8000 Detect when full license text has been provided and preserve as separate field by spiffcs · Pull Request #3450 · anchore/syft · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Detect when full license text has been provided and preserve as separate field #3450

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 12 commits into from
May 1, 2025
Merged

Detect when full license text has been provided and preserve as separate field #3450

merged 12 commits into from
May 1, 2025

Conversation

spiffcs
Copy link
Contributor
@spiffcs spiffcs commented Nov 17, 2024 •
edited by wagoodman
Loading

This PR updates the syft License model to include a new FullText field without any breaking changes to the current license behavior. We select candidates for this new field based on if the metadata being analyzed contains any new line characters. Because we still want Value to be populated as it is a required field I've included a default string that will be added here when FullText is the selected outcome for a newly constructed license.

Verification

Use the following Dockerfile and build a test image
docker build -t syft-3088:latest .

# Use the official Python 3.9 image from Docker Hub
FROM python:3.9

# Set the working directory in the container
WORKDIR /app

# Install the specific version of NumPy
RUN pip install numpy==1.26.4

# Specify the command to run on container start
CMD ["python"]

Run the latest syft against this image using this branch:
go run cmd/syft/main.go -o json syft-3088 | jq '.artifacts[] | select(.name=="numpy") | { name: .name, licenses: .licenses }'

The large license value extracted from the package should now be listed under the field fullText with value being set to FullText to keep the field required and not incur any breaking changes.

Type of change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)

Checklist:

  • I have added unit tests that cover changed behavior
  • I have tested my code in common scenarios and confirmed there are no regressions
  • I have added comments to my code, particularly in hard-to-understand sections

@spiffcs
feat: add full text field to syft license struct
14926a3 
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
@spiffcs
test: full text license test
c997a8d 
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
@spiffcs
feat: update full text in encoder
ea438b6 
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
@spiffcs
test: update fixtures to accomadte new full text values
bbca5e5 
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
@github-actions github-actions bot added the json-schema Changes the json schema label Nov 17, 2024
@spiffcs spiffcs requested a review from wagoodman November 18, 2024 17:01
wagoodman
wagoodman reviewed Nov 18, 2024
View reviewed changes
@spiffcs
wip: wip
ab44be5 
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
@henrysachs
Copy link
Contributor

I just hit this case and maybe this could get picked up again as the new field would help me a lot :)

@spiffcs
Copy link
Contributor Author
spiffcs commented Jan 23, 2025

I just hit this case and maybe this could get picked up again as the new field would help me a lot :)

Yep! This is in the queue of a few other PR I have to clean up and get merged for the next up coming release. Apologies for the delay on this one.

@spiffcs spiffcs mentioned this pull request Jan 23, 2025
Open
@spiffcs spiffcs self-assigned this Jan 23, 2025
@spiffcs
Merge branch 'main' into 3088-full-text
baf3c36 
* main: (117 commits)
  chore(deps): update CPE dictionary index (#3620)
  chore(deps): bump github.com/bmatcuk/doublestar/v4 from 4.8.0 to 4.8.1 (#3621)
  chore(deps): bump github/codeql-action from 3.28.4 to 3.28.5 (#3622)
  chore(deps): bump github/codeql-action from 3.28.3 to 3.28.4 (#3618)
  chore(deps): bump anchore/sbom-action from 0.17.9 to 0.18.0 (#3619)
  chore(deps): update tools to latest versions (#3607)
  chore(deps): bump github/codeql-action from 3.28.2 to 3.28.3 (#3608)
  chore(deps): bump github.com/go-git/go-git/v5 from 5.13.1 to 5.13.2 (#3609)
  chore(deps): bump github.com/docker/docker (#3610)
  chore(deps): bump actions/setup-go in /.github/actions/bootstrap (#3612)
  chore(deps): bump actions/cache in /.github/actions/bootstrap (#3613)
  chore(ci): fix composite GitHub action path in dependabot config (#3611)
  chore(deps): update tools to latest versions (#3602)
  chore(deps): bump github/codeql-action from 3.28.1 to 3.28.2 (#3604)
  chore(deps): bump github.com/hashicorp/hcl/v2 from 2.22.0 to 2.23.0 (#3605)
  chore(deps): bump github.com/aquasecurity/go-pep440-version (#3606)
  chore: bump stereoscope to v0.0.13 (#3601)
  feat(cataloger): add a terraform provider cataloger (#3378)
  chore(deps): update tools to latest versions (#3597)
  chore(deps): update CPE dictionary index (#3599)
  ...

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
10000
@spiffcs
Copy link
Contributor Author
spiffcs commented Jan 28, 2025

Updating this in relation to #3366

@VictorHuu VictorHuu mentioned this pull request Apr 15, 2025
Closed
@Funsho-Agboola
Copy link
Funsho-Agboola commented Apr 17, 2025 •
edited
Loading

Hi team, great work on this. I have a primary issue #3780 which is about returning the full license strings in SPDX outputs instead of the LicenseRef-‹hash> identifiers as in here. Can you consider extending this implementation to address this?

