Skip to content

Commit 6a5d3a0

Browse files
goneallgoneall
authored
Merge pull request #104 from spdx/enrich
Create an example for enriching SPDX V2.3 documents
2 parents 6f8f8bf + 83d438b commit 6a5d3a0

5 files changed

Lines changed: 481 additions & 0 deletions

File tree

‎.github/workflows/pull_request.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ jobs:
1414
run: |
1515
find . \( -name '*.spdx' -o -name '*.json' \) \
1616
-not -path './presentations/*' \
17+
-not -path '*/content/*' \
1718
-not -path './tools-java/*' \
1819
-not -path '*/spdx2.2/*' \
1920
-not -path '*/spdx2.3/*' \

‎software/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,3 +37,4 @@ Each directory contains build metadata which is used to create the build artifac
3737
| 11 | 1 Rust file | compiled with Cargo | 1 document | SBOM describing both source and artifact, related with GENERATED_FROM |
3838
| 12 | 1 Ruby library | built using `bundle` | 1 document | SBOM describing Ruby library packaged in a gem |
3939
| 13 | Bundled app with a package and container | No compiling - hypothetical example | Documents in progress | SBOM describing a hypothetical "Acme Aplication" |
40+
| 14 | SPDX file from example 8 | N/A | 1 document | SPDX file is enriched using a tool such as [Parlay](https://github.com/snyk/parlay) - includes relationship to original SPDX document |

‎software/example14/README.md‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
# Example 1
2+
3+
## Description
4+
5+
An [existing (original) SPDX document](content/examplemaven-0.0.1.spdx.json) is enriched to include additional metadata from an application such as [Parlay](https://github.com/snyk/parlay) producing the [enriched SPDX document](spdx2.3/examplemaven-0.0.1-enriched.spdx.json). Any process or tool that modifies an existing SPDX document should include the additional metadata referenced in comments below.
6+
7+
## Comments
8+
9+
In addition to any modifications made to the original SPDX document, the following changes are made to the resultant enriched SPDX document:
10+
- Create a new `documentNamespace` - this is required since the enriched document does not contain exactly the same SPDX metadata
11+
- Update the `created` timestamp to the time this document was generated
12+
- Add a tool to the creators for the enrichment tool
13+
- Create an `AMENDS` relationship from the enriched document to the original document
14+
- Add an `externalDocumentRef` for the original document - this is necessary to create the relationship and provides a checksum for verifying the integrity of the original document
15+
16+
17+
Below is a diff for the above-mentioned changes:
18+
19+
```
20+
6c6
21+
< "documentNamespace": "http://spdx.org/documents/examplemaven-0.0.1",
22+
---
23+
> "documentNamespace": "http://spdx.org/documents/examplemaven-0.0.1/enriched",
24+
11c11,12
25+
< "Tool: spdx-maven-plugin"
26+
---
27+
> "Tool: spdx-maven-plugin",
28+
> "Tool: Parlay"
29+
13c14
30+
< "created": "2022-10-23T15:44:16Z"
31+
---
32+
> "created": "2024-11-18T10:22:12Z"
33+
14a16,23
34+
> "externalDocumentRefs" : [ {
35+
> "externalDocumentId" : "DocumentRef-original",
36+
> "checksum" : {
37+
> "algorithm" : "SHA1",
38+
> "checksumValue" : "3f9deeef2efdbb0eb4b15ec216f5c4e3af2d13e2"
39+
> },
40+
> "spdxDocument" : "http://spdx.org/documents/examplemaven-0.0.1"
41+
> } ],
42+
153a163,168
43+
> {
44+
> "spdxElementId": "SPDXRef-DOCUMENT",
45+
> "relatedSpdxElement": "DocumentRef-original:SPDXRef-DOCUMENT",
46+
> "relationshipType": "AMENDS",
47+
> "comment": "The original document and been enriched by the Parlay application"
48+
> },
49+
50+
```

