feat: allow subpackage copyright metadata

Signed-off-by: Asish Kumar <officialasishkumar@gmail.com>

Author: officialasishkumar

docs/BUILD-FILE.md

@@ -23,6 +23,8 @@ The following are the high level sections for the build file, with detailed desc
 ### subpackages
 
    List of subpackages that this package also produces. For example, docs.
+   Subpackages may define their own `copyright` entries when their files have
+   different licensing from the origin package.
 
 ### data
 
@@ -499,4 +501,3 @@ TODO(vaikas): melange config points to apko here:
 
 # pipeline
 Pipeline defines the ordered steps to build the package.
-

pkg/build/package.go

@@ -73,6 +73,7 @@ type PackageBuild struct {
 	Description   string
 	URL           string
 	Commit        string
+	Copyright     []config.Copyright
 }
 
 func pkgFromSub(sub *config.Subpackage) *config.Package {
@@ -84,6 +85,7 @@ func pkgFromSub(sub *config.Subpackage) *config.Package {
 		Description:  sub.Description,
 		URL:          sub.URL,
 		Commit:       sub.Commit,
+		Copyright:    sub.Copyright,
 	}
 }
 
@@ -102,6 +104,10 @@ func (b *Build) Emit(ctx context.Context, pkg *config.Package) error {
 		Description:  pkg.Description,
 		URL:          pkg.URL,
 		Commit:       pkg.Commit,
+		Copyright:    pkg.Copyright,
+	}
+	if len(pc.Copyright) == 0 {
+		pc.Copyright = pc.Origin.Copyright
 	}
 
 	if !b.StripOriginName {
@@ -166,7 +172,7 @@ maintainer = {{.Build.Namespace}}
 {{- if ne .Build.SourceDateEpoch.Unix 0 }}
 builddate = {{ .Build.SourceDateEpoch.Unix }}
 {{- end}}
-{{- range $copyright := .Origin.Copyright }}
+{{- range $copyright := .Copyright }}
 license = {{ $copyright.License }}
 {{- end }}
 {{- range $dep := .Dependencies.Runtime }}

pkg/build/package_test.go

@@ -80,7 +80,10 @@ func Test_GenerateControlData(t *testing.T) {
 			Description:   "I'm a unit test",
 			URL:           "https://chainguard.dev",
 			Commit:        "deadbeef",
-			DataHash:      "baadf00d",
+			Copyright: []config.Copyright{
+				{License: "Apache-2.0"},
+			},
+			DataHash: "baadf00d",
 		},
 		want: `# Generated by melange
 pkgname = glibc
@@ -92,6 +95,7 @@ pkgdesc = I'm a unit test
 url = https://chainguard.dev
 commit = deadbeef
 maintainer = wolfi
+license = Apache-2.0
 datahash = baadf00d
 `,
 	}, {
@@ -138,3 +142,16 @@ datahash = baadf00d
 		})
 	}
 }
+
+func Test_pkgFromSub_Copyright(t *testing.T) {
+	sub := &config.Subpackage{
+		Name: "glibc-dev",
+		Copyright: []config.Copyright{
+			{License: "LGPL-2.1-or-later"},
+		},
+	}
+
+	pkg := pkgFromSub(sub)
+
+	require.Equal(t, sub.Copyright, pkg.Copyright)
+}

pkg/build/sbom/spdx/spdx.go

@@ -29,6 +29,7 @@ import (
 	"github.com/spdx/tools-golang/spdx/v2/common"
 
 	build "chainguard.dev/melange/pkg/build/sbom"
+	"chainguard.dev/melange/pkg/config"
 	"chainguard.dev/melange/pkg/sbom"
 )
 
