def generate_spdx_document(self) -> Document:
"""Generates the SPDX document.
Example of SPDX document section.
SPDXVersion: SPDX-2.1
DataLicense: CC0-1.0
SPDXID: SPDXRef-DOCUMENT
DocumentName: mbed-targets
DocumentNamespace: http://spdx.org/spdxdocs/spdx-v2.1-3c4714e6-a7b1-4574-abb8-861149cbc590
Creator: Person: Anonymous ()
Creator: Organization: Anonymous ()
Creator: Tool: reuse-0.8.0
Created: 2020-01-20T17:53:41Z
CreatorComment: <text>
This document was created automatically using available reuse information consistent with REUSE.
</text>
Returns:
the corresponding document
"""
doc = Document()
doc.version = Version(1, 2)
doc.name = determine_spdx_value(self.document_name)
doc.namespace = determine_spdx_value(self.document_namespace)
doc.spdx_id = "SPDXRef-DOCUMENT"
doc.comment = determine_spdx_value(
"This document was created automatically using available information from python packages."
)
doc.data_license = License.from_identifier("CC0-1.0")
doc.creation_info.add_creator(Person(self.author, self.author_email))
if not self._is_dependency:
doc.creation_info.add_creator(
Organization(self.organisation, self.organisation_email))
doc.creation_info.add_creator(Tool(self.tool_name))
doc.creation_info.set_created_now()
if not self._is_dependency:
review = Review(
Person(
determine_spdx_value(self.reviewer),
determine_spdx_value(self.reviewer_email),
))
review.set_review_date_now()
doc.add_review(review)
# FIXME with current tooling and specification, only one package can
# be described in a file and hence, all dependencies are described
# in separate files. Find out what to do with dependencies when new
# tools are released as it is not entirely clear in the specification
doc.package = self.generate_spdx_package().generate_spdx_package()
for external_reference in self.external_refs:
doc.add_ext_document_reference(
external_reference.generate_external_reference())
return doc
def test_creators(self):
ci = CreationInfo()
assert len(ci.creators) == 0
person = Person(name='Alice', email='*****@*****.**')
tool = Tool(name='spdxtron-9000')
org = Organization(name='Acme', email='*****@*****.**')
ci.add_creator(tool)
ci.add_creator(org)
ci.add_creator(person)
assert len(ci.creators) == 3
assert tool in ci.creators
assert org in ci.creators
assert person in ci.creators
ci.remove_creator(person)
assert len(ci.creators) == 2
assert tool in ci.creators
assert org in ci.creators
assert person not in ci.creators
import codecs
from spdx.writers.tagvalue import write_document, InvalidDocumentError
from spdx.document import Document, License, LicenseConjuction, ExtractedLicense
from spdx.version import Version
from spdx.creationinfo import Person
from spdx.review import Review
from spdx.package import Package
from spdx.file import File, FileType
from spdx.checksum import Algorithm
from spdx.utils import SPDXNone, NoAssert, UnKnown
doc = Document()
doc.version = Version(1, 2)
doc.comment = 'Example Document'
doc.data_license = License.from_identifier('CC0-1.0')
doc.creation_info.add_creator(Person('Alice', '*****@*****.**'))
doc.creation_info.set_created_now()
review = Review(Person('Joe', None))
review.set_review_date_now()
review.comment = 'Joe reviewed this document'
doc.add_review(review)
# File
testfile1 = File('TestFile1')
testfile1.type = FileType.BINARY
testfile1.comment = 'This is a test file.'
testfile1.chk_sum = Algorithm('SHA1',
'c537c5d99eca5333f23491d47ededd083fefb7ad')
testfile1.conc_lics = License.from_identifier('BSD-2-Clause')
testfile1.add_lics(License.from_identifier('BSD-2-Clause'))
testfile1.copyright = SPDXNone()
testfile1.add_artifact('name', 'TagWriteTest')
def generate_spdx_package(self) -> Package:
"""Generates the SPDX package.
Example of a SPDX package:
PackageName: eduVPN
DataFormat: SPDXRef-1
PackageSupplier: Organization: The Commons Conservancy eduVPN Programme
PackageHomePage: https://eduvpn.org
PackageLicenseDeclared: GPL-3.0+
PackageCopyrightText: 2017, The Commons Conservancy eduVPN Programme
PackageSummary: <text>EduVPN is designed to allow users to connect
securely and encrypted to the Internet from any standard device.
</text>
PackageComment: <text>The package includes the following libraries; see
Relationship information.
</text>
Created: 2017-06-06T09:00:00Z
PackageDownloadLocation: git://github.com/eduVPN/reponame
PackageDownloadLocation: git+https://github.com/eduVPN/reponame.git
PackageDownloadLocation: git+ssh://github.com/eduVPN/reponame.git
Creator: Person: Jane Doe
Returns:
the corresponding package
"""
package = Package(
name=determine_spdx_value(self.name),
spdx_id=f"SPDXRef-{self.id}",
download_location=determine_spdx_value(None),
version=determine_spdx_value(self.version),
file_name=determine_spdx_value(self.name),
supplier=None,
originator=Person(determine_spdx_value(self.author),
determine_spdx_value(self.author_email)),
)
package.check_sum = Algorithm("SHA1", str(NoAssert()))
package.cr_text = NoAssert()
package.homepage = determine_spdx_value(self.url)
package.license_declared = License.from_identifier(
str(determine_spdx_value(self.main_licence)))
package.conc_lics = License.from_identifier(
str(determine_spdx_value(self.licence)))
package.summary = determine_spdx_value(self.description)
package.description = NoAssert()
files = self.get_spdx_files()
if files:
package.files_analyzed = True
for file in files:
package.add_file(file.generate_spdx_file())
package.add_lics_from_file(
License.from_identifier(
str(determine_spdx_value(file.licence))))
_set_package_copyright(file, package)
package.verif_code = determine_spdx_value(
package.calc_verif_code())
else:
# Has to generate a dummy file because of the following rule in SDK:
# - Package must have at least one file
dummy_file = SpdxFile(Path(UNKNOWN), self._package_info.root_dir,
self.main_licence)
package.verif_code = NoAssert()
package.add_file(dummy_file.generate_spdx_file())
package.add_lics_from_file(
License.from_identifier(
str(determine_spdx_value(dummy_file.licence))))
return package
from spdx.version import Version
from spdx.creationinfo import Person
from spdx.review import Review
from spdx.package import Package
from spdx.file import File, FileType
from spdx.checksum import Algorithm
from spdx.utils import SPDXNone, NoAssert, UnKnown
doc = Document()
doc.version = Version(1, 2)
doc.name = "Hello SPDX"
doc.spdx_id = "Test#SPDXRef-DOCUMENT"
doc.comment = "Example Document"
doc.namespace = "spdx"
doc.data_license = License.from_identifier("CC0-1.0")
doc.creation_info.add_creator(Person("Alice", "*****@*****.**"))
doc.creation_info.set_created_now()
review = Review(Person("Joe", None))
review.set_review_date_now()
review.comment = "Joe reviewed this document"
doc.add_review(review)
# File
testfile1 = File("TestFile1")
testfile1.type = FileType.BINARY
testfile1.spdx_id = "TestFilet#SPDXRef-FILE"
testfile1.comment = "This is a test file."
testfile1.chk_sum = Algorithm("SHA1", "c537c5d99eca5333f23491d47ededd083fefb7ad")
testfile1.conc_lics = License.from_identifier("BSD-2-Clause")
testfile1.add_lics(License.from_identifier("BSD-2-Clause"))
testfile1.copyright = SPDXNone()
testfile1.add_artifact("name", "TagWriteTest")