@spiffcs spiffcs moved this from In Progress to In Review in OSS Apr 29, 2025
spiffcs added 3 commits April 29, 2025 15:38
@spiffcs
Merge branch 'main' into 3088-full-text
b3f335e 
* main: (150 commits)
  fix the fluent-bit regex detection pattern (#3817)
  chore(deps): bump anchore/sbom-action from 0.18.0 to 0.19.0 (#3832)
  chore(deps): update tools to latest versions (#3830)
  Resolve owned file paths when searching for overlaps (#3828)
  chore(deps): update anchore dependencies (#3827)
  fix: Make the fileresolver Support Prefix Match of Files (#3820)
  Add support for detecting javascript assets in .NET projects using libman (#3825)
  chore(deps): update tools to latest versions (#3823)
  (feat): support skipping archive extraction with file source (#3795)
  Consider DLL claims for dependencies of .NET packages from deps.json (#3822)
  PE cataloger should consider compile target paths from deps.json (#3821)
  Perf: skip license scanner injection (#3796)
  chore(deps): bump sigstore/cosign-installer from 3.8.1 to 3.8.2 (#3818)
  chore(deps): bump github/codeql-action from 3.28.15 to 3.28.16 (#3819)
  chore(deps): update tools to latest versions (#3815)
  docs: document test commands (#3816)
  Support detection of Chrome binaries (#3136)
  fix:allow golang tip image detection regex pattern (#3757)
  fix:Make the parse of the replace part in ```go.mod``` more compliant and traceable (#3812)
  (fix): delete collection name/type key entries when empty (#3797)
  ...

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
@spiffcs
feat: update schema to 16.0.26
6fe7e2f 
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
@spiffcs
feat: refactor so that fullText or Value are correct for license
93b2125 
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
@github-actions GitHub Actions

This comment has been minimized.

Sign in to view
spiffcs added 2 commits May 1, 2025 10:50
@spiffcs
feat: schema swap for 16.0.27
c679201 
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
@spiffcs
Merge branch 'main' into 3088-full-text
35e5300 
Signed-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com>
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
@spiffcs spiffcs requested a review from 8000 wagoodman May 1, 2025 15:49
wagoodman
wagoodman reviewed May 1, 2025
View reviewed changes
wagoodman
wagoodman reviewed May 1, 2025
View reviewed changes
@wagoodman wagoodman changed the title 3088: add full text field for licenses to default syft-json output Detect when full license text has been provided and preserve as separate field May 1, 2025
@wagoodman wagoodman removed this from OSS May 1, 2025
@spiffcs
chore: pr comments
d3e74f3 
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
@spiffcs spiffcs merged commit 94e63eb into main May 1, 2025
13 checks passed
@spiffcs spiffcs deleted the 3088-full-text branch May 1, 2025 19:00
spiffcs added a commit that referenced this pull request May 1, 2025
@spiffcs
Merge branch 'main' into 1961-add-suport-package-supplier
d428ff3 
* main: (142 commits)
  feat: detect when full license text has been provided and preserve as separate field (#3450)
  chore(deps): bump github.com/Masterminds/semver/v3 from 3.3.0 to 3.3.1 (#3843)
  chore(deps): update tools to latest versions (#3841)
  Update github.com/Masterminds/semver to v3 (#3836)
  Add support for PHP Pear (#2775)
  fix: Improve detection of erlang binary in alpine Linux (#3839)
  fix:Resolve ancestral symlinks correctly (#3783)
  chore(deps): update CPE dictionary index (#3834)
  chore(deps): update tools to latest versions (#3835)
  chore(deps): bump github.com/charmbracelet/bubbletea from 1.3.4 to 1.3.5 (#3838)
  fix the fluent-bit regex detection pattern (#3817)
  chore(deps): bump anchore/sbom-action from 0.18.0 to 0.19.0 (#3832)
  chore(deps): update tools to latest versions (#3830)
  Resolve owned file paths when searching for overlaps (#3828)
  chore(deps): update anchore dependencies (#3827)
  fix: Make the fileresolver Support Prefix Match of Files (#3820)
  Add support for detecting javascript assets in .NET projects using libman (#3825)
  chore(deps): update tools to latest versions (#3823)
  (feat): support skipping archive extraction with file source (#3795)
  Consider DLL claims for dependencies of .NET packages from deps.json (#3822)
  ...

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@wagoodman wagoodman wagoodman approved these changes

Assignees

@spiffcs spiffcs

Labels
json-schema Changes the json schema
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Detect whether full license text or a license name has been provided
4 participants
@spiffcs @henrysachs @Funsho-Agboola @wagoodman
0