Add SPDX 2.2.1 support (SBOM) #296
Conversation
ras0219-msft
force-pushed
the
dev/roschuma/sbom
branch
2 times, most recently
from
140c546 to
ea355cc
Compare
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
ras0219-msft
force-pushed
the
dev/roschuma/sbom
branch
from
ea355cc to
c157e31
Compare
|
This is an incredible amount of code for just updating to SPDX 2.2.1; what's actually going on here? |
ras0219-msft
force-pushed
the
dev/roschuma/sbom
branch
from
c157e31 to
41bdf76
Compare
strega-nil-ms
force-pushed
the
dev/roschuma/sbom
branch
2 times, most recently
from
7e88c85 to
934c870
Compare
src/vcpkg/spdx.cpp
Outdated
| } | ||
|
|
||
| static bool is_cmake_whitespace(int ch) { return ch == ' ' || ch == '\n' || ch == '\t' || ch == '\r'; } | ||
| static bool is_cmake_identifier(int ch) |
There was a problem hiding this comment.
what is this for? this function does not include all of CMake's "identifiers" (by which I assume you mean "identifiers that can be included in ${...} syntax"). It is missing /_+-, and escape sequences.
edit: oh, identifier is what CMake calls their command names. I'd like a comment here if possible.
Also, this should take a char32_t or raw char.
There was a problem hiding this comment.
My intent with these "heuristics" was entirely as a point-in-time/proof-of-concept stop gap until our standard helpers can be instrumented to emit resource documents. At that point, these heuristics should be retired since they're hopelessly outclassed (can't handle variable substitution, can't detect data-dependent paths).
Therefore I wanted to minimize sharing and refactoring of other parts of the codebase, since I hope to delete these entirely.
| obj.insert("downloadLocation", "NONE"); | ||
| obj.insert("licenseConcluded", conclude_license(cpgh.license.value_or(""))); | ||
| obj.insert("licenseDeclared", noassert); | ||
| obj.insert("copyrightText", noassert); |
There was a problem hiding this comment.
should this include <installed>/share/<port>/copyright?
There was a problem hiding this comment.
For now I wanted to get basic stuff in place and see what additional data is required after. For example, maybe we can use the SPDX license "go look in that file" instead of having to copy the entire text.
strega-nil-ms
changed the title
ras0219-msft
force-pushed
the
dev/roschuma/sbom
branch
from
fc23fd9 to
72c5ab1
Compare
See https://spdx.github.io/spdx-spec/ for more details.
Depends on #323