Skip to content

Commit 5fd404f

Browse files
goneallgoneall
authored
Add support for SPDX Spec version 3 (#167)
* Updated for SPDX spec version 3 changes to the library Signed-off-by: Gary O'Neall <gary@sourceauditor.com> * Remove type from ModelCopyManager interface Signed-off-by: Gary O'Neall <gary@sourceauditor.com> * Partial implementation of SPDX 3 support Signed-off-by: Gary O'Neall <gary@sourceauditor.com> * Implented SpdxConverter for SPDX V3 Signed-off-by: Gary O'Neall <gary@sourceauditor.com> * Implement verify for spec version 3 Signed-off-by: Gary O'Neall <gary@sourceauditor.com> * Update to SPDX 3.0.1 Signed-off-by: Gary O'Neall <gary@sourceauditor.com> * Fix schema and update deps for release Signed-off-by: Gary O'Neall <gary@sourceauditor.com> * Handle JSON-LD files that may end in '.json' Signed-off-by: Gary O'Neall <gary@sourceauditor.com> * Remove unused dependency check suppresses Signed-off-by: Gary O'Neall <gary@sourceauditor.com> --------- Signed-off-by: Gary O'Neall <gary@sourceauditor.com>
1 parent d95178b commit 5fd404f

48 files changed

Lines changed: 12785 additions & 339 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎dependency-check-supress.xml‎

Lines changed: 1 addition & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -1,34 +1,4 @@
11
<?xml version="1.0" encoding="UTF-8"?>
22
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
3-
<suppress>
4-
<notes><![CDATA[
5-
The feature referenced in the CVE is not used by this software.
6-
file name: guava-28.2-android.jar
7-
]]></notes>
8-
<packageUrl regex="true">^pkg:maven/com\.google\.guava/guava@.*$</packageUrl>
9-
<cve>CVE-2020-8908</cve>
10-
</suppress>
11-
<suppress>
12-
<notes><![CDATA[
13-
The feature referenced in the CVE is not used by this software.
14-
file name: poi-4.1.2.jar
15-
]]></notes>
16-
<packageUrl regex="true">^pkg:maven/org\.apache\.poi/poi@.*$</packageUrl>
17-
<cve>CVE-2022-26336</cve>
18-
</suppress>
19-
<suppress>
20-
<notes><![CDATA[
21-
The feature referenced in the CVE is not used by this software.
22-
file name: poi-ooxml-4.1.2.jar
23-
]]></notes>
24-
<packageUrl regex="true">^pkg:maven/org\.apache\.poi/poi\-ooxml@.*$</packageUrl>
25-
<cve>CVE-2022-26336</cve>
26-
</suppress>
27-
<suppress>
28-
<notes><![CDATA[
29-
file name: poi-ooxml-schemas-4.1.2.jar
30-
]]></notes>
31-
<packageUrl regex="true">^pkg:maven/org\.apache\.poi/poi\-ooxml\-schemas@.*$</packageUrl>
32-
<cve>CVE-2022-26336</cve>
33-
</suppress>
3+
344
</suppressions>

examples/org/spdx/examples/ExistingSpdxDocument.java renamed to examples/org/spdx/examples/ExistingSpdxDocumentV2Compat.java

Lines changed: 23 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -10,23 +10,23 @@
1010
import java.io.IOException;
1111
import java.io.InputStream;
1212
import java.util.Collection;
13-
import java.util.Optional;
13+
import java.util.List;
14+
import java.util.stream.Collectors;
1415

1516
import org.spdx.jacksonstore.MultiFormatStore;
1617
import org.spdx.jacksonstore.MultiFormatStore.Format;
17-
import org.spdx.library.InvalidSPDXAnalysisException;
18+
import org.spdx.core.InvalidSPDXAnalysisException;
1819
import org.spdx.library.ModelCopyManager;
19-
import org.spdx.library.SpdxConstants;
20-
import org.spdx.library.model.ModelObject;
21-
import org.spdx.library.model.SpdxDocument;
22-
import org.spdx.library.model.SpdxElement;
23-
import org.spdx.library.model.SpdxModelFactory;
20+
import org.spdx.library.SpdxModelFactory;
21+
import org.spdx.library.model.v2.SpdxConstantsCompatV2;
22+
import org.spdx.library.model.v2.SpdxDocument;
23+
import org.spdx.library.model.v2.SpdxElement;
2424
import org.spdx.storage.ISerializableModelStore;
2525
import org.spdx.storage.simple.InMemSpdxStore;
2626

2727
/**
28-
* This example demonstrate opening an existing SPDX document and accessing it. The format
29-
* for this example is assumed to be JSON (e.g. the output of the SimpleSpdxDocument example).
28+
* This example demonstrate opening an existing SPDX spec version 2.X document and accessing it. The format
29+
* for this example is assumed to be JSON (e.g. the output of the SimpleSpdxDocumentV2Compat example).
3030
* Different format can be used by using the associated store rather than the spdx-jackson store
3131
* (e.g. spdx-spreadsheet-store, spdx-tagvalue-store, or the spdx-rdf-store).
3232
*
@@ -35,7 +35,7 @@
3535
* @author Gary O'Neall
3636
*
3737
*/
38-
public class ExistingSpdxDocument {
38+
public class ExistingSpdxDocumentV2Compat {
3939

4040
/**
4141
* @param args args[0] is the file path containing the SPDX document
@@ -74,10 +74,10 @@ public static void main(String[] args) {
7474
* license information over to the document model store
7575
*/
7676
ModelCopyManager copyManager = new ModelCopyManager();
77-
String documentUri = null;
7877
// Let's deseralize the document
7978
try (InputStream stream = new FileInputStream(inputFile)) {
80-
documentUri = modelStore.deSerialize(stream, false);
79+
modelStore.deSerialize(stream, false);
80+
8181
} catch (FileNotFoundException e1) {
8282
System.out.println("Input file does not exist: "+args[0]);
8383
System.exit(1);
@@ -90,22 +90,20 @@ public static void main(String[] args) {
9090
}
9191
// Now that the document is deserialized, we can access it using the SpdxModelFactory
9292
try {
93-
// To access the existing document, simply create the SPDX document passing in the
94-
// model store and document URI as parameters
95-
SpdxDocument document = new SpdxDocument(modelStore, documentUri, copyManager, false);
93+
// To find all the SPDX documents in the model store, use the getObjects method from the
94+
// SpdxModelFactory passing in the SpdxDocument type
95+
// When using the factory method, we have to type cast the result
96+
@SuppressWarnings("unchecked")
97+
List<SpdxDocument> allDocs = (List<SpdxDocument>) SpdxModelFactory.getSpdxObjects(modelStore, copyManager,
98+
SpdxConstantsCompatV2.CLASS_SPDX_DOCUMENT, null, null)
99+
.collect(Collectors.toList());
100+
SpdxDocument document = allDocs.get(0);
101+
String documentUri = document.getDocumentUri();
102+
// If you know the document URI, you can simply create an SPDX document using the followint constructor
103+
SpdxDocument document2 = new SpdxDocument(modelStore, documentUri, copyManager, false);
96104
// Note that all class objects in the Spdx Java Library follow the same pattern -
97105
// to access any existing object in the store, simply create the object passing in
98106
// the document URI, model store and the ID for the object
99-
100-
// Another (more cumbersome) approach is to use the model factory
101-
Optional<ModelObject> optionalDocument2 = SpdxModelFactory.getModelObject(modelStore, documentUri, SpdxConstants.SPDX_DOCUMENT_ID, copyManager);
102-
if (!optionalDocument2.isPresent()) {
103-
System.out.println("The SPDX document is not present in the model");
104-
// Note - this should never happen
105-
System.exit(1);
106-
}
107-
// When using the factory method, we have to type cast the result
108-
SpdxDocument document2 = (SpdxDocument)optionalDocument2.get();
109107
// Since the 2 documents are just references to the same object, they will always be equivalent
110108
if (!document.equivalent(document2)) {
111109
System.out.println("Oops - these 2 documents should be the same");

examples/org/spdx/examples/SimpleSpdxDocument.java renamed to examples/org/spdx/examples/SimpleSpdxDocumentV2Compat.java

Lines changed: 18 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -15,30 +15,29 @@
1515

1616
import org.spdx.jacksonstore.MultiFormatStore;
1717
import org.spdx.jacksonstore.MultiFormatStore.Format;
18-
import org.spdx.library.InvalidSPDXAnalysisException;
18+
import org.spdx.core.InvalidSPDXAnalysisException;
19+
import org.spdx.library.LicenseInfoFactory;
1920
import org.spdx.library.ModelCopyManager;
20-
import org.spdx.library.SpdxConstants;
21-
import org.spdx.library.model.Relationship;
22-
import org.spdx.library.model.SpdxDocument;
23-
import org.spdx.library.model.SpdxModelFactory;
24-
import org.spdx.library.model.SpdxPackage;
25-
import org.spdx.library.model.enumerations.RelationshipType;
26-
import org.spdx.library.model.license.AnyLicenseInfo;
27-
import org.spdx.library.model.license.LicenseInfoFactory;
21+
import org.spdx.library.model.v2.Relationship;
22+
import org.spdx.library.model.v2.SpdxConstantsCompatV2;
23+
import org.spdx.library.model.v2.SpdxDocument;
24+
import org.spdx.library.model.v2.SpdxPackage;
25+
import org.spdx.library.model.v2.enumerations.RelationshipType;
26+
import org.spdx.library.model.v2.license.AnyLicenseInfo;
2827
import org.spdx.storage.IModelStore.IdType;
2928
import org.spdx.storage.ISerializableModelStore;
3029
import org.spdx.storage.simple.InMemSpdxStore;
3130

3231
/**
33-
* This example demonstrate programmatically creating an SPDX document, adding document, files
32+
* This example demonstrate programmatically creating an SPDX spec version 2.X document, adding document, files
3433
* and saving the document in a JSON file format
3534
*
3635
* This example depends on the Spdx-Java-Library and the spdx-java-jackson store libraries
3736
*
3837
* @author Gary O'Neall
3938
*
4039
*/
41-
public class SimpleSpdxDocument {
40+
public class SimpleSpdxDocumentV2Compat {
4241

4342
/**
4443
* @param args args[0] is the file path to store the resultant JSON file
@@ -83,9 +82,9 @@ public static void main(String[] args) {
8382
ModelCopyManager copyManager = new ModelCopyManager();
8483
try {
8584
// Time to create the document
86-
SpdxDocument document = SpdxModelFactory.createSpdxDocument(modelStore, documentUri, copyManager);
85+
SpdxDocument document = new SpdxDocument(modelStore, documentUri, copyManager, false);
8786
// Let's add a few required fields to the document
88-
SimpleDateFormat dateFormat = new SimpleDateFormat(SpdxConstants.SPDX_DATE_FORMAT);
87+
SimpleDateFormat dateFormat = new SimpleDateFormat(SpdxConstantsCompatV2.SPDX_DATE_FORMAT);
8988
String creationDate = dateFormat.format(new Date());
9089
document.setCreationInfo(document.createCreationInfo(
9190
Arrays.asList(new String[] {"Tool: Simple SPDX Document Example"}),
@@ -96,7 +95,7 @@ public static void main(String[] args) {
9695
* above. These helper functions will use the same Document URI, Model Store and Model Copy Manager
9796
* as the document element.
9897
*/
99-
AnyLicenseInfo dataLicense = LicenseInfoFactory.parseSPDXLicenseString("CC0-1.0");
98+
AnyLicenseInfo dataLicense = LicenseInfoFactory.parseSPDXLicenseStringCompatV2("CC0-1.0");
10099
/*
101100
* Note that by passing in the modelStore and documentUri, the parsed license information is stored
102101
* in the same model store we are using for the document
@@ -106,9 +105,9 @@ public static void main(String[] args) {
106105
document.setSpecVersion("SPDX-2.2");
107106

108107
// Now that we have the basic document information filled in, let's create a package
109-
AnyLicenseInfo pkgConcludedLicense = LicenseInfoFactory.parseSPDXLicenseString("Apache-2.0 AND MIT");
110-
AnyLicenseInfo pkgDeclaredLicense = LicenseInfoFactory.parseSPDXLicenseString("Apache-2.0");
111-
String pkgId = modelStore.getNextId(IdType.SpdxId, documentUri);
108+
AnyLicenseInfo pkgConcludedLicense = LicenseInfoFactory.parseSPDXLicenseStringCompatV2("Apache-2.0 AND MIT");
109+
AnyLicenseInfo pkgDeclaredLicense = LicenseInfoFactory.parseSPDXLicenseStringCompatV2("Apache-2.0");
110+
String pkgId = modelStore.getNextId(IdType.SpdxId);
112111
// The ID's used for SPDX elements must be unique. Calling the model store getNextId function is a
113112
// convenient and safe method to make sure you have a correctly formatted and unique ID
114113
SpdxPackage pkg = document.createPackage(pkgId, "Example Package Name", pkgConcludedLicense,
@@ -128,7 +127,7 @@ public static void main(String[] args) {
128127
// This step will add a relationship between document and pkg as "DESCRIBES".
129128
document.getDocumentDescribes().add(pkg);
130129
// Let's create another package
131-
pkgId = modelStore.getNextId(IdType.SpdxId, documentUri);
130+
pkgId = modelStore.getNextId(IdType.SpdxId);
132131
SpdxPackage childPkg = document.createPackage(pkgId, "Child Example Package Name", pkgConcludedLicense,
133132
"Copyright example.org", pkgDeclaredLicense)
134133
.setFilesAnalyzed(false) // Default is true and we don't want to add all the required fields
@@ -150,7 +149,7 @@ public static void main(String[] args) {
150149
}
151150
// Last step is to serialize
152151
try (OutputStream outputStream = new FileOutputStream(outFile)) {
153-
modelStore.serialize(documentUri, outputStream);
152+
modelStore.serialize(outputStream);
154153
}
155154
System.out.println("Example document written to "+args[0]);
156155
System.exit(0);