‎software/example14/content/examplemaven-0.0.1.spdx.json‎

Lines changed: 204 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,204 @@
1+
{
2+
"SPDXID": "SPDXRef-DOCUMENT",
3+
"spdxVersion": "SPDX-2.3",
4+
"creationInfo": {
5+
"created": "2022-10-23T15:44:16Z",
6+
"creators": [
7+
"Person: Gary O'Neall",
8+
"Tool: spdx-maven-plugin"
9+
],
10+
"licenseListVersion": "3.18"
11+
},
12+
"name": "examplemaven",
13+
"dataLicense": "CC0-1.0",
14+
"documentDescribes": [
15+
"SPDXRef-example"
16+
],
17+
"documentNamespace": "http://spdx.org/documents/examplemaven-0.0.1",
18+
"packages": [
19+
{
20+
"SPDXID": "SPDXRef-junit",
21+
"copyrightText": "UNSPECIFIED",
22+
"description": "JUnit is a regression testing framework written by Erich Gamma and Kent Beck. It is used by the developer who implements unit tests in Java.",
23+
"downloadLocation": "NOASSERTION",
24+
"filesAnalyzed": false,
25+
"homepage": "http://junit.org",
26+
"licenseConcluded": "NOASSERTION",
27+
"licenseDeclared": "CPL-1.0",
28+
"name": "JUnit",
29+
"originator": "Organization: JUnit",
30+
"summary": "JUnit is a regression testing framework written by Erich Gamma and Kent Beck. It is used by the developer who implements unit tests in Java.",
31+
"versionInfo": "3.8.1"
32+
},
33+
{
34+
"SPDXID": "SPDXRef-log4jslf4jbinding",
35+
"copyrightText": "UNSPECIFIED",
36+
"description": "The Apache Log4j SLF4J API binding to Log4j 2 Core",
37+
"downloadLocation": "NOASSERTION",
38+
"filesAnalyzed": false,
39+
"licenseConcluded": "NOASSERTION",
40+
"licenseDeclared": "NOASSERTION",
41+
"name": "Apache Log4j SLF4J Binding",
42+
"summary": "The Apache Log4j SLF4J API binding to Log4j 2 Core"
43+
},
44+
{
45+
"SPDXID": "SPDXRef-log4jslf4jApi",
46+
"copyrightText": "UNSPECIFIED",
47+
"description": "The slf4j API",
48+
"downloadLocation": "NOASSERTION",
49+
"filesAnalyzed": false,
50+
"homepage": "http://www.slf4j.org",
51+
"licenseConcluded": "NOASSERTION",
52+
"licenseDeclared": "NOASSERTION",
53+
"name": "SLF4J API Module",
54+
"summary": "The slf4j API"
55+
},
56+
{
57+
"SPDXID": "SPDXRef-log4jApi",
58+
"copyrightText": "UNSPECIFIED",
59+
"description": "The Apache Log4j API",
60+
"downloadLocation": "NOASSERTION",
61+
"filesAnalyzed": false,
62+
"licenseConcluded": "NOASSERTION",
63+
"licenseDeclared": "NOASSERTION",
64+
"name": "Apache Log4j API",
65+
"summary": "The Apache Log4j API"
66+
},
67+
{
68+
"SPDXID": "SPDXRef-log4jImpl",
69+
"copyrightText": "UNSPECIFIED",
70+
"description": "The Apache Log4j Implementation",
71+
"downloadLocation": "NOASSERTION",
72+
"filesAnalyzed": false,
73+
"licenseConcluded": "NOASSERTION",
74+
"licenseDeclared": "NOASSERTION",
75+
"name": "Apache Log4j Core",
76+
"summary": "The Apache Log4j Implementation"
77+
},
78+
{
79+
"SPDXID": "SPDXRef-example",
80+
"checksums": [
81+
{
82+
"algorithm": "SHA1",
83+
"checksumValue": "b8a7e6c75001e6d78625cfc9a3103bf121abf8b4"
84+
}
85+
],
86+
"copyrightText": "Copyright (c) 2022 Source Auditor Inc.",
87+
"description": "This is a simple example Maven project created using the Maven quickstart archetype with one dependency added.",
88+
"downloadLocation": "NOASSERTION",
89+
"filesAnalyzed": true,
90+
"homepage": "https://github.com/spdx/spdx-examples",
91+
"licenseConcluded": "Apache-2.0",
92+
"licenseDeclared": "Apache-2.0",
93+
"licenseInfoFromFiles": [
94+
"Apache-2.0"
95+
],
96+
"name": "examplemaven",
97+
"originator": "Organization: Linux Foundation",
