Add support for license list version and creator comments

pkg/assemble/spdx/merge.go

@@ -19,17 +19,13 @@ import (
 	"fmt"
 	"io"
 	"os"
-	"sort"
-	"strings"
 
-	semver "github.com/Masterminds/semver/v3"
 	"github.com/google/uuid"
 	"github.com/interlynk-io/sbomasm/pkg/logger"
 	"github.com/samber/lo"
 	"github.com/spdx/tools-golang/spdx"
 	"github.com/spdx/tools-golang/spdx/v2/common"
 	"github.com/spdx/tools-golang/spdx/v2/v2_3"
-	"sigs.k8s.io/release-utils/version"
 )
 
 type merge struct {
@@ -59,7 +55,7 @@ func (m *merge) loadBoms() {
 }
 
 func (m *merge) initOutBom() {
-	log := logger.FromContext(*m.settings.Ctx)
+	//log := logger.FromContext(*m.settings.Ctx)
 	m.out.SPDXVersion = spdx.Version
 	m.out.DataLicense = spdx.DataLicense
 	m.out.SPDXIdentifier = common.ElementID("DOCUMENT")
@@ -68,10 +64,6 @@ func (m *merge) initOutBom() {
 	m.out.CreationInfo = &v2_3.CreationInfo{}
 	m.out.CreationInfo.Created = utcNowTime()
 
-	m.out.CreationInfo.CreatorComment = fmt.Sprintf("Generated by sbomasm-%s using %d sboms",
-		version.GetVersionInfo().GitVersion,
-		len(m.in))
-
 	for _, author := range m.settings.App.Authors {
 		c := common.Creator{}
 		c.CreatorType = "Organization"
@@ -82,43 +74,16 @@ func (m *merge) initOutBom() {
 		m.out.CreationInfo.Creators = append(m.out.CreationInfo.Creators, c)
 	}
 
-	//Add tool also as creator
-	m.out.CreationInfo.Creators = append(m.out.CreationInfo.Creators, common.Creator{
-		CreatorType: "Tool",
-		Creator:     fmt.Sprintf("%s-%s", "sbomasm", version.GetVersionInfo().GitVersion),
-	})
-
 	//Add all creators from the input sboms
 	creators := getAllCreators(m.in)
 	m.out.CreationInfo.Creators = append(m.out.CreationInfo.Creators, creators...)
 
-	lVersions := lo.Uniq(lo.Map(m.in, func(bom *spdx.Document, _ int) string {
-		if bom.CreationInfo != nil && bom.CreationInfo.LicenseListVersion != "" {
-			return bom.CreationInfo.LicenseListVersion
-		}
-		return ""
-	}))
-
-	finalLicVersion := "3.19"
-	if len(lVersions) > 1 {
-		vs := make([]*semver.Version, len(lVersions))
-		for i, r := range lVersions {
-			v, err := semver.NewVersion(r)
-			if err != nil {
-				panic(err) // TODO: return error instead of panic
-			}
-			vs[i] = v
-		}
-
-		sort.Sort(semver.Collection(vs))
-		finalLicVersion = vs[0].String()
-	} else if len(lVersions) == 1 && strings.Trim(lVersions[0], " ") != "" {
-		finalLicVersion = lVersions[0]
+	version := getLicenseListVersion(m.in)
+	if version != "" {
+		m.out.CreationInfo.LicenseListVersion = version
 	}
-
-	log.Debugf("No of Licenses: %d:  Selected:%s", len(lVersions), finalLicVersion)
-	m.out.CreationInfo.LicenseListVersion = finalLicVersion
 	m.out.ExternalDocumentReferences = append(m.out.ExternalDocumentReferences, externalDocumentRefs(m.in)...)
+	m.out.CreationInfo.CreatorComment = getCreatorComments(m.in)
 }
 
 func (m *merge) setupPrimaryComp() *spdx.Package {

pkg/assemble/spdx/utils.go

@@ -19,6 +19,9 @@ import (
 	"fmt"
 	"net/url"
 	"os"
+	"sort"
+	"strconv"
+	"strings"
 	"time"
 
