Skip to content

Commit c3b4290

Browse files
giterlizzigiterlizzi
committed
Fixes and improvements
- Fix mapping of "perl_5" license with SPDX expression "Artistic-1.0-Perl OR GPL-1.0-or-later" (#3) - Improved "SBOM::CycloneDX::License" behavior - Improved mapping of CPAN::Meta licenses to SPDX - Added support for SPDX "NOASSERTION" and "NONE" licenses: https://spdx.github.io/spdx-spec/v3.0.1/model/ExpandedLicensing/Individuals/NoAssertionLicense/ https://spdx.github.io/spdx-spec/v3.0.1/model/ExpandedLicensing/Individuals/NoneLicense/
1 parent b426e68 commit c3b4290

File tree

4 files changed

+67
-37
lines changed

4 files changed

+67
-37
lines changed

‎Changes‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,13 @@ Change history for SBOM::CycloneDX
22

33
1.0? 2025-??-??
44
- Fix name in Makefile.PL (giterlizzi/perl-SBOM-CycloneDX#2)
5+
- Fix mapping of "perl_5" license with SPDX expression
6+
"Artistic-1.0-Perl OR GPL-1.0-or-later" (giterlizzi/perl-SBOM-CycloneDX#3)
7+
- Improved "SBOM::CycloneDX::License" behavior
8+
- Improved mapping of CPAN::Meta licenses to SPDX
9+
- Added support for SPDX "NOASSERTION" and "NONE" licenses:
10+
https://spdx.github.io/spdx-spec/v3.0.1/model/ExpandedLicensing/Individuals/NoAssertionLicense/
11+
https://spdx.github.io/spdx-spec/v3.0.1/model/ExpandedLicensing/Individuals/NoneLicense/
512

613
1.03 2025-03-31
714
- Improved documentation

‎lib/SBOM/CycloneDX.pm‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ use constant JSON_SCHEMA_1_4 => 'http://cyclonedx.org/schema/bom-1.4.schema.json
2929
use constant JSON_SCHEMA_1_5 => 'http://cyclonedx.org/schema/bom-1.5.schema.json';
3030
use constant JSON_SCHEMA_1_6 => 'http://cyclonedx.org/schema/bom-1.6.schema.json';
3131

32-
our $VERSION = 1.03;
32+
our $VERSION = 1.03_01;
3333

3434
our %JSON_SCHEMA = (
3535
'1.2' => JSON_SCHEMA_1_2,

‎lib/SBOM/CycloneDX/License.pm‎

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ has bom_ref => (
4040
coerce => sub { ref($_[0]) ? $_[0] : SBOM::CycloneDX::BomRef->new($_[0]) }
4141
);
4242

43-
has id => (is => 'rw', isa => Str);
43+
has id => (is => 'rw', isa => Str, trigger => 1);
4444
has name => (is => 'rw', isa => Str);
4545
has acknowledgement => (is => 'rw', isa => Enum [qw(declared concluded)]);
4646
has text => (is => 'rw', isa => InstanceOf ['SBOM::CycloneDX::Attachment']);
@@ -60,6 +60,24 @@ has properties => (
6060
);
6161

6262

63+
sub _trigger_id {
64+
65+
my ($self) = @_;
66+
67+
if ($self->id && $self->id =~ /(WITH|AND|OR)/) {
68+
DEBUG and say STDERR '-- Detected SPDX expression';
69+
$self->expression($self->id);
70+
$self->{id} = undef;
71+
}
72+
73+
if ($self->id && $self->id =~ /^(NOASSERTION|NONE)$/) {
74+
DEBUG and say STDERR "-- Detected $1 license identifier (unset license identifier)";
75+
$self->{id} = undef;
76+
}
77+
78+
}
79+
80+
6381
sub _trigger_url {
6482
my ($self) = @_;
6583
$self->url('https://opensource.org/license/' . $self->id) if $self->url eq '1';

‎lib/SBOM/CycloneDX/Util.pm‎

Lines changed: 40 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -24,45 +24,50 @@ require SBOM::CycloneDX::License;
2424
require SBOM::CycloneDX::Tool;
2525

2626

27-
# CPAN::Meta::Spec | SPDX | Description
28-
# -----------------|---------------------------|--------------------------------
2927
my %CPAN_META_SPEC_LICENSE_MAPPING = (
30-
agpl_3 => 'AGPL-3.0', # GNU Affero General Public License, Version 3
31-
apache_1_1 => 'Apache-1.1', # Apache Software License, Version 1.1
32-
apache_2_0 => 'Apache-2.0', # Apache License, Version 2.0
33-
artistic_1 => 'Artistic-1.0', # Artistic License, (Version 1)
34-
artistic_2 => 'Artistic-2.0', # Artistic License, Version 2.0
35-
bsd => 'BSD-3-Clause', # BSD License (three-clause)
36-
freebsd => 'BSD-2-Clause-FreeBSD', # FreeBSD License (two-clause)
37-
gfdl_1_2 => 'GFDL-1.2', # GNU Free Documentation License, Version 1.2
38-
gfdl_1_3 => 'GFDL-1.3', # GNU Free Documentation License, Version 1.3
39-
gpl_1 => 'GPL-1.0', # GNU General Public License, Version 1
40-
gpl_2 => 'GPL-2.0', # GNU General Public License, Version 2
41-
gpl_3 => 'GPL-3.0', # GNU General Public License, Version 3
42-
lgpl_2_1 => 'LGPL-2.1', # GNU Lesser General Public License, Version 2.1
43-
lgpl_3_0 => 'LGPL-3.0', # GNU Lesser General Public License, Version 3.0
44-
mit => 'MIT', # MIT (aka X11) License
45-
mozilla_1_0 => 'MPL-1.0', # Mozilla Public License, Version 1.0
46-
mozilla_1_1 => 'MPL-1.1', # Mozilla Public License, Version 1.1
47-
openssl => 'OpenSSL', # OpenSSL License
48-
perl_5 => 'Artistic-1.0-Perl', # The Perl 5 License (Artistic 1 & GPL 1 or later)
49-
qpl_1_0 => 'QPL-1.0', # Q Public License, Version 1.0
50-
ssleay => 'SSLeay-standalone', # Original SSLeay License
51-
sun => 'SISSL', # Sun Internet Standards Source License (SISSL)
52-
zlib => 'Zlib', # zlib License
53-
);
5428

55-
# From CPAN::Meta::Spec
29+
# CPAN::Meta::Spec licenses
30+
31+
# license | SPDX | Description
32+
# -----------------|-------------------------------------------|--------------------------------
33+
34+
agpl_3 => 'AGPL-3.0', # GNU Affero General Public License, Version 3
35+
apache_1_1 => 'Apache-1.1', # Apache Software License, Version 1.1
36+
apache_2_0 => 'Apache-2.0', # Apache License, Version 2.0
37+
artistic_1 => 'Artistic-1.0', # Artistic License, (Version 1)
38+
artistic_2 => 'Artistic-2.0', # Artistic License, Version 2.0
39+
bsd => 'BSD-3-Clause', # BSD License (three-clause)
40+
freebsd => 'BSD-2-Clause-FreeBSD', # FreeBSD License (two-clause)
41+
gfdl_1_2 => 'GFDL-1.2-or-later', # GNU Free Documentation License, Version 1.2
42+
gfdl_1_3 => 'GFDL-1.3-or-later', # GNU Free Documentation License, Version 1.3
43+
gpl_1 => 'GPL-1.0-only', # GNU General Public License, Version 1
44+
gpl_2 => 'GPL-2.0-only', # GNU General Public License, Version 2
45+
gpl_3 => 'GPL-3.0-only', # GNU General Public License, Version 3
46+
lgpl_2_1 => 'LGPL-2.1', # GNU Lesser General Public License, Version 2.1
47+
lgpl_3_0 => 'LGPL-3.0', # GNU Lesser General Public License, Version 3.0
48+
mit => 'MIT', # MIT (aka X11) License
49+
mozilla_1_0 => 'MPL-1.0', # Mozilla Public License, Version 1.0
50+
mozilla_1_1 => 'MPL-1.1', # Mozilla Public License, Version 1.1
51+
openssl => 'OpenSSL', # OpenSSL License
52+
perl_5 => 'Artistic-1.0-Perl OR GPL-1.0-or-later', # The Perl 5 License (Artistic 1 & GPL 1 or later)
53+
qpl_1_0 => 'QPL-1.0', # Q Public License, Version 1.0
54+
ssleay => 'SSLeay-standalone', # Original SSLeay License
55+
sun => 'SISSL', # Sun Internet Standards Source License (SISSL)
56+
zlib => 'Zlib', # zlib License
57+
58+
59+
# Additional license (from CPAN::Meta::Spec)
5660
#
57-
# The following license strings are also valid and indicate other licensing not described above:
61+
# The following license strings are also valid and indicate other licensing not described above:
5862
#
59-
# string description
60-
# ------------- -----------------------------------------------
61-
# open_source Other Open Source Initiative (OSI) approved license
62-
# restricted Requires special permission from copyright holder
63-
# unrestricted Not an OSI approved license, but not restricted
64-
# unknown License not provided in metadata
63+
# license | SPDX | Description
64+
# -----------------|-------------------------------------------|--------------------------------
6565

66+
open_source => 'NOASSERTION', # Other Open Source Initiative (OSI) approved license
67+
restricted => 'NOASSERTION', # Requires special permission from copyright holder
68+
unrestricted => 'CC0-1.0', # Not an OSI approved license, but not restricted
69+
unknown => 'NONE', # License not provided in metadata
70+
);
6671

6772
sub urn_uuid { sprintf 'urn:uuid:%s', create_uuid_as_string(UUID_V4) }
6873
sub urn_cdx { sprintf 'urn:cdx:%s', create_uuid_as_string(UUID_V4) }
@@ -177,7 +182,7 @@ SBOM::CycloneDX::Util - Utility for CycloneDX
177182
178183
=head1 DESCRIPTION
179184
180-
L<SBOM::CycloneDX::Utility> provides a set of utility for L<SBOM::CycloneDX>.
185+
L<SBOM::CycloneDX::Util> provides a set of utility for L<SBOM::CycloneDX>.
181186
182187
=head2 FUNCTIONS
183188

0 commit comments

Comments
 (0)