Add SPDX 3.0 for example7 #85

nishakm · 2024-06-10T13:43:07Z

No description provided.

nishakm · 2024-06-10T13:44:45Z

@JPEWdev @kzantow

nishakm · 2024-06-10T13:57:26Z

My questions:

Does xsd:anyURI mean a URI or a URN? If URN, is there a recommended way of generating these?
If we were generating URNs for every spdxId for every SPDX document, what happens when the same person generates a different URNs for the same thing?
How do we encode the license info in SPDX 2?
What dataLicense do we use for SPDX3?
How do we encode "document describes" relationship?
How do we encode "manual creation"?
Should the name of the document include the file extension? How do we manage the document naming during generation?

maxhbr · 2024-06-10T14:03:11Z

This is a draft but reviews are requested?

maxhbr

A rendered puml for the file (with the suggestions applied):

maxhbr · 2024-06-10T14:20:32Z

software/example7/spdx3.0/example7-golang.spdx.jsonld

+    },
+    {
+      "spdxId": "https://golang.org/dl/go1.16.4.linux-amd64.tar.gz",
+      "type": "Software_Package",


Suggested change

"type": "Software_Package",

"type": "software_Package",

maxhbr · 2024-06-10T14:21:03Z

software/example7/spdx3.0/example7-golang.spdx.jsonld

+    },
+    {
+      "spdxId": "https://golang.org/dl/go-compiler",
+      "type": "Software_File",


Suggested change

"type": "Software_File",

"type": "software_File",

maxhbr · 2024-06-10T14:21:26Z

software/example7/spdx3.0/example7-golang.spdx.jsonld

+        "software"
+      ],
+      "dataLicense": "CC0-1.0",
+      "createdUsing": [


createdUsing seems to not be valid here. At least it trips the validator.

Hmm...this file was created manually, not using any tool. How do we state that here?

created using is a property of the creationInfo, not any element. It explains how the SPDX file was created.

software/example7/spdx3.0/example7-golang.spdx.jsonld

nishakm · 2024-06-10T16:57:24Z

This is a draft but reviews are requested?

It's a first pass review to iron out the obvious mistakes. I'll convert it into an actual PR after I get feedback. Thanks a bunch!

software/example7/spdx3.0/example7-golang.spdx.jsonld

JPEWdev · 2024-06-10T19:53:04Z

#86 Will make it so that automatic validation is done on pull requests

software/example7/spdx3.0/example7-go-module.spdx.jsonld

nishakm · 2024-06-12T15:39:05Z

My questions:

* Does xsd:anyURI mean a URI or a URN? If URN, is there a recommended way of generating these?

You can make a URI with a UUID. If you don't own your own domain use: https://spdx.org/spdxdocs/-UUID
Or https://spdx.org/spdxdocs/UUID#SPDXId-

* If we were generating URNs for every spdxId for every SPDX document, what happens when the same person generates a different URNs for the same thing?

Referencing the same object that is referenced somewhere use and externalID. Don't worry about multiple UUIDs referencing the same thing.

Resolving the two different objects is fraught. They are in the end two different elements. Content identifiers can help but they are not the same thing. Equivalent but not equal.

* How do we encode the license info in SPDX 2?

Use SimpleLicensing > SimpleLicensingText

For Copyright text use Software > copyrightText

* What `dataLicense` do we use for SPDX3?

dataLicense is optional but CC0 is typically the one we use

* How do we encode "document describes" relationship?

You don't need it. The element list covers it.

Technically, the SpdxDocument.element should contain all SPDXIDs in the file except itself, but it is accepted that @graph is equivalent. This is not the case for any other container object.

* How do we encode "manual creation"?

Don't include this. If the document is not created by a tool there will be no Tool element in the CreationInfo.

* Should the name of the document include the file extension? How do we manage the document naming during generation?

The file name doesn't matter. Meanwhile, the files can have the .json file extension. Once parsing you can create a relationship SerializedInArtifact as a relationship.

ilans · 2024-08-01T02:11:23Z

software/example7/spdx3.0/example7-go-module.spdx.jsonld

+      "element": [
+        "urn:uuid:cf7dddac-8ce5-4a16-8860-ee255be7b4c8",
+        "urn:uuid:a9f18ff3-17fa-419d-8966-abe4b992312b",
+        "urn:uuid:d8bfb4bd-f3b9-4d5e-b83d-dd48038ecfde",


remove the comma

ilans · 2024-08-01T02:11:37Z

software/example7/spdx3.0/example7-go-module.spdx.jsonld

+      "comment": "The SBOM communicates that this document is an SBOM. The SBOM only has one element",
+      "rootElement": [
+        "urn:uuid:a9f18ff3-17fa-419d-8966-abe4b992312b"
+      ]


add a comma

ilans · 2024-08-01T02:14:11Z

software/example7/spdx3.0/example7-go-module.spdx.jsonld

+      ]
+      "element": [
+        "urn:uuid:cf7dddac-8ce5-4a16-8860-ee255be7b4c8",
+        "urn:uuid:a9f18ff3-17fa-419d-8966-abe4b992312b",


Same as above, you probably meant:
"urn:uuid:e1877974-0aaa-48e6-931f-db4898c543f8"

ilans · 2024-08-01T02:15:29Z

software/example7/spdx3.0/example7-go-module.spdx.jsonld

ilans · 2024-08-01T02:18:24Z

software/example7/spdx3.0/example7-go-module.spdx.jsonld

+      "creationInfo": "_:creationInfo",
+      "comment": "The SBOM communicates that this document is an SBOM. The SBOM only has one element",
+      "rootElement": [
+        "urn:uuid:a9f18ff3-17fa-419d-8966-abe4b992312b"


Wrong spdxId. Assuming you intended to set the package spdxId, set:
"urn:uuid:e1877974-0aaa-48e6-931f-db4898c543f8"

nishakm · 2024-08-07T03:16:32Z

@JPEWdev @maxhbr @goneall @ilans This is ready for review.

Questions from me:

Although the person is the same, their SPDXID is different in each of the documents. I'm wondering if tools should strive to make this one SPDXID across all documents a person or organization should create or just generate UUIDs each time it executes?
I didn't see a "BUILD_TOOL_OF" equivalent in SPDX 3, so I made a stub "Build" element and expressed that relationship as inputs and outputs.

software/example7/spdx-3.0/example7-third-party-modules.spdx.json

nishakm · 2024-08-09T14:04:55Z

@JPEWdev @maxhbr @goneall @ilans This is ready for review.

Note: the validator cannot validate ExternalMap elements yet. So I will need some manual review of example7-bin.spdx.json.

software/example7/spdx-3.0/example7-bin.spdx.json

kestewart · 2024-08-20T16:16:17Z

Pending validator fixes, this is expected to pass. Waiting for merge before rechecing.

kestewart · 2024-08-20T16:25:47Z

@nishakm - can you rebase so the checks pass (merged in Josh's fix)

Signed-off-by: Nisha Kumar <[email protected]>

- Use URN instead of URI for spdxId - Fix capitalization on types - Move `createdUsing` to `CreationInfo` object Signed-off-by: Nisha Kumar <[email protected]>

Signed-off-by: Nisha Kumar <[email protected]>

- Remove "createdUsing" as these files are manually created - "rootElement" is a list - "element" in the SBOM element is a list of all elements in the SBOM Signed-off-by: Nisha Kumar <[email protected]>

Signed-off-by: Nisha Kumar <[email protected]>

- Remove Organization element - Fix root element and element list uuids Signed-off-by: Nisha Kumar <[email protected]>

Signed-off-by: Nisha Kumar <[email protected]>

- Add specVersion to creationInfo object - Only one context allowed - originatedBy is an array - dataLicense is not required - Fix element list in example7-third-party-modules.spdx.json - Remove build conformance (requires more information about the build) Signed-off-by: Nisha Kumar <[email protected]>

- Recalculate hashes for ExternalMap - Remove Build element - Update relationships - Remove Build id from element list - Move all ExternalMap elements to SpdxDocument "imports" Signed-off-by: Nisha Kumar <[email protected]>

Signed-off-by: Nisha Kumar <[email protected]>

nishakm · 2024-09-25T21:16:12Z

@kestewart Done! Ready to merge

goneall · 2024-09-26T13:18:01Z

Thanks @nishakm - I'll go ahead and merge.

We may need to do some updates once we get the validation updated to 3.0.1, but we can take care of that after we update the validation.

nishakm marked this pull request as draft June 10, 2024 13:43

nishakm requested review from goneall and maxhbr June 10, 2024 13:43

maxhbr requested changes Jun 10, 2024

View reviewed changes

software/example7/spdx3.0/example7-golang.spdx.jsonld Outdated Show resolved Hide resolved

maxhbr reviewed Jun 10, 2024

View reviewed changes

software/example7/spdx3.0/example7-golang.spdx.jsonld Outdated Show resolved Hide resolved

maxhbr reviewed Jun 10, 2024

View reviewed changes

software/example7/spdx3.0/example7-golang.spdx.jsonld Outdated Show resolved Hide resolved

nishakm commented Jun 12, 2024

View reviewed changes

software/example7/spdx3.0/example7-go-module.spdx.jsonld Outdated Show resolved Hide resolved

ilans reviewed Aug 1, 2024

View reviewed changes

nishakm force-pushed the example7-spdx3 branch 2 times, most recently from 3cc3127 to dff9a0f Compare August 6, 2024 00:31

nishakm marked this pull request as ready for review August 7, 2024 03:11

nishakm changed the title ~~WIP: Add SPDX 3.0 for example7~~ Add SPDX 3.0 for example7 Aug 7, 2024

nishakm force-pushed the example7-spdx3 branch 4 times, most recently from 67b1c05 to ff5b79b Compare August 7, 2024 17:58

JPEWdev reviewed Aug 7, 2024

View reviewed changes

software/example7/spdx-3.0/example7-third-party-modules.spdx.json Outdated Show resolved Hide resolved

nishakm force-pushed the example7-spdx3 branch 3 times, most recently from 55065d2 to 9ccf7ad Compare August 8, 2024 15:42

nishakm requested a review from maxhbr August 8, 2024 18:07

JPEWdev reviewed Aug 9, 2024

View reviewed changes

software/example7/spdx-3.0/example7-bin.spdx.json Outdated Show resolved Hide resolved

software/example7/spdx-3.0/example7-bin.spdx.json Outdated Show resolved Hide resolved

nishakm force-pushed the example7-spdx3 branch from 9ccf7ad to 1ae83ba Compare August 9, 2024 17:55

nishakm added 11 commits September 25, 2024 13:43

Add SPDX 3.0 for example7

78718e7

Signed-off-by: Nisha Kumar <[email protected]>

Basic updates: fix glaring mistakes

53c620b

- Use URN instead of URI for spdxId - Fix capitalization on types - Move `createdUsing` to `CreationInfo` object Signed-off-by: Nisha Kumar <[email protected]>

Add SPDX 3.0 JSONLD document for a go module

cb9caa6

Signed-off-by: Nisha Kumar <[email protected]>

example7: spdx3.0: Modifications to schema

2219fd6

- Remove "createdUsing" as these files are manually created - "rootElement" is a list - "element" in the SBOM element is a list of all elements in the SBOM Signed-off-by: Nisha Kumar <[email protected]>

Fix JSON parsing errors

0854158

Signed-off-by: Nisha Kumar <[email protected]>

Fix elements

d07093e

- Remove Organization element - Fix root element and element list uuids Signed-off-by: Nisha Kumar <[email protected]>

Add example 7 third party modules

13bf520

Signed-off-by: Nisha Kumar <[email protected]>

Add binary JSONLD document

298156a

Signed-off-by: Nisha Kumar <[email protected]>

Rename .jsonld to .json and the folder to spdx-3.0

30a8ae0

Signed-off-by: Nisha Kumar <[email protected]>

Updates to example7 binary sbom

23abdcc

- Recalculate hashes for ExternalMap - Remove Build element - Update relationships - Remove Build id from element list - Move all ExternalMap elements to SpdxDocument "imports" Signed-off-by: Nisha Kumar <[email protected]>

nishakm force-pushed the example7-spdx3 branch from 1ae83ba to 23abdcc Compare September 25, 2024 20:43

Move files back to folder called spdx3.0

4a9291b

Signed-off-by: Nisha Kumar <[email protected]>

nishakm mentioned this pull request Sep 25, 2024

Add SPDX 3 format example for software/example1 #101

Merged

goneall merged commit 6f8f8bf into spdx:master Sep 26, 2024
1 check passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add SPDX 3.0 for example7 #85

Add SPDX 3.0 for example7 #85

nishakm commented Jun 10, 2024

nishakm commented Jun 10, 2024

nishakm commented Jun 10, 2024 •

edited

Loading

maxhbr commented Jun 10, 2024

maxhbr left a comment

maxhbr Jun 10, 2024

maxhbr Jun 10, 2024

maxhbr Jun 10, 2024

nishakm Jun 10, 2024

maxhbr Jun 10, 2024

nishakm commented Jun 10, 2024

JPEWdev commented Jun 10, 2024

nishakm commented Jun 12, 2024

ilans Aug 1, 2024

ilans Aug 1, 2024

ilans Aug 1, 2024

ilans Aug 1, 2024

ilans Aug 1, 2024

nishakm commented Aug 7, 2024

nishakm commented Aug 9, 2024

kestewart commented Aug 20, 2024

kestewart commented Aug 20, 2024

nishakm commented Sep 25, 2024

goneall commented Sep 26, 2024

Add SPDX 3.0 for example7 #85

Add SPDX 3.0 for example7 #85

Conversation

nishakm commented Jun 10, 2024

nishakm commented Jun 10, 2024

nishakm commented Jun 10, 2024 • edited Loading

maxhbr commented Jun 10, 2024

maxhbr left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nishakm commented Jun 10, 2024

JPEWdev commented Jun 10, 2024

nishakm commented Jun 12, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nishakm commented Aug 7, 2024

nishakm commented Aug 9, 2024

kestewart commented Aug 20, 2024

kestewart commented Aug 20, 2024

nishakm commented Sep 25, 2024

goneall commented Sep 26, 2024

nishakm commented Jun 10, 2024 •

edited

Loading