diff --git a/requirements.txt b/requirements.txt index d97edea593f..883600070b2 100644 --- a/requirements.txt +++ b/requirements.txt @@ -64,7 +64,7 @@ requests==2.28.1 saneyaml==0.6.0 six==1.16.0 soupsieve==2.3.2.post1 -spdx-tools==0.7.0a3 +spdx-tools==0.7.0rc0 text-unidecode==1.3 toml==0.10.2 typecode==30.0.0 diff --git a/setup-mini.cfg b/setup-mini.cfg index e97392c859e..a4587ca38e3 100644 --- a/setup-mini.cfg +++ b/setup-mini.cfg @@ -80,7 +80,7 @@ install_requires = gemfileparser2 >= 0.9.0 html5lib importlib_metadata - intbitset >= 3.0.2 + intbitset >= 3.0.2 jaraco.functools javaproperties >= 0.5 jinja2 >= 2.7.0 @@ -105,7 +105,7 @@ install_requires = pymaven_patch >= 0.2.8 requests >= 2.7.0 saneyaml >= 0.6.0 - spdx_tools == 0.7.0a3 + spdx_tools == 0.7.0rc0 text_unidecode >= 1.0 toml >= 0.10.0 urlpy diff --git a/setup.cfg b/setup.cfg index 066c3b8294f..58149eb984d 100644 --- a/setup.cfg +++ b/setup.cfg @@ -105,7 +105,7 @@ install_requires = pymaven_patch >= 0.2.8 requests >= 2.7.0 saneyaml >= 0.6.0 - spdx_tools == 0.7.0a3 + spdx_tools == 0.7.0rc0 text_unidecode >= 1.0 toml >= 0.10.0 urlpy diff --git a/src/formattedcode/output_spdx.py b/src/formattedcode/output_spdx.py index 73b4b2a69ac..fddfa065afe 100644 --- a/src/formattedcode/output_spdx.py +++ b/src/formattedcode/output_spdx.py @@ -12,13 +12,16 @@ from io import BytesIO from io import StringIO -from spdx.checksum import Algorithm +from spdx.checksum import Checksum +from spdx.checksum import ChecksumAlgorithm from spdx.creationinfo import Tool from spdx.document import ExtractedLicense from spdx.document import Document -from spdx.document import License +from spdx.license import License from spdx.file import File from spdx.package import Package +from spdx.relationship import Relationship +from spdx.utils import calc_verif_code from spdx.utils import NoAssert from spdx.utils import SPDXNone from spdx.version import Version @@ -280,9 +283,8 @@ def write_spdx( name = './' + file_data.get('path') file_entry = File( spdx_id=f'SPDXRef-{sid}', - name=name, - chk_sum=Algorithm('SHA1', file_data.get('sha1') or '') - ) + name=name) + file_entry.set_checksum(Checksum(ChecksumAlgorithm.SHA1, file_data.get('sha1') or '')) file_license_detections = file_data.get('license_detections') license_matches = get_matches_from_detection_mappings(file_license_detections) @@ -357,9 +359,11 @@ def write_spdx( else: file_entry.copyright = SPDXNone() - package.add_file(file_entry) + doc.add_file(file_entry) + relationship = Relationship(f'{package.spdx_id} CONTAINS {file_entry.spdx_id}') + doc.add_relationship(relationship) - if len(package.files) == 0: + if not doc.files: if as_tagvalue: msg = "# No results for package '{}'.\n".format(package.name) else: @@ -392,7 +396,7 @@ def write_spdx( # statements for the package. package.cr_text = '\n'.join(sorted(package.cr_text)) + '\n' - package.verif_code = doc.package.calc_verif_code() + package.verif_code = calc_verif_code(doc.files) package.license_declared = NoAssert() package.conc_lics = NoAssert() @@ -404,7 +408,7 @@ def write_spdx( # one case we do need to deal with bytes and decode before writing (rdf) and # in the other case we deal with text all the way. - if package.files: + if doc.files: if as_tagvalue: from spdx.writers.tagvalue