Merge pull request #576 from enzbang/enhance-spdx-support

Enhance spdx support

Author: enzbang

src/e3/spdx.py

@@ -384,6 +384,15 @@ class PackageLicenseConcluded(SPDXEntryMaybeStr):
     json_entry_key = "licenseConcluded"
 
 
+class PackageLicenseComments(SPDXEntryMaybeStrMultilines):
+    """Cecord background information or analysis for the Concluded License.
+
+    See 7.16 Comments on license field
+    """
+
+    json_entry_key = "licenseComments"
+
+
 class PackageLicenseDeclared(SPDXEntryMaybeStr):
     """Contain the license having been declared by the authors of the package.
 
@@ -417,7 +426,7 @@ class ExternalRef(SPDXEntry):
     See 7.21 External reference field
     """
 
-    json_entry_key = "external-refs"
+    json_entry_key = "externalRefs"
 
     def __init__(
         self,
@@ -624,6 +633,7 @@ class Package(SPDXSection):
     copyright_text: PackageCopyrightText
     files_analyzed: FilesAnalyzed
     license_concluded: PackageLicenseConcluded
+    license_comments: PackageLicenseComments | None
     license_declared: PackageLicenseDeclared | None
     download_location: PackageDownloadLocation
     external_refs: list[ExternalRef] | None
@@ -695,6 +705,7 @@ def add_package(
         download_location: str,
         files_analyzed: bool,
         copyright_text: str,
+        license_comments: str | None = None,
         license_declared: str | None = None,
         is_main_package: bool = False,
         add_relationship: bool = True,
@@ -707,6 +718,7 @@ def add_package(
         :param file_name: the actual file name of the package
         :param checksum: the package checksum (see SHA1, SHA256 classes)
         :param license_concluded: the license concluded as govering the package
+        :param license_comments: comments for the license_concluded field
         :param license_declared: the license declared in the package
         :param supplier: actual distribution source for the package
         :param originator: this field identifies from where or whom the package
@@ -753,6 +765,9 @@ def add_package(
             file_name=PackageFileName(file_name),
             checksum=checksum,
             license_concluded=PackageLicenseConcluded(license_concluded),
+            license_comments=PackageLicenseComments(license_comments)
+            if license_comments is not None
+            else None,
             license_declared=PackageLicenseDeclared(license_declared)
             if license_declared is not None
             else None,

tests/tests_e3/spdx_test.py

@@ -44,7 +44,7 @@ def test_external_ref():
         == "ExternalRef: PACKAGE-MANAGER purl pkg:pypi/wheel@0.36.2"
     )
     assert ExternalRef.from_dict(value).to_json_dict() == {
-        "external-refs": {
+        "externalRefs": {
             "referenceCategory": "PACKAGE-MANAGER",
             "referenceLocator": "pkg:pypi/wheel@0.36.2",
             "referenceType": "purl",
@@ -91,6 +91,7 @@ def test_spdx():
             SHA1("6876df3aa8780622368173fe6e868a2edc3932c8"),
         ],
         license_concluded="GPL-3.0-or-later",
+        license_comments="Pretty sure this is GPL v3",
         supplier=Organization("AdaCore"),
         originator=Organization("AdaCore"),
         download_location=NOASSERTION,
@@ -203,6 +204,7 @@ def test_spdx():
         "PackageCopyrightText: <text>2023 AdaCore</text>",
         "FilesAnalyzed: false",
         "PackageLicenseConcluded: GPL-3.0-or-later",
+        "PackageLicenseComments: <text>Pretty sure this is GPL v3</text>",
         "PackageDownloadLocation: NOASSERTION",
         "ExternalRef: PACKAGE-MANAGER purl pkg:generic/my-dep@1b2",
         "",
@@ -286,7 +288,7 @@ def test_spdx():
                 ],
                 "copyrightText": "2023 AdaCore",
                 "downloadLocation": "NOASSERTION",
-                "external-refs": [
+                "externalRefs": [
                     {
                         "referenceCategory": "PACKAGE-MANAGER",
                         "referenceLocator": "pkg:generic/my-dep@1b2",
@@ -295,6 +297,7 @@ def test_spdx():
                 ],
                 "packageFileName": "my-dep-1b2.tgz",
                 "licenseConcluded": "GPL-3.0-or-later",
+                "licenseComments": "Pretty sure this is GPL v3",
                 "name": "my-dep",
                 "originator": "Organization: AdaCore",
                 "supplier": "Organization: AdaCore",