3 # SPDX-License-Identifier: Apache-2.0
14     r'^cpe:2\.3:[aho\*\-](:(((\?*|\*?)([a-zA-Z0-9\-\._]|(\\[\\\*\?!"#$$%&\'\(\)\+,\/:;<=>@\[\]\^'
15 …  r"`\{\|}~]))+(\?*|\*?))|[\*\-])){5}(:(([a-zA-Z]{2,3}(-([a-zA-Z]{2}|[0-9]{3}))?)|[\*\-]))(:(((\?*"
16 …r'|\*?)([a-zA-Z0-9\-\._]|(\\[\\\*\?!"#$$%&\'\(\)\+,\/:;<=>@\[\]\^`\{\|}~]))+(\?*|\*?))|[\*\-])){4}…
21     # Replace "_" by "-" since it's not allowed in spdx ID
22     return name.replace("_", "-")
24 # Output tag-value SPDX 2.3 content for the given Relationship object.
26 #   1) f: file handle for SPDX document
28 def writeRelationshipSPDX(f, rln):  argument
29 …f.write(f"Relationship: {_normalize_spdx_name(rln.refA)} {rln.rlnType} {_normalize_spdx_name(rln.r…
31 # Output tag-value SPDX 2.3 content for the given File object.
33 #   1) f: file handle for SPDX document
35 def writeFileSPDX(f, bf):  argument
38     f.write(f"""FileName: ./{bf.relpath}
43         f.write(f"FileChecksum: SHA256: {bf.sha256}\n")
45         f.write(f"FileChecksum: MD5: {bf.md5}\n")
46     f.write(f"LicenseConcluded: {bf.concludedLicense}\n")
48         f.write(f"LicenseInfoInFile: NONE\n")
51             f.write(f"LicenseInfoInFile: {licInfoInFile}\n")
52     f.write(f"FileCopyrightText: {bf.copyrightText}\n\n")
57             writeRelationshipSPDX(f, rln)
58         f.write("\n")
66     return f'git+{url}@{revision}'
68 # Output tag-value SPDX 2.3 content for the given Package object.
70 #   1) f: file handle for SPDX document
72 def writePackageSPDX(f, pkg):  argument
76     f.write(f"""##### Package: {spdx_normalized_name}
82     f.write(f"""PackageLicenseDeclared: {pkg.cfg.declaredLicense}
87         f.write(f"PrimaryPackagePurpose: {pkg.cfg.primaryPurpose}\n")
91         f.write(f"PackageDownloadLocation: {downloadUrl}\n")
93         f.write("PackageDownloadLocation: NOASSERTION\n")
96         f.write(f"PackageVersion: {pkg.cfg.version}\n")
98         f.write(f"PackageVersion: {pkg.cfg.revision}\n")
102             f.write(f"ExternalRef: SECURITY cpe23Type {ref}\n")
104             f.write(f"ExternalRef: PACKAGE_MANAGER purl {ref}\n")
106             log.wrn(f"Unknown external reference ({ref})")
112                 f.write(f"PackageLicenseInfoFromFiles: {licFromFiles}\n")
114             f.write(f"PackageLicenseInfoFromFiles: NOASSERTION\n")
115         f.write(f"FilesAnalyzed: true\nPackageVerificationCode: {pkg.verificationCode}\n\n")
117         f.write(f"FilesAnalyzed: false\nPackageComment: Utility target; no files\n\n")
122             writeRelationshipSPDX(f, rln)
123         f.write("\n")
130             writeFileSPDX(f, bf)
132 # Output tag-value SPDX 2.3 content for a custom license.
134 #   1) f: file handle for SPDX document
136 def writeOtherLicenseSPDX(f, lic):  argument
137     f.write(f"""LicenseID: {lic}
140 LicenseComment: Corresponds to the license ID `{lic}` detected in an SPDX-License-Identifier: tag.
143 # Output tag-value SPDX 2.3 content for the given Document object.
145 #   1) f: file handle for SPDX document
147 def writeDocumentSPDX(f, doc):  argument
150     f.write(f"""SPDXVersion: SPDX-2.3
151 DataLicense: CC0-1.0
152 SPDXID: SPDXRef-DOCUMENT
156 Created: {datetime.utcnow().strftime("%Y-%m-%dT%H:%M:%SZ")}
165 …f.write(f"ExternalDocumentRef: {extDoc.cfg.docRefID} {extDoc.cfg.namespace} SHA1: {extDoc.myDocSHA…
166         f.write(f"\n")
171             writeRelationshipSPDX(f, rln)
172         f.write(f"\n")
176         writePackageSPDX(f, pkg)
181             writeOtherLicenseSPDX(f, lic)
191         log.inf(f"Writing SPDX document {doc.cfg.name} to {spdxPath}")
192         with open(spdxPath, "w") as f:
193             writeDocumentSPDX(f, doc)
195         log.err(f"Error: Unable to write to {spdxPath}: {str(e)}")
201         log.err(f"Error: created document but unable to calculate hash values")