Add SPDX 2.3 support #13
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>
This commit introduces a document model to handle SPDX 2.2 and 2.3 packages. The model is intended to avoid code duplication in the application while working with the SPDX libraries. Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>
Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>
Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>
Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>
Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>
Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>
|
Thanks so much for this PR. I'm going to delay merging until very early January, as I'm hoping to spend time away from coding for a bit. If I cave during this vacation.. it might make it in earlier, but wanted to set some expectations. |
|
Hey @puerco . Just checking in to see if I should pick this PR up and carry it forward or if you're planning to make the changes. Thanks again for getting it this far. :) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR adds SPDX 2.3 support SBOM Scorecard.
While the number of SPDX fields in use is still low, we can create an abstract document model we can use to test against.
The main test report has been modified to use the abstract document. The
document.gopackage lays the groundwork for the extensible doc model and adds a few functions to read and populate the common model with the fields the report cares about. The abstract document can be expanded to add more fields as the tests get more sophisticated.A simple test of the new loader and test SBOMs are included.