import write_document # NOQA diff --git a/tests/formattedcode/data/spdx/license_known/expected.tv b/tests/formattedcode/data/spdx/license_known/expected.tv index 9357ce6f057..fa4d0afd572 100644 --- a/tests/formattedcode/data/spdx/license_known/expected.tv +++ b/tests/formattedcode/data/spdx/license_known/expected.tv @@ -35,5 +35,4 @@ SPDXID: SPDXRef-3 FileChecksum: SHA1: 172444e7c137eb5cd3cae530aca0879c90f7fada LicenseConcluded: NOASSERTION LicenseInfoInFile: CC0-1.0 -FileCopyrightText: NONE -# Extracted Licenses \ No newline at end of file +FileCopyrightText: NONE \ No newline at end of file diff --git a/tests/formattedcode/data/spdx/license_known/expected_with_text.tv b/tests/formattedcode/data/spdx/license_known/expected_with_text.tv index 9357ce6f057..fa4d0afd572 100644 --- a/tests/formattedcode/data/spdx/license_known/expected_with_text.tv +++ b/tests/formattedcode/data/spdx/license_known/expected_with_text.tv @@ -35,5 +35,4 @@ SPDXID: SPDXRef-3 FileChecksum: SHA1: 172444e7c137eb5cd3cae530aca0879c90f7fada LicenseConcluded: NOASSERTION LicenseInfoInFile: CC0-1.0 -FileCopyrightText: NONE -# Extracted Licenses \ No newline at end of file +FileCopyrightText: NONE \ No newline at end of file diff --git a/tests/formattedcode/data/spdx/simple/expected.tv b/tests/formattedcode/data/spdx/simple/expected.tv index 43edf4777ad..8c6a74c0851 100644 --- a/tests/formattedcode/data/spdx/simple/expected.tv +++ b/tests/formattedcode/data/spdx/simple/expected.tv @@ -27,5 +27,4 @@ SPDXID: SPDXRef-1 FileChecksum: SHA1: b8a793cce3c3a4cd3a4646ddbe86edd542ed0cd8 LicenseConcluded: NOASSERTION LicenseInfoInFile: NONE -FileCopyrightText: NONE -# Extracted Licenses \ No newline at end of file +FileCopyrightText: NONE \ No newline at end of file diff --git a/tests/formattedcode/data/spdx/tree/expected.tv b/tests/formattedcode/data/spdx/tree/expected.tv index 42430f27e06..9cf44357934 100644 --- a/tests/formattedcode/data/spdx/tree/expected.tv +++ b/tests/formattedcode/data/spdx/tree/expected.tv @@ -77,5 +77,4 @@ FileChecksum: SHA1: 58748872d25374160692f1ed7075d0fe80a544b1 LicenseConcluded: NOASSERTION LicenseInfoInFile: NONE FileCopyrightText: Copyright (c) 2000 ACME, Inc. - -# Extracted Licenses \ No newline at end of file + \ No newline at end of file diff --git a/tests/formattedcode/data/templated/tree/expected.tv b/tests/formattedcode/data/templated/tree/expected.tv index 0f89fe3edee..0ff1511d78d 100644 --- a/tests/formattedcode/data/templated/tree/expected.tv +++ b/tests/formattedcode/data/templated/tree/expected.tv @@ -65,5 +65,4 @@ FileChecksum: SHA1: 58748872d25374160692f1ed7075d0fe80a544b1 LicenseConcluded: NOASSERTION LicenseInfoInFile: NONE FileCopyrightText: Copyright (c) 2000 ACME, Inc. - -# Extracted Licenses \ No newline at end of file + \ No newline at end of file diff --git a/tests/formattedcode/test_output_spdx.py b/tests/formattedcode/test_output_spdx.py index 8fd58752242..3eee6a70aa9 100644 --- a/tests/formattedcode/test_output_spdx.py +++ b/tests/formattedcode/test_output_spdx.py @@ -149,6 +149,8 @@ def load_and_clean_tv(location): line = line.strip() if not line: continue + if line.startswith('LicenseListVersion'): + continue if line.startswith(('Creator: ', 'Created: ',)): continue if line.startswith(dns):