Open olhado opened 1 year ago
Hi @olhado ! If I understand you correctly need to change the originator/supplier fields. I suppose it should be "Organization: Docker, Inc. (NOASSERTION)" Please, correct me if I'm wrong.
You can't add NOASSERTION if you are also defining an originator/supplier (see https://spdx.github.io/spdx-spec/v2-draft/package-information/#75-package-supplier-field and https://spdx.github.io/spdx-spec/v2-draft/package-information/#76-package-originator-field):
Single line of text with one of the following:
NOASSERTION
Person: person name and optional (<email>)
Organization: organization name and optional (<email>)
Ok, thank you, @olhado . In this example, you should see "Organization: Docker, Inc. ". Correct?
That would be valid, but that means the tool is asserting the originator/supplier. You have to be confident in the algorithm you are using to determine the correct values.
Ideally, I assume the SPDX spec is expecting any generator to scan the dependencies to find SPDX tags. Not sure what SPDX allows tools to do to infer originator/supplier, or even license ids/copyright text.
Hi @olhado ! Please, take the new version of the tool. You are right: precisely defining the originator/supplier in the case of a few copyrights is impossible.
Bug Description
The code in the generator is generating an array of
copyrightText
entries, when the spec defines it as a free-form text field:(See: https://spdx.github.io/spdx-spec/v2-draft/package-information/#717-copyright-text-field)
Identify the copyright holders of the package, as well as any dates present. This will be a free form text field extracted from package information files.
This leads to issues with the
supplier
/originator
fields too, as the generator picks one of the array items, chops off anything withCopyright
and digits for years when populating these fields. One example I have isCopyright and licenses
, which leads to theoriginator
/supplier
fields to be set toand licenses
.Steps to Reproduce
Steps to reproduce the behavior:
Expected Behavior
Generator should follow the spec.
Additional Context
Example Package definition showing the behaviors described above: