15 …  r"`\{\|}~]))+(\?*|\*?))|[\*\-])){5}(:(([a-zA-Z]{2,3}(-([a-zA-Z]{2}|[0-9]{3}))?)|[\*\-]))(:(((\?*"
26 #   1) f: file handle for SPDX document
28 def writeRelationshipSPDX(f, rln):  argument
29 …f.write(f"Relationship: {_normalize_spdx_name(rln.refA)} {rln.rlnType} {_normalize_spdx_name(rln.r…
33 #   1) f: file handle for SPDX document
35 def writeFileSPDX(f, bf):  argument
38     f.write(f"""FileName: ./{bf.relpath}
43         f.write(f"FileChecksum: SHA256: {bf.sha256}\n")
45         f.write(f"FileChecksum: MD5: {bf.md5}\n")
46     f.write(f"LicenseConcluded: {bf.concludedLicense}\n")
47     if len(bf.licenseInfoInFile) == 0:
48         f.write(f"LicenseInfoInFile: NONE\n")
51             f.write(f"LicenseInfoInFile: {licInfoInFile}\n")
52     f.write(f"FileCopyrightText: {bf.copyrightText}\n\n")
55     if len(bf.rlns) > 0:
57             writeRelationshipSPDX(f, rln)
58         f.write("\n")
63     if len(revision) == 0:
66     return f'git+{url}@{revision}'
70 #   1) f: file handle for SPDX document
72 def writePackageSPDX(f, pkg):  argument
76     f.write(f"""##### Package: {spdx_normalized_name}
82     f.write(f"""PackageLicenseDeclared: {pkg.cfg.declaredLicense}
87         f.write(f"PrimaryPackagePurpose: {pkg.cfg.primaryPurpose}\n")
89     if len(pkg.cfg.url) > 0:
91         f.write(f"PackageDownloadLocation: {downloadUrl}\n")
93         f.write("PackageDownloadLocation: NOASSERTION\n")
95     if len(pkg.cfg.version) > 0:
96         f.write(f"PackageVersion: {pkg.cfg.version}\n")
97     elif len(pkg.cfg.revision) > 0:
98         f.write(f"PackageVersion: {pkg.cfg.revision}\n")
102             f.write(f"ExternalRef: SECURITY cpe23Type {ref}\n")
104             f.write(f"ExternalRef: PACKAGE_MANAGER purl {ref}\n")
106             log.wrn(f"Unknown external reference ({ref})")
109     if len(pkg.files) > 0:
110         if len(pkg.licenseInfoFromFiles) > 0:
112                 f.write(f"PackageLicenseInfoFromFiles: {licFromFiles}\n")
114             f.write(f"PackageLicenseInfoFromFiles: NOASSERTION\n")
115         f.write(f"FilesAnalyzed: true\nPackageVerificationCode: {pkg.verificationCode}\n\n")
117         f.write(f"FilesAnalyzed: false\nPackageComment: Utility target; no files\n\n")
120     if len(pkg.rlns) > 0:
122             writeRelationshipSPDX(f, rln)
123         f.write("\n")
126     if len(pkg.files) > 0:
130             writeFileSPDX(f, bf)
134 #   1) f: file handle for SPDX document
136 def writeOtherLicenseSPDX(f, lic):  argument
137     f.write(f"""LicenseID: {lic}
145 #   1) f: file handle for SPDX document
147 def writeDocumentSPDX(f, doc):  argument
150     f.write(f"""SPDXVersion: SPDX-2.3
161     if len(doc.externalDocuments) > 0:
165 …f.write(f"ExternalDocumentRef: {extDoc.cfg.docRefID} {extDoc.cfg.namespace} SHA1: {extDoc.myDocSHA…
166         f.write(f"\n")
169     if len(doc.relationships) > 0:
171             writeRelationshipSPDX(f, rln)
172         f.write(f"\n")
176         writePackageSPDX(f, pkg)
179     if len(doc.customLicenseIDs) > 0:
181             writeOtherLicenseSPDX(f, lic)
191         log.inf(f"Writing SPDX document {doc.cfg.name} to {spdxPath}")
192         with open(spdxPath, "w") as f:
193             writeDocumentSPDX(f, doc)
195         log.err(f"Error: Unable to write to {spdxPath}: {str(e)}")
201         log.err(f"Error: created document but unable to calculate hash values")
203     doc.myDocSHA1 = hashes[0]