28 def writeRelationshipSPDX(f, rln):  argument
29 …f.write(f"Relationship: {_normalize_spdx_name(rln.refA)} {rln.rlnType} {_normalize_spdx_name(rln.r…
35 def writeFileSPDX(f, bf):  argument
38     f.write(f"""FileName: ./{bf.relpath}
43         f.write(f"FileChecksum: SHA256: {bf.sha256}\n")
45         f.write(f"FileChecksum: MD5: {bf.md5}\n")
46     f.write(f"LicenseConcluded: {bf.concludedLicense}\n")
48         f.write(f"LicenseInfoInFile: NONE\n")
51             f.write(f"LicenseInfoInFile: {licInfoInFile}\n")
52     f.write(f"FileCopyrightText: {bf.copyrightText}\n\n")
57             writeRelationshipSPDX(f, rln)
58         f.write("\n")
66     return f'git+{url}@{revision}'
72 def writePackageSPDX(f, pkg):  argument
76     f.write(f"""##### Package: {spdx_normalized_name}
82     f.write(f"""PackageLicenseDeclared: {pkg.cfg.declaredLicense}
87         f.write(f"PrimaryPackagePurpose: {pkg.cfg.primaryPurpose}\n")
91         f.write(f"PackageDownloadLocation: {downloadUrl}\n")
93         f.write("PackageDownloadLocation: NOASSERTION\n")
96         f.write(f"PackageVersion: {pkg.cfg.version}\n")
98         f.write(f"PackageVersion: {pkg.cfg.revision}\n")
102             f.write(f"ExternalRef: SECURITY cpe23Type {ref}\n")
104             f.write(f"ExternalRef: PACKAGE_MANAGER purl {ref}\n")
106             log.wrn(f"Unknown external reference ({ref})")
112                 f.write(f"PackageLicenseInfoFromFiles: {licFromFiles}\n")
114             f.write(f"PackageLicenseInfoFromFiles: NOASSERTION\n")
115         f.write(f"FilesAnalyzed: true\nPackageVerificationCode: {pkg.verificationCode}\n\n")
117         f.write(f"FilesAnalyzed: false\nPackageComment: Utility target; no files\n\n")
122             writeRelationshipSPDX(f, rln)
123         f.write("\n")
130             writeFileSPDX(f, bf)
136 def writeOtherLicenseSPDX(f, lic):  argument
137     f.write(f"""LicenseID: {lic}
147 def writeDocumentSPDX(f, doc):  argument
150     f.write(f"""SPDXVersion: SPDX-2.3
165 …f.write(f"ExternalDocumentRef: {extDoc.cfg.docRefID} {extDoc.cfg.namespace} SHA1: {extDoc.myDocSHA…
166         f.write(f"\n")
171             writeRelationshipSPDX(f, rln)
172         f.write(f"\n")
176         writePackageSPDX(f, pkg)
181             writeOtherLicenseSPDX(f, lic)
191         log.inf(f"Writing SPDX document {doc.cfg.name} to {spdxPath}")
192         with open(spdxPath, "w") as f:
193             writeDocumentSPDX(f, doc)
195         log.err(f"Error: Unable to write to {spdxPath}: {str(e)}")
201         log.err(f"Error: created document but unable to calculate hash values")