From 82be1b3f8a9d4f275545b4d8a87fb14091995699 Mon Sep 17 00:00:00 2001 From: Lon Hohberger Date: Fri, 1 Oct 2021 15:05:12 -0400 Subject: [PATCH 1/2] Include filesAnalyzed in machine-readable output Signed-off-by: Lon Hohberger --- spdx/writers/jsonyamlxml.py | 1 + 1 file changed, 1 insertion(+) diff --git a/spdx/writers/jsonyamlxml.py b/spdx/writers/jsonyamlxml.py index faac513dd..fbe79ff2a 100644 --- a/spdx/writers/jsonyamlxml.py +++ b/spdx/writers/jsonyamlxml.py @@ -112,6 +112,7 @@ def create_package_info(self, package): package_object["SPDXID"] = self.spdx_id(package.spdx_id) package_object["name"] = package.name package_object["downloadLocation"] = package.download_location.__str__() + package_object["filesAnalyzed"] = package.files_analyzed package_object["packageVerificationCode"] = self.package_verification_code( package ) From f2a13d6767f4ee564310be950acd2cb5ae476455 Mon Sep 17 00:00:00 2001 From: Lon Hohberger Date: Fri, 1 Oct 2021 16:54:18 -0400 Subject: [PATCH 2/2] Fix filesAnalyzed handling When filesAnalyzed is False, several sections should be omitted when omitting rather than being presented as empty sets or "None" SPDX 2.2, sec: 3.8.3 - files analyzed specification 3.9.3 - verification code 3.14.3 - licenses from files Signed-off-by: Lon Hohberger --- spdx/writers/jsonyamlxml.py | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/spdx/writers/jsonyamlxml.py b/spdx/writers/jsonyamlxml.py index fbe79ff2a..80674de51 100644 --- a/spdx/writers/jsonyamlxml.py +++ b/spdx/writers/jsonyamlxml.py @@ -112,14 +112,16 @@ def create_package_info(self, package): package_object["SPDXID"] = self.spdx_id(package.spdx_id) package_object["name"] = package.name package_object["downloadLocation"] = package.download_location.__str__() - package_object["filesAnalyzed"] = package.files_analyzed - package_object["packageVerificationCode"] = self.package_verification_code( - package - ) + if package.files_analyzed is not None: + package_object["filesAnalyzed"] = package.files_analyzed + if package.files_analyzed is None or package.files_analyzed is True: + package_object["packageVerificationCode"] = self.package_verification_code( + package + ) + package_object["licenseInfoFromFiles"] = list( + map(self.license, package.licenses_from_files) + ) package_object["licenseConcluded"] = self.license(package.conc_lics) - package_object["licenseInfoFromFiles"] = list( - map(self.license, package.licenses_from_files) - ) package_object["licenseDeclared"] = self.license(package.license_declared) package_object["copyrightText"] = package.cr_text.__str__() @@ -475,7 +477,9 @@ def create_document(self): package_objects = [] for package in self.document.packages: package_info_object = self.create_package_info(package) - package_info_object["files"] = self.create_file_info(package) + # SPDX 2.2 says to omit if filesAnalyzed = False + if package.files: + package_info_object["files"] = self.create_file_info(package) package_objects.append({"Package": package_info_object}) self.document_object["documentDescribes"] = package_objects