 	"github.com/google/uuid"
@@ -33,6 +36,7 @@ import (
 	"github.com/spdx/tools-golang/spdx/v2/v2_3"
 	spdx_tv "github.com/spdx/tools-golang/tagvalue"
 	spdx_yaml "github.com/spdx/tools-golang/yaml"
+	"sigs.k8s.io/release-utils/version"
 )
 
 func loadBom(ctx context.Context, path string) (*v2_3.Document, error) {
@@ -138,5 +142,66 @@ func getAllCreators(docs []*v2_3.Document) []common.Creator {
 			}
 		}
 	}
+
+	sbomAsmCreator := common.Creator{
+		CreatorType: "Tool",
+		Creator:     fmt.Sprintf("%s-%s", "sbomasm", version.GetVersionInfo().GitVersion),
+	}
+
+	creators = append(creators, sbomAsmCreator)
 	return creators
 }
+
+func getCreatorComments(docs []*v2_3.Document) string {
+	comments := lo.Uniq(lo.Map(docs, func(bom *spdx.Document, _ int) string {
+		if bom.CreationInfo != nil {
+			return bom.CreationInfo.CreatorComment
+		}
+		return ""
+	}))
+
+	docNames := lo.Uniq(lo.Map(docs, func(doc *v2_3.Document, _ int) string {
+		return doc.DocumentName
+	}))
+
+	sbomasmComment := fmt.Sprintf("Generated by sbomasm (%s) using %s",
+		version.GetVersionInfo().GitVersion, strings.Join(docNames, ", "))
+
+	finalComments := append([]string{sbomasmComment}, comments...)
+
+	return strings.Join(finalComments, "\n")
+}
+
+func getLicenseListVersion(docs []*v2_3.Document) string {
+	versions := lo.Uniq(lo.Map(docs, func(bom *spdx.Document, _ int) string {
+		if bom.CreationInfo != nil && bom.CreationInfo.LicenseListVersion != "" {
+			return bom.CreationInfo.LicenseListVersion
+		}
+		return ""
+	}))
+
+	sort.Slice(versions, func(i, j int) bool {
+		return compareVersions(versions[i], versions[j])
+	})
+
+	// fmt.Println("Sorted versions:", versions)
+	// fmt.Println("Highest version:", versions[len(versions)-1])
+
+	return versions[len(versions)-1]
+}
+
+func compareVersions(a, b string) bool {
+	aParts := strings.Split(a, ".")
+	bParts := strings.Split(b, ".")
+
+	for i := 0; i < len(aParts) && i < len(bParts); i++ {
+		aNum, _ := strconv.Atoi(aParts[i])
+		bNum, _ := strconv.Atoi(bParts[i])
+
+		if aNum != bNum {
+			return aNum < bNum
+		}
+	}
+
+	return len(aParts) < len(bParts)
+}