98+
"packageFileName": "examplemaven-0.0.1.jar",
99+
"packageVerificationCode": {
100+
"packageVerificationCodeValue": "c12417def36d7804096521de4280721e5863e68b"
101+
},
102+
"primaryPackagePurpose": "LIBRARY",
103+
"hasFiles": [
104+
"SPDXRef-appsource",
105+
"SPDXRef-apptest"
106+
],
107+
"summary": "This is a simple example Maven project created using the Maven quickstart archetype with one dependency added.",
108+
"supplier": "Organization: SPDX",
109+
"versionInfo": "0.0.1"
110+
}
111+
],
112+
"files": [
113+
{
114+
"SPDXID": "SPDXRef-appsource",
115+
"checksums": [
116+
{
117+
"algorithm": "SHA1",
118+
"checksumValue": "a6f47dbc7e4615058490055172fe0065c55f8fc5"
119+
}
120+
],
121+
"copyrightText": "Copyright (c) 2020 Source Auditor Inc.",
122+
"fileContributors": [
123+
"Gary O'Neall"
124+
],
125+
"fileName": "./src/main/java/org/spdx/examplemaven/App.java",
126+
"fileTypes": [
127+
"SOURCE"
128+
],
129+
"licenseComments": "This file contains SPDX-License-Identifiers for Apache-2.0",
130+
"licenseConcluded": "Apache-2.0",
131+
"licenseInfoInFiles": [
132+
"Apache-2.0"
133+
],
134+
"noticeText": "SPDX-License-Identifier: Apache-2.0\nCopyright (c) 2022 Source Auditor Inc."
135+
},
136+
{
137+
"SPDXID": "SPDXRef-apptest",
138+
"checksums": [
139+
{
140+
"algorithm": "SHA1",
141+
"checksumValue": "4b4df52d36588c8e9482d56eebc42336447f3dad"
142+
}
143+
],
144+
"copyrightText": "Copyright (c) 2020 Source Auditor Inc.",
145+
"fileContributors": [
146+
"Gary O'Neall"
147+
],
148+
"fileName": "./src/test/java/org/spdx/examplemaven/AppTest.java",
149+
"fileTypes": [
150+
"SOURCE"
151+
],
152+
"licenseComments": "This file contains SPDX-License-Identifiers for Apache-2.0",
153+
"licenseConcluded": "Apache-2.0",
154+
"licenseInfoInFiles": [
155+
"Apache-2.0"
156+
],
157+
"noticeText": "SPDX-License-Identifier: Apache-2.0\nCopyright (c) 2022 Source Auditor Inc."
158+
}
159+
],
160+
"relationships": [
161+
{
162+
"spdxElementId": "SPDXRef-junit",
163+
"relationshipType": "TEST_DEPENDENCY_OF",
164+
"relatedSpdxElement": "SPDXRef-example",
165+
"comment": "Relationship created based on Maven POM information"
166+
},
167+
{
168+
"spdxElementId": "SPDXRef-example",
169+
"relationshipType": "DYNAMIC_LINK",
170+
"relatedSpdxElement": "SPDXRef-log4jslf4jbinding",
171+
"comment": "Relationship based on Maven POM file dependency information"
172+
},
173+
{
174+
"spdxElementId": "SPDXRef-example",
175+
"relationshipType": "DYNAMIC_LINK",
176+
"relatedSpdxElement": "SPDXRef-log4jslf4jApi",
177+
"comment": "Relationship based on Maven POM file dependency information"
178+
},
179+
{
180+
"spdxElementId": "SPDXRef-example",
181+
"relationshipType": "DYNAMIC_LINK",
182+
"relatedSpdxElement": "SPDXRef-log4jApi",
183+
"comment": "Relationship based on Maven POM file dependency information"
184+
},
185+
{
186+
"spdxElementId": "SPDXRef-example",
187+
"relationshipType": "DYNAMIC_LINK",
188+
"relatedSpdxElement": "SPDXRef-log4jImpl",
189+
"comment": "Relationship based on Maven POM file dependency information"
190+
},
191+
{
192+
"spdxElementId": "SPDXRef-appsource",
193+
"relationshipType": "GENERATES",
194+
"relatedSpdxElement": "SPDXRef-example",
195+
"comment": ""
196+
},
197+
{
198+
"spdxElementId": "SPDXRef-apptest",
199+
"relationshipType": "TEST_CASE_OF",
200+
"relatedSpdxElement": "SPDXRef-example",
201+
"comment": ""
202+
}
203+
]
204+
}

0 commit comments

Comments
 (0)