@@ -121,13 +122,14 @@ func (g *Generator) GenerateSPDX(ctx context.Context, gc *build.GeneratorContext
 	// Add APK packages to their respective SBOMs
 	for _, sp := range gc.Configuration.Subpackages {
 		spSBOM := sg.Document(sp.Name)
+		spPkg := packageForSubpackage(pkg, &sp)
 
 		apkSubPkg := &sbom.Package{
 			IDComponents:    []string{"apk", sp.Name, pkg.FullVersion()},
 			Name:            sp.Name,
 			Version:         pkg.FullVersion(),
-			Copyright:       pkg.FullCopyright(),
-			LicenseDeclared: pkg.LicenseExpression(),
+			Copyright:       spPkg.FullCopyright(),
+			LicenseDeclared: spPkg.LicenseExpression(),
 			Namespace:       gc.Namespace,
 			Arch:            arch,
 			PURL:            pkg.PackageURLForSubpackage(gc.Namespace, arch, sp.Name),
@@ -139,7 +141,7 @@ func (g *Generator) GenerateSPDX(ctx context.Context, gc *build.GeneratorContext
 		// Add upstream source packages from subpackage pipelines
 		for i, p := range sp.Pipeline {
 			uniqueID := strconv.Itoa(i)
-			upstreamPkg, err := p.SBOMPackageForUpstreamSource(pkg.LicenseExpression(), gc.Namespace, uniqueID)
+			upstreamPkg, err := p.SBOMPackageForUpstreamSource(spPkg.LicenseExpression(), gc.Namespace, uniqueID)
 			if err != nil {
 				return nil, fmt.Errorf("creating SBOM package for upstream source in subpackage %s: %w", sp.Name, err)
 			}
@@ -206,7 +208,7 @@ func (g *Generator) GenerateSPDX(ctx context.Context, gc *build.GeneratorContext
 	}
 
 	// Add licensing information
-	li, err := gc.Configuration.Package.LicensingInfos(ctx, gc.WorkspaceDir)
+	li, err := licensingInfos(ctx, gc)
 	if err != nil {
 		return nil, fmt.Errorf("gathering licensing infos: %w", err)
 	}
@@ -227,6 +229,40 @@ func (g *Generator) GenerateSPDX(ctx context.Context, gc *build.GeneratorContext
 	return out, nil
 }
 
+func packageForSubpackage(pkg *config.Package, sp *config.Subpackage) config.Package {
+	copyright := sp.Copyright
+	if len(copyright) == 0 {
+		copyright = pkg.Copyright
+	}
+
+	return config.Package{
+		Name:      sp.Name,
+		Version:   pkg.Version,
+		Epoch:     pkg.Epoch,
+		Copyright: copyright,
+	}
+}
+
+func licensingInfos(ctx context.Context, gc *build.GeneratorContext) (map[string]string, error) {
+	out, err := gc.Configuration.Package.LicensingInfos(ctx, gc.WorkspaceDir)
+	if err != nil {
+		return nil, err
+	}
+
+	for _, sp := range gc.Configuration.Subpackages {
+		spPkg := packageForSubpackage(&gc.Configuration.Package, &sp)
+		li, err := spPkg.LicensingInfos(ctx, gc.WorkspaceDir)
+		if err != nil {
+			return nil, err
+		}
+		for k, v := range li {
+			out[k] = v
+		}
+	}
+
+	return out, nil
+}
+
 // GenerateSBOM generates and writes SPDX SBOM documents for the main package and
 // all subpackages based on the build context.
 func (g *Generator) GenerateSBOM(ctx context.Context, gc *build.GeneratorContext) error {

pkg/build/sbom/spdx/spdx_test.go

@@ -260,6 +260,68 @@ func TestSBOMGeneration(t *testing.T) {
 	}
 }
 
+func TestSBOMGenerationUsesSubpackageCopyright(t *testing.T) {
+	tmpDir := t.TempDir()
+	ctx := context.Background()
+	outputFS := apkofs.DirFS(ctx, tmpDir)
+
+	cfg := &config.Configuration{
+		Package: config.Package{
+			Name:    "test-pkg",
+			Version: "1.2.3",
+			Epoch:   2,
+			Copyright: []config.Copyright{
+				{License: "MIT"},
+			},
+		},
+		Subpackages: []config.Subpackage{
+			{
+				Name: "test-pkg-dev",
+				Copyright: []config.Copyright{
+					{
+						License:     "Apache-2.0",
+						Attestation: "Copyright 2026 Example",
+					},
+				},
+			},
+		},
+	}
+
+	genCtx := &build.GeneratorContext{
+		Configuration:   cfg,
+		WorkspaceDir:    tmpDir,
+		OutputFS:        outputFS,
+		SourceDateEpoch: time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC),
+		Namespace:       "test-ns",
+		Arch:            "x86_64",
+	}
+
+	gen := &Generator{}
+	sboms, err := gen.GenerateSPDX(ctx, genCtx)
+	if err != nil {
+		t.Fatalf("GenerateSPDX failed: %v", err)
+	}
+
+	subDoc := sboms["test-pkg-dev"]
+	var subPackage *spdx.Package
+	for i := range subDoc.Packages {
+		if subDoc.Packages[i].Name == "test-pkg-dev" {
+			subPackage = &subDoc.Packages[i]
+			break
+		}
+	}
+	if subPackage == nil {
+		t.Fatal("subpackage package not found in SBOM")
+	}
+
+	if diff := cmp.Diff("Apache-2.0", subPackage.LicenseDeclared); diff != "" {
+		t.Errorf("subpackage license declared mismatch (-want +got):\n%s", diff)
+	}
+	if diff := cmp.Diff("Copyright 2026 Example\n", subPackage.CopyrightText); diff != "" {
+		t.Errorf("subpackage copyright mismatch (-want +got):\n%s", diff)
+	}
+}
+
 func TestSBOMGenerationWithNonSPDXLicense(t *testing.T) {
 	tmpDir := t.TempDir()
 	ctx := context.Background()

pkg/config/config.go

@@ -861,6 +861,8 @@ type Subpackage struct {
 	URL string `json:"url,omitempty" yaml:"url,omitempty"`
 	// Optional: The git commit of the subpackage build configuration
 	Commit string `json:"commit,omitempty" yaml:"commit,omitempty"`
+	// Optional: The list of copyrights for this subpackage
+	Copyright []Copyright `json:"copyright,omitempty" yaml:"copyright,omitempty"`
 	// Optional: enabling, disabling, and configuration of build checks
 	Checks Checks `json:"checks" yaml:"checks,omitempty"`
 	// Test section for the subpackage.
@@ -1560,6 +1562,7 @@ func replaceSubpackage(r *strings.Replacer, detectedCommit string, in Subpackage
 		Description:  r.Replace(in.Description),
 		URL:          r.Replace(in.URL),
 		Commit:       replaceCommit(detectedCommit, in.Commit),
+		Copyright:    in.Copyright,
 		Checks:       in.Checks,
 		Test:         replaceTest(r, in.Test),
 	}

pkg/config/config_test.go

@@ -107,6 +107,8 @@ var-transforms:
 
 subpackages:
   - name: subpackage-${{vars.short-package-version}}
+    copyright:
+      - license: Apache-2.0
     dependencies:
       runtime:
         - ${{package.name}}-config-${{package.version}}
@@ -181,6 +183,7 @@ test:
 	}, cfg.Test.Environment.Contents.Packages)
 
 	require.Equal(t, cfg.Subpackages[0].Name, "subpackage-0.0")
+	require.Equal(t, []Copyright{{License: "Apache-2.0"}}, cfg.Subpackages[0].Copyright)
 
 	require.Equal(t, "/usr/local/FOO", cfg.Test.Environment.Environment["LD_LIBRARY_PATH"])
 }

pkg/config/schema.cue

@@ -567,6 +567,9 @@
 	// Optional: The git commit of the subpackage build configuration
 	commit?: string
 
+	// Optional: The list of copyrights for this subpackage
+	copyright?: [...#Copyright]
+
 	// Optional: enabling, disabling, and configuration of build
 	// checks
 	checks!: #Checks

pkg/config/schema.json

@@ -1033,6 +1033,13 @@
           "type": "string",
           "description": "Optional: The git commit of the subpackage build configuration"
         },
+        "copyright": {
+          "items": {
+            "$ref": "#/$defs/Copyright"
+          },
+          "type": "array",
+          "description": "Optional: The list of copyrights for this subpackage"
+        },
         "checks": {
           "$ref": "#/$defs/Checks",
           "description": "Optional: enabling, disabling, and configuration of build checks"