Align SPDX export more with SPDX 2.2 specification #743
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Keith Zantow <[email protected]>
Signed-off-by: Keith Zantow <[email protected]>
Signed-off-by: Keith Zantow <[email protected]>
kzantow
commented
Jan 12, 2022
| return "" | ||
| case pkg.RpmdbMetadata: | ||
| return metadata.Vendor | ||
| return "Organization: " + metadata.Vendor |
There was a problem hiding this comment.
Should this also be Person: ?
There was a problem hiding this comment.
I think we won't be able to tell 100% of the time (org is a good guess)
kzantow
commented
Jan 12, 2022
| SPDXID string `json:"SPDXID"` | ||
| // Identify name of this SpdxElement. | ||
| Name string `json:"name"` | ||
| Name string `json:"name,omitempty"` |
There was a problem hiding this comment.
Not sure if this will have other adverse effects since it is used by things such as spdx22json.Package .Item.Element but not allowed in spdx22json.File, something like this is needed.
Signed-off-by: Keith Zantow <[email protected]>
wagoodman
approved these changes
Jan 13, 2022
spiffcs
added a commit
that referenced
this pull request
Jan 19, 2022
…hub.com/hectorj2f/syft into hectorj2f/add_dependencies_to_cyclonedx * 'hectorj2f/add_dependencies_to_cyclonedx' of https://github.com/hectorj2f/syft: (29 commits) Improve CycloneDX format output (#710) Add additional PHP metadata (#753) Update Syft formats for SyftJson (#752) Add support for "file" source type in syftjson unmarshaling (#750) remove contains file from spdx dependency generation support .sar for java ecosystem (#748) Start developer documentation (#746) Align SPDX export more with SPDX 2.2 specification (#743) Replace distro type (#742) update goreleaser with windows checksums (#740) bump stereoscope version to remove old containerd (#741) Add support for multiple output files in different formats (#732) Add support for searching for jars within archives (#734) 683 windows filepath (#735) Fix CPE encode/decode when it contains special chars (#714) support .par for java ecosystems (#727) Add arm64 support to install script (#729) Revert "bump goreleaser to v1.2 (#720)" (#731) Add a version flag (#722) Add lpkg as java package format (#694) ...
fengshunli
pushed a commit
to fengshunli/syft
that referenced
this pull request
Jan 24, 2022
Signed-off-by: fsl <[email protected]>
spiffcs
pushed a commit
that referenced
this pull request
Jan 24, 2022
Signed-off-by: Christopher Phillips <[email protected]>
spiffcs
pushed a commit
that referenced
this pull request
Jan 25, 2022
jonasagx
pushed a commit
to jonasagx/syft
that referenced
this pull request
Jan 28, 2022
GijsCalis
pushed a commit
to GijsCalis/syft
that referenced
this pull request
Feb 19, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This aligns the SPDX output more correctly with the SPDX 2.2 spec.
These changes are required for Syft's generated SPDX to import properly using the spdx/tools-golang jsonloader
Links to some pertinent resources: