Skip to content

Commit

Permalink
Merge branch 'spdx:master' into patch-3
Browse files Browse the repository at this point in the history
  • Loading branch information
@bact
bact authored Jun 17, 2024
2 parents 218b9bc + 74b7c5f commit bd6f2b5
Show file tree
Hide file tree
Showing 6 changed files with 1,050 additions and 5 deletions.
48 changes: 43 additions & 5 deletions .github/workflows/pull_request.yml
View file
Original file line number Diff line number Diff line change
@@ -1,18 +1,56 @@
name: SPDX validation
on: pull_request
on:
- pull_request
- push

jobs:
SPDX_Validation:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Setup

- name: Look for files that are not checked
run: |
find . \( -name '*.spdx' -o -name '*.json' \) \
-not -path './presentations/*' \
-not -path './tools-java/*' \
-not -path '*/spdx2.2/*' \
-not -path '*/spdx2.3/*' \
-not -path '*/spdx-3.0/*' | tee flist.txt
test "$(cat flist.txt | wc -l)" = "0"
- name: Update apt
run: |
sudo apt update -y
- name: Setup Java tools
run: |
sudo apt install -y default-jdk maven
git clone https://github.com/spdx/tools-java.git && cd tools-java
export JAVA_HOME=$(readlink -f /usr/bin/javac | sed "s:/bin/javac::")
mvn clean install && cd ..
- name: Validate SPDX Documents
- name: Setup Python tools
run: |
python3 -m pip install -U pip
python3 -m pip install \
check-jsonschema \
pyshacl
- name: Validate SPDX 2.2 & SPDX 2.3 Documents
run: |
find . -name *.spdx -o -name *.json -exec echo {} \; -exec java -jar tools-java/target/tools-java-*-jar-with-dependencies.jar Verify {} \;
find . \( -path '*/spdx2.2/*' -o -path '*/spdx2.3/*' \) \( -name *.spdx -o -name *.json \) \
-exec echo {} \; \
-exec java -jar tools-java/target/tools-java-*-jar-with-dependencies.jar Verify {} \;
- name: Validate SPDX 3.0 Documents
run: |
SPDX30_SCHEMA_URL="https://spdx.org/schema/3.0.0/spdx-json-schema.json"
SPDX30_SHACL_URL="https://spdx.org/rdf/3.0.0/spdx-model.ttl"
for f in $(find . -type f -path '*/spdx-3.0/*.json'); do
echo "Checking $f..."
check-jsonschema -v --schemafile $SPDX30_SCHEMA_URL $f
pyshacl -s $SPDX30_SHACL_URL -e $SPDX30_SHACL_URL $f
done
2 changes: 2 additions & 0 deletions software/README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -30,4 +30,6 @@ Each directory contains build metadata which is used to create the build artifac
| 9 | 2 Java files | generated from Gradle | 1 document |a copy of the [App-BOM-ination SPDX example](https://github.com/yevster/App-BOM-ination) contributed by @yevster for the SPDX spec version 2.0 docfest |
| 10 | 1 Python file | python package | 1 document | packaged using the [instructions from python.org](https://packaging.python.org/en/latest/tutorials/packaging-projects/) |
| 11 | 1 Rust file | compiled with Cargo | 1 document | SBOM describing both source and artifact, related with GENERATED_FROM |
| 12 | 1 Ruby library | built using `bundle` | 1 document | SBOM describing Ruby library packaged in a gem |
| 13 | Bundled app with a package and container | No compiling - hypothetical example | Documents in progress | SBOM describing a hypothetical "Acme Aplication" |

7 changes: 7 additions & 0 deletions software/example13/README.md
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
# Example 13

## Description

This is a hypothetical example of a "simple" piece of software, Acme Application version 1.3. This example shows what an SPDX-3.0 document looks like for said Acme Application. The idea for this example is that other profiles will be able to build on top of this and demonstrate how all the profiles can work in harmony.

In this specific example, Acme Application is a bundled and distributed piece of software. When Acme Application is run, it pulls in the `alpine:latest` container image which runs in parallel to the `npm-elliptic` library that is packaged and distributed within the Acme Application binary. Among others not depicted for the sake of simplicity, `openssl` is a package included in the `alpine:latest` container image. The example-13 SBOM describes the Acme Application top level piece of software.
Binary file added software/example13/example-13.png
View file
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
153 changes: 153 additions & 0 deletions software/example13/spdx-3.0/example-13-spdx-3.json
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,153 @@
{
"@context": "https://spdx.org/rdf/3.0.0/spdx-context.jsonld",
"@graph": [
{
"type": "Person",
"spdxId": "urn:[email protected]",
"creationInfo": "_:creationinfo",
"name": "Application Owner Jane Doe",
"externalIdentifier": [
{
"type": "ExternalIdentifier",
"externalIdentifierType": "email",
"identifier": "[email protected]"
}
]
},
{
"type": "Organization",
"spdxId": "urn:acme.com-4fe40e24-20e3-11ee-be56-0242ac120002",
"creationInfo": "_:creationinfo",
"name": "Acme Company"
},
{
"type": "Person",
"spdxId": "urn:github.com-indutny-c4fe40e24-20e3-11ee-be56-0242ac120002",
"creationInfo": "_:creationinfo",
"name": "Fedor Indutny",
"externalIdentifier": [
{
"type": "ExternalIdentifier",
"externalIdentifierType": "other",
"identifier": "https://github.com/indutny"
}
]
},
{
"type": "Organization",
"spdxId": "urn:github.com-alpinelinux-4fe40e24-20e3-11ee-be56-0242ac120002",
"creationInfo": "_:creationinfo",
"name": "Alpine Linux"

},
{
"type": "CreationInfo",
"@id": "_:creationinfo",
"specVersion": "3.0.0",
"createdBy": [
"urn:[email protected]",
"urn:acme.com-4fe40e24-20e3-11ee-be56-0242ac120002"
],
"created": "2024-05-02T00:00:00Z"
},
{
"type": "SpdxDocument",
"spdxId": "http://spdx.example.com/Document1",
"creationInfo": "_:creationinfo",
"profileConformance": [
"core",
"software"
],
"rootElement": [
"urn:example13-sbom.com-4fe40e24-20e3-11ee-be56-0242ac120002"
]
},
{
"type": "software_Sbom",
"spdxId": "urn:example13-sbom.com-4fe40e24-20e3-11ee-be56-0242ac120002",
"creationInfo": "_:creationinfo",
"profileConformance": [
"core",
"software"
],
"rootElement": [
"urn:product-acme-application-1.3-4fe40e24-20e3-11ee-be56-0242ac120002"
]
},
{
"type": "software_Package",
"spdxId": "urn:product-acme-application-1.3-4fe40e24-20e3-11ee-be56-0242ac120002",
"creationInfo": "_:creationinfo",
"name": "Acme Application",
"software_packageVersion": "1.3",
"suppliedBy": "urn:acme.com-4fe40e24-20e3-11ee-be56-0242ac120002",
"software_primaryPurpose": "application"
},
{
"type": "software_Package",
"spdxId": "urn:npm-elliptic-6.5.2-4fe40e24-20e3-11ee-be56-0242ac120002",
"creationInfo": "_:creationinfo",
"name": "npm-elliptic",
"software_packageVersion": "6.5.2",
"suppliedBy": "urn:github.com-indutny-c4fe40e24-20e3-11ee-be56-0242ac120002",
"software_primaryPurpose": "library",
"externalIdentifier": [
{
"type": "ExternalIdentifier",
"externalIdentifierType": "other",
"identifier": "https://github.com/indutny/elliptic/releases/tag/v6.5.2"
}
]

},
{
"type": "software_Package",
"spdxId": "urn:container-alpine-latest-sha256:69665d02cb32192e52e07644d76bc6f25abeb5410edc1c7a81a10ba3f0efb90a-4fe40e24-20e3-11ee-be56-0242ac120002",
"creationInfo": "_:creationinfo",
"name": "alpine:latest",
"software_packageVersion": "69665d02cb32192e52e07644d76bc6f25abeb5410edc1c7a81a10ba3f0efb90a",
"suppliedBy": "urn:github.com-alpinelinux-4fe40e24-20e3-11ee-be56-0242ac120002",
"software_primaryPurpose": "container"
},
{
"type": "software_Package",
"spdxId": "urn:openssl-3.0.4-4fe40e24-20e3-11ee-be56-0242ac120002",
"creationInfo": "_:creationinfo",
"name": "openssl",
"software_packageVersion": "3.0.4",
"software_primaryPurpose": "library"
},
{
"type": "Relationship",
"spdxId": "urn:acme-relationship-1-4fe40e24-20e3-11ee-be56-0242ac120002",
"creationInfo": "_:creationinfo",
"from": "urn:product-acme-application-1.3-4fe40e24-20e3-11ee-be56-0242ac120002",
"to": ["urn:[email protected]"],
"relationshipType": "availableFrom"
},
{
"type": "Relationship",
"spdxId": "urn:acme-relationship-2-4fe40e24-20e3-11ee-be56-0242ac120002",
"creationInfo": "_:creationinfo",
"from": "urn:product-acme-application-1.3-4fe40e24-20e3-11ee-be56-0242ac120002",
"to": ["urn:npm-elliptic-6.5.2-4fe40e24-20e3-11ee-be56-0242ac120002"],
"relationshipType": "contains"
},
{
"type": "Relationship",
"spdxId": "urn:acme-relationship-3-4fe40e24-20e3-11ee-be56-0242ac120002",
"creationInfo": "_:creationinfo",
"from": "urn:product-acme-application-1.3-4fe40e24-20e3-11ee-be56-0242ac120002",
"to": ["urn:container-alpine-latest-sha256:69665d02cb32192e52e07644d76bc6f25abeb5410edc1c7a81a10ba3f0efb90a-4fe40e24-20e3-11ee-be56-0242ac120002"],
"relationshipType": "dependsOn"
},
{
"type": "Relationship",
"spdxId": "urn:acme-relationship-4-4fe40e24-20e3-11ee-be56-0242ac120002",
"creationInfo": "_:creationinfo",
"from": "urn:container-alpine-latest-sha256:69665d02cb32192e52e07644d76bc6f25abeb5410edc1c7a81a10ba3f0efb90a-4fe40e24-20e3-11ee-be56-0242ac120002",
"to": ["urn:openssl-3.0.4-4fe40e24-20e3-11ee-be56-0242ac120002"],
"relationshipType": "contains"
}
]
}
Loading

0 comments on commit bd6f2b5

Please sign in to comment.