‎pom.xml‎

Lines changed: 26 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33

44
<groupId>org.spdx</groupId>
55
<artifactId>tools-java</artifactId>
6-
<version>1.1.9-SNAPSHOT</version>
6+
<version>2.0.0-SNAPSHOT</version>
77
<packaging>jar</packaging>
88

99
<name>tools-java</name>
@@ -55,7 +55,7 @@
5555
<sonar.host.url>https://sonarcloud.io</sonar.host.url>
5656
<sonar.organization>spdx</sonar.organization>
5757
<sonar.projectKey>tools-java</sonar.projectKey>
58-
<dependency-check-maven.version>8.0.1</dependency-check-maven.version>
58+
<dependency-check-maven.version>8.4.3</dependency-check-maven.version>
5959
<maven.compiler.release>11</maven.compiler.release>
6060
<javadoc.opts>-Xdoclint:none</javadoc.opts>
6161
</properties>
@@ -101,6 +101,16 @@
101101
</profile>
102102
</profiles>
103103
<dependencies>
104+
<dependency>
105+
<groupId>commons-io</groupId>
106+
<artifactId>commons-io</artifactId>
107+
<version>2.16.1</version>
108+
</dependency>
109+
<dependency>
110+
<groupId>org.apache.commons</groupId>
111+
<artifactId>commons-compress</artifactId>
112+
<version>1.27.1</version>
113+
</dependency>
104114
<dependency>
105115
<groupId>junit</groupId>
106116
<artifactId>junit</artifactId>
@@ -110,17 +120,17 @@
110120
<dependency>
111121
<groupId>org.spdx</groupId>
112122
<artifactId>java-spdx-library</artifactId>
113-
<version>1.1.10</version>
123+
<version>2.0.0-Alpha</version>
114124
</dependency>
115125
<dependency>
116126
<groupId>org.spdx</groupId>
117127
<artifactId>spdx-rdf-store</artifactId>
118-
<version>1.1.9</version>
128+
<version>2.0.0-Alpha</version>
119129
</dependency>
120130
<dependency>
121131
<groupId>org.spdx</groupId>
122132
<artifactId>spdx-jackson-store</artifactId>
123-
<version>1.1.9</version>
133+
<version>2.0.0-Alpha</version>
124134
</dependency>
125135
<dependency>
126136
<groupId>org.apache.ws.xmlschema</groupId>
@@ -130,24 +140,29 @@
130140
<dependency>
131141
<groupId>org.spdx</groupId>
132142
<artifactId>spdx-spreadsheet-store</artifactId>
133-
<version>1.1.7</version>
143+
<version>2.0.0-Alpha</version>
134144
</dependency>
135145
<dependency>
136146
<groupId>org.spdx</groupId>
137147
<artifactId>spdx-tagvalue-store</artifactId>
138-
<version>1.1.7</version>
148+
<version>2.0.0-Alpha</version>
139149
</dependency>
140150
<dependency>
141-
<groupId>com.github.java-json-tools</groupId>
151+
<groupId>com.networknt</groupId>
142152
<artifactId>json-schema-validator</artifactId>
143-
<version>2.2.14</version>
153+
<version>1.5.1</version>
144154
</dependency>
145155
<dependency>
146156
<groupId>org.slf4j</groupId>
147157
<artifactId>slf4j-simple</artifactId>
148-
<version>2.0.7</version>
158+
<version>2.0.13</version>
149159
<optional>true</optional>
150160
</dependency>
161+
<dependency>
162+
<groupId>org.spdx</groupId>
163+
<artifactId>spdx-v3jsonld-store</artifactId>
164+
<version>0.1.0-Alpha</version>
165+
</dependency>
151166
</dependencies>
152167
<build>
153168
<resources>
@@ -299,7 +314,7 @@
299314
<plugin>
300315
<groupId>org.spdx</groupId>
301316
<artifactId>spdx-maven-plugin</artifactId>
302-
<version>0.7.2</version>
317+
<version>0.7.3</version>
303318
<executions>
304319
<execution>
305320
<id>build-spdx</id>

0 commit comments

Comments
 (0)