samples/spdx/issue-67/example6-bin.spdx

@@ -0,0 +1,107 @@
+SPDXVersion: SPDX-2.2
+DataLicense: CC0-1.0
+SPDXID: SPDXRef-DOCUMENT
+DocumentName: hello-go-bin
+DocumentNamespace: https://swinslow.net/spdx-examples/example6/hello-go-bin-v2
+ExternalDocumentRef:DocumentRef-hello-go-src https://swinslow.net/spdx-examples/example6/hello-go-src-v2 SHA1: b3018ddb18802a56b60ad839c98d279687b60bd6
+ExternalDocumentRef:DocumentRef-go-lib https://swinslow.net/spdx-examples/example6/go-lib-v2 SHA1: 58e4a6d5745f032b9788142e49edee1b508c7ac5
+Creator: Person: Steve Winslow ([email protected])
+Creator: Tool: github.com/spdx/tools-golang/builder
+Creator: Tool: github.com/spdx/tools-golang/idsearcher
+Created: 2021-08-26T01:56:00Z
+LicenseListVersion: 3.18
+
+##### Package: hello-go-bin
+
+PackageName: hello-go-bin
+SPDXID: SPDXRef-Package-hello-go-bin
+PackageDownloadLocation: git+https://github.com/swinslow/spdx-examples.git#example6/content/build
+FilesAnalyzed: true
+PackageVerificationCode: 41acac4b846ee388cb6c1234f04489ccd5daa5a5
+PackageLicenseConcluded: GPL-3.0-or-later AND LicenseRef-Golang-BSD-plus-Patents
+PackageLicenseInfoFromFiles: NOASSERTION
+PackageLicenseDeclared: NOASSERTION
+PackageCopyrightText: NOASSERTION
+
+Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-Package-hello-go-bin
+
+FileName: ./hello
+SPDXID: SPDXRef-hello-go-binary
+FileChecksum: SHA1: 78ed46e8e6f86f19d3a6782979029be5f918235f
+FileChecksum: SHA256: 3d51cb6c9a38d437e8ee20a1902a15875ea1d3771a215622e14739532be14949
+FileChecksum: MD5: 9ec63d68bdceb2922548e3faa377e7d0
+LicenseConcluded: GPL-3.0-or-later AND LicenseRef-Golang-BSD-plus-Patents
+LicenseInfoInFile: NOASSERTION
+FileCopyrightText: NOASSERTION
+
+##### Relationships
+
+Relationship: SPDXRef-hello-go-binary GENERATED_FROM DocumentRef-hello-go-src:SPDXRef-hello-go-src
+Relationship: SPDXRef-hello-go-binary GENERATED_FROM DocumentRef-hello-go-src:SPDXRef-Makefile
+
+Relationship: DocumentRef-go-lib:SPDXRef-Package-go-compiler BUILD_TOOL_OF SPDXRef-Package-hello-go-bin
+
+Relationship: DocumentRef-go-lib:SPDXRef-Package-go.fmt RUNTIME_DEPENDENCY_OF SPDXRef-Package-hello-go-bin
+Relationship: DocumentRef-go-lib:SPDXRef-Package-go.fmt STATIC_LINK SPDXRef-Package-hello-go-bin
+
+Relationship: DocumentRef-go-lib:SPDXRef-Package-go.reflect STATIC_LINK SPDXRef-Package-hello-go-bin
+Relationship: DocumentRef-go-lib:SPDXRef-Package-go.strconv STATIC_LINK SPDXRef-Package-hello-go-bin
+
+##### Non-standard license
+
+LicenseID: LicenseRef-Golang-BSD-plus-Patents
+ExtractedText: <text>
+Copyright (c) 2009 The Go Authors. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+   * Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+   * Redistributions in binary form must reproduce the above
+copyright notice, this list of conditions and the following disclaimer
+in the documentation and/or other materials provided with the
+distribution.
+   * Neither the name of Google Inc. nor the names of its
+contributors may be used to endorse or promote products derived from
+this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+Additional IP Rights Grant (Patents)
+
+"This implementation" means the copyrightable works distributed by
+Google as part of the Go project.
+
+Google hereby grants to You a perpetual, worldwide, non-exclusive,
+no-charge, royalty-free, irrevocable (except as stated in this section)
+patent license to make, have made, use, offer to sell, sell, import,
+transfer and otherwise run, modify and propagate the contents of this
+implementation of Go, where such license applies only to those patent
+claims, both currently owned or controlled by Google and acquired in
+the future, licensable by Google that are necessarily infringed by this
+implementation of Go.  This grant does not include claims that would be
+infringed only as a consequence of further modification of this
+implementation.  If you or your agent or exclusive licensee institute or
+order or agree to the institution of patent litigation against any
+entity (including a cross-claim or counterclaim in a lawsuit) alleging
+that this implementation of Go or any code incorporated within this
+implementation of Go constitutes direct or contributory patent
+infringement, or inducement of patent infringement, then any patent
+rights granted to you under this License for this implementation of Go
+shall terminate as of the date such litigation is filed.</text>
+LicenseName: Golang BSD-plus-PATENTS
+LicenseCrossReference: https://github.com/golang/go/blob/master/LICENSE
+LicenseCrossReference: https://github.com/golang/go/blob/master/PATENTS
+LicenseComment: The Golang license text is split across two files, with the BSD-3-Clause content in LICENSE and the Additional IP Rights Grant in PATENTS.