feat: Add support for new Copyrights and schema updates

- **Added**: New JSON schema version `16.0.16` with support for the new `Copyrights`. - **Modified**: Updated the `JSONSchemaVersion` parameter to use the new schema. - **Added**: New `Copyrights` field to the `Package` and `PackageBasicData` structs, similar to the existing `Licenses` field. - **Added**: New `Copyright` struct. - **Implemented**: Sorting methods for the `Copyright` struct. - **Changed**: Updated the `PackageCopyrightText` to use `helpers.GetCopyrights(p.Copyrights)`, which formats the copyright text and returns a string. Example output: "Copyright 2014-2014 Matt Zabriskie & Collaborators". - **Added**: `Copyrights` assignment to the `toSyftPackage` function. Signed-off-by: dor-hayun <[email protected]>
anchore · Aug 28, 2024 · b113b35 · b113b35
1 parent cf9bb13
commit b113b35
Show file tree

Hide file tree

Showing 37 changed files with 524 additions and 105 deletions.
diff --git a/internal/cmptest/common_options.go b/internal/cmptest/common_options.go
@@ -9,10 +9,11 @@ import (
 )
 
 func DefaultCommonOptions() []cmp.Option {
-	return CommonOptions(nil, nil)
+	return CommonOptions(nil, nil, nil)
 }
 
-func CommonOptions(licenseCmp LicenseComparer, locationCmp LocationComparer) []cmp.Option {
+//nolint:funlen
+func CommonOptions(licenseCmp LicenseComparer, locationCmp LocationComparer, copyrightCmp CopyrightComparer) []cmp.Option {
 	if licenseCmp == nil {
 		licenseCmp = DefaultLicenseComparer
 	}
@@ -21,6 +22,10 @@ func CommonOptions(licenseCmp LicenseComparer, locationCmp LocationComparer) []c
 		locationCmp = DefaultLocationComparer
 	}
 
+	if copyrightCmp == nil {
+		copyrightCmp = DefaultCopyrightComparer
+	}
+
 	return []cmp.Option{
 		cmpopts.IgnoreFields(pkg.Package{}, "id"), // note: ID is not deterministic for test purposes
 		cmpopts.SortSlices(pkg.Less),
@@ -61,11 +66,31 @@ func CommonOptions(licenseCmp LicenseComparer, locationCmp LocationComparer) []c
 				return true
 			},
 		),
+		cmp.Comparer(
+			func(x, y pkg.CopyrightsSet) bool {
+				xs := x.ToSlice()
+				ys := y.ToSlice()
+
+				if len(xs) != len(ys) {
+					return false
+				}
+				for i, xe := range xs {
+					ye := ys[i]
+					if !copyrightCmp(xe, ye) {
+						return false
+					}
+				}
+				return true
+			},
+		),
 		cmp.Comparer(
 			locationCmp,
 		),
 		cmp.Comparer(
 			licenseCmp,
 		),
+		cmp.Comparer(
+			copyrightCmp,
+		),
 	}
 }
diff --git a/internal/cmptest/copyright.go b/internal/cmptest/copyright.go
@@ -0,0 +1,16 @@
+package cmptest
+
+import (
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/google/go-cmp/cmp"
+)
+
+type CopyrightComparer func(x, y pkg.Copyright) bool
+
+func DefaultCopyrightComparer(x, y pkg.Copyright) bool {
+	return cmp.Equal(x, y, cmp.Comparer(
+		func(x, y string) bool {
+			return x == y
+		},
+	))
+}
diff --git a/internal/constants.go b/internal/constants.go
@@ -3,5 +3,5 @@ package internal
 const (
 	// JSONSchemaVersion is the current schema version output by the JSON encoder
 	// This is roughly following the "SchemaVer" guidelines for versioning the JSON schema. Please see schema/json/README.md for details on how to increment.
-	JSONSchemaVersion = "16.0.15"
+	JSONSchemaVersion = "16.0.16"
 )
diff --git a/internal/relationship/binary/binary_dependencies_test.go b/internal/relationship/binary/binary_dependencies_test.go
@@ -351,6 +351,7 @@ func relationshipComparer(x, y []artifact.Relationship) string {
 		artifact.Relationship{},
 		file.LocationSet{},
 		pkg.LicenseSet{},
+		pkg.CopyrightsSet{},
 	), cmpopts.SortSlices(lessRelationships))
 }
 

diff --git a/schema/json/schema-latest.json b/schema/json/schema-latest.json
@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "anchore.io/schema/syft/json/16.0.15/document",
+  "$id": "anchore.io/schema/syft/json/16.0.16/document",
   "$ref": "#/$defs/Document",
   "$defs": {
     "AlpmDbEntry": {
@@ -370,6 +370,28 @@
         "path"
       ]
     },
+    "Copyright": {
+      "properties": {
+        "url": {
+          "type": "string"
+        },
+        "author": {
+          "type": "string"
+        },
+        "startYear": {
+          "type": "string"
+        },
+        "endYear": {
+          "type": "string"
+        }
+      },
+      "type": "object",
+      "required": [
+        "author",
+        "startYear",
+        "endYear"
+      ]
+    },
     "DartPubspecLockEntry": {
       "properties": {
         "name": {
@@ -1462,6 +1484,9 @@
         "licenses": {
           "$ref": "#/$defs/licenses"
         },
+        "copyrights": {
+          "$ref": "#/$defs/copyrights"
+        },
         "language": {
           "type": "string"
         },
@@ -1626,6 +1651,7 @@
         "foundBy",
         "locations",
         "licenses",
+        "copyrights",
         "language",
         "cpes",
         "purl"
@@ -2566,6 +2592,12 @@
         "pluginInstallDirectory"
       ]
     },
+    "copyrights": {
+      "items": {
+        "$ref": "#/$defs/Copyright"
+      },
+      "type": "array"
+    },
     "cpes": {
       "items": {
         "$ref": "#/$defs/CPE"

diff --git a/syft/format/common/spdxhelpers/to_format_model.go b/syft/format/common/spdxhelpers/to_format_model.go
@@ -444,8 +444,8 @@ func toPackages(rels *relationship.Index, catalog *pkg.Collection, sbom sbom.SBO
 			// NOASSERTION, if
 			//   (i) the SPDX document creator has made no attempt to determine this field; or
 			//   (ii) the SPDX document creator has intentionally provided no information (no meaning should be implied by doing so).
-			//
-			PackageCopyrightText: noAssertion,
+			//   (iii) Get the formatted copyright text if available, otherwise return NOASSERTION
+			PackageCopyrightText: helpers.GetCopyrights(p.Copyrights),
 
 			// 7.18: Package Summary Description
 			// Cardinality: optional, one

diff --git a/syft/format/common/spdxhelpers/to_syft_model_test.go b/syft/format/common/spdxhelpers/to_syft_model_test.go
@@ -595,6 +595,7 @@ func Test_convertToAndFromFormat(t *testing.T) {
 				cmpopts.IgnoreUnexported(pkg.Collection{}),
 				cmpopts.IgnoreUnexported(pkg.Package{}),
 				cmpopts.IgnoreUnexported(pkg.LicenseSet{}),
+				cmpopts.IgnoreUnexported(pkg.CopyrightsSet{}),
 				cmpopts.IgnoreFields(sbom.Artifacts{}, "FileMetadata", "FileDigests"),
 			); diff != "" {
 				t.Fatalf("packages do not match:\n%s", diff)

diff --git a/syft/format/cyclonedxjson/test-fixtures/snapshot/TestCycloneDxDirectoryEncoder.golden b/syft/format/cyclonedxjson/test-fixtures/snapshot/TestCycloneDxDirectoryEncoder.golden
@@ -35,6 +35,7 @@
           }
         }
       ],
+      "copyright":"NOASSERTION",
       "cpe": "cpe:2.3:*:some:package:2:*:*:*:*:*:*:*",
       "purl": "a-purl-2",
       "properties": [
@@ -62,6 +63,7 @@
     },
     {
       "bom-ref":"redacted",
+      "copyright":"NOASSERTION",
       "type": "library",
       "name": "package-2",
       "version": "2.0.1",

diff --git a/syft/format/cyclonedxjson/test-fixtures/snapshot/TestCycloneDxImageEncoder.golden b/syft/format/cyclonedxjson/test-fixtures/snapshot/TestCycloneDxImageEncoder.golden
@@ -36,6 +36,7 @@
           }
         }
       ],
+      "copyright":"NOASSERTION",
       "cpe": "cpe:2.3:*:some:package:1:*:*:*:*:*:*:*",
       "purl": "a-purl-1",
       "properties": [
@@ -67,6 +68,7 @@
     },
     {
       "bom-ref":"redacted",
+      "copyright":"NOASSERTION",
       "type": "library",
       "name": "package-2",
       "version": "2.0.1",

diff --git a/syft/format/cyclonedxxml/test-fixtures/snapshot/TestCycloneDxDirectoryEncoder.golden b/syft/format/cyclonedxxml/test-fixtures/snapshot/TestCycloneDxDirectoryEncoder.golden
@@ -24,6 +24,7 @@
           <id>MIT</id>
         </license>
       </licenses>
+      <copyright>NOASSERTION</copyright>
       <cpe>cpe:2.3:*:some:package:2:*:*:*:*:*:*:*</cpe>
       <purl>a-purl-2</purl>
       <properties>
@@ -37,6 +38,7 @@
     <component bom-ref="redacted" type="library">
       <name>package-2</name>
       <version>2.0.1</version>
+      <copyright>NOASSERTION</copyright>
       <cpe>cpe:2.3:*:some:package:2:*:*:*:*:*:*:*</cpe>
       <purl>pkg:deb/debian/[email protected]</purl>
       <properties>

diff --git a/syft/format/cyclonedxxml/test-fixtures/snapshot/TestCycloneDxImageEncoder.golden b/syft/format/cyclonedxxml/test-fixtures/snapshot/TestCycloneDxImageEncoder.golden
@@ -25,6 +25,7 @@
           <id>MIT</id>
         </license>
       </licenses>
+      <copyright>NOASSERTION</copyright>
       <cpe>cpe:2.3:*:some:package:1:*:*:*:*:*:*:*</cpe>
       <purl>a-purl-1</purl>
       <properties>
@@ -39,6 +40,7 @@
     <component bom-ref="redacted" type="library">
       <name>package-2</name>
       <version>2.0.1</version>
+      <copyright>NOASSERTION</copyright>
       <cpe>cpe:2.3:*:some:package:2:*:*:*:*:*:*:*</cpe>
       <purl>pkg:deb/debian/[email protected]</purl>
       <properties>

diff --git a/syft/format/internal/cyclonedxutil/helpers/component.go b/syft/format/internal/cyclonedxutil/helpers/component.go
@@ -48,6 +48,7 @@ func EncodeComponent(p pkg.Package) cyclonedx.Component {
 		Version:            p.Version,
 		PackageURL:         p.PURL,
 		Licenses:           encodeLicenses(p),
+		Copyright:          encodeCopyrights(p),
 		CPE:                encodeSingleCPE(p),
 		Author:             encodeAuthor(p),
 		Publisher:          encodePublisher(p),

diff --git a/syft/format/internal/cyclonedxutil/helpers/component_test.go b/syft/format/internal/cyclonedxutil/helpers/component_test.go
@@ -187,6 +187,7 @@ func Test_encodeCompomentType(t *testing.T) {
 						Value: "go-module",
 					},
 				},
+				Copyright: noAssertion,
 			},
 		},
 		{
@@ -206,6 +207,8 @@ func Test_encodeCompomentType(t *testing.T) {
 						Value: "binary",
 					},
 				},
+
+				Copyright: noAssertion,
 			},
 		},
 	}

diff --git a/syft/format/internal/cyclonedxutil/helpers/licenses.go b/syft/format/internal/cyclonedxutil/helpers/licenses.go
@@ -5,11 +5,15 @@ import (
 	"strings"
 
 	"github.com/CycloneDX/cyclonedx-go"
-
 	"github.com/anchore/syft/internal/spdxlicense"
 	"github.com/anchore/syft/syft/pkg"
 )
 
+const (
+	noAssertion     = "NOASSERTION"
+	copyrightPrefix = "Copyright"
+)
+
 // This should be a function that just surfaces licenses already validated in the package struct
 func encodeLicenses(p pkg.Package) *cyclonedx.Licenses {
 	spdx, other, ex := separateLicenses(p)
@@ -198,3 +202,31 @@ func reduceOuter(expression string) string {
 
 	return sb.String()
 }
+
+func encodeCopyrights(p pkg.Package) string {
+	if p.Copyrights.Empty() {
+		return noAssertion
+	}
+
+	var strArr []string
+
+	for _, c := range p.Copyrights.ToSlice() {
+		var sb strings.Builder
+		sb.WriteString(copyrightPrefix)
+
+		// Construct the string with Start Year, End Year, and Author
+		if c.StartYear != "" {
+			sb.WriteString(" " + c.StartYear)
+		}
+		if c.EndYear != "" {
+			sb.WriteString("-" + c.EndYear)
+		}
+		if c.Author != "" {
+			sb.WriteString(" " + c.Author)
+		}
+
+		strArr = append(strArr, sb.String())
+	}
+
+	return strings.Join(strArr, ", ")
+}
diff --git a/syft/format/internal/spdxutil/helpers/copyright.go b/syft/format/internal/spdxutil/helpers/copyright.go
@@ -0,0 +1,45 @@
+package helpers
+
+import (
+	"strings"
+
+	"github.com/anchore/syft/syft/pkg"
+)
+
+const (
+	noAssertion     = "NOASSERTION"
+	copyrightPrefix = "Copyright"
+)
+
+func GetCopyrights(copyrights pkg.CopyrightsSet) string {
+	result := noAssertion
+
+	for _, c := range copyrights.ToSlice() {
+		var sb strings.Builder
+
+		sb.WriteString(copyrightPrefix)
+
+		// Start Year
+		if c.StartYear != "" {
+			sb.WriteString(" ")
+			sb.WriteString(c.StartYear)
+		}
+
+		// End Year
+		if c.EndYear != "" {
+			sb.WriteString("-")
+			sb.WriteString(c.EndYear)
+		}
+
+		// Author
+		if c.Author != "" {
+			sb.WriteString(" ")
+			sb.WriteString(c.Author)
+		}
+
+		// Assign the formatted string to result
+		result = sb.String()
+	}
+
+	return result
+}
diff --git a/syft/format/spdxjson/test-fixtures/snapshot/TestSPDX22JSONRequredProperties.golden b/syft/format/spdxjson/test-fixtures/snapshot/TestSPDX22JSONRequredProperties.golden
@@ -14,7 +14,7 @@
  },
  "packages": [
   {
-   "SPDXID": "SPDXRef-Package-files-analyzed-false-7d37ba9d2f7c574b",
+   "SPDXID": "SPDXRef-Package-files-analyzed-false-0950a383541717dc",
    "copyrightText": "NOASSERTION",
    "downloadLocation": "NOASSERTION",
    "filesAnalyzed": false,
@@ -27,7 +27,7 @@
   },
   {
    "name": "files-analyzed-true",
-   "SPDXID": "SPDXRef-Package-files-analyzed-true-035066c2086b8bb4",
+   "SPDXID": "SPDXRef-Package-files-analyzed-true-1d0a8d923f0cd238",
    "versionInfo": "v1",
    "supplier": "NOASSERTION",
    "downloadLocation": "NOASSERTION",
@@ -77,18 +77,18 @@
  ],
  "relationships": [
   {
-   "spdxElementId": "SPDXRef-Package-files-analyzed-true-035066c2086b8bb4",
+   "spdxElementId": "SPDXRef-Package-files-analyzed-true-1d0a8d923f0cd238",
    "relatedSpdxElement": "SPDXRef-File-some-file-2c5bc344430decac",
    "relationshipType": "CONTAINS"
   },
   {
    "spdxElementId": "SPDXRef-DocumentRoot-Unknown-",
-   "relatedSpdxElement": "SPDXRef-Package-files-analyzed-false-7d37ba9d2f7c574b",
+   "relatedSpdxElement": "SPDXRef-Package-files-analyzed-false-0950a383541717dc",
    "relationshipType": "CONTAINS"
   },
   {
    "spdxElementId": "SPDXRef-DocumentRoot-Unknown-",
-   "relatedSpdxElement": "SPDXRef-Package-files-analyzed-true-035066c2086b8bb4",
+   "relatedSpdxElement": "SPDXRef-Package-files-analyzed-true-1d0a8d923f0cd238",
    "relationshipType": "CONTAINS"
   },
   {