
Removes redundant code and improves DNS lookup configuration.	Removes redundant code in inet_config.erl. Improves DNS lookup configuration.	lib/kernel/src/inet_config.erl
Adds a license header to crypto_ec_curves.erl.	Adds a license header to crypto_ec_curves.erl.	lib/crypto/src/crypto_ec_curves.erl

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!
• Generate a plan of action for an issue: Comment @sourcery-ai plan on
  an issue to generate a plan of action for it.

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.