fix: "or-later" suffix updated to consider deprecated "+" operator #1907
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
If a given license has the suffix "or-later" it previously could have been considered or represented with a "+". Example "GFDL-1.0-or-later" could have been represented as "GFDL-1.0+". This PR allows the license list generation to consider "or-later" as == to "+" when generating permutations for upgrading deprecated licenses. Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Benchmark Test ResultsBenchmark results from the latest changes vs base branch |
spiffcs
changed the title
spiffcs
changed the title
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
* main: feat: CLI flag for directory base (#1867) Fix CPE gen for k8s python client (#1921) chore: update iterations to protect against race (#1927) chore(deps): update bootstrap tools to latest versions (#1922) fix: Don't use the actual redis or grpc CPEs for gems (#1926) fix(install): return with right error code (#1915) Remove erroneous Java CPEs from generation (#1918) chore(deps): bump golang.org/x/net from 0.11.0 to 0.12.0 (#1916) Switch UI to bubbletea (#1888) fix: use filepath.EvalSymlinks if os.Readlink fails to evaluate the link (#1884) add file source digest support (#1914) chore(deps): update bootstrap tools to latest versions (#1908) chore(deps): bump golang.org/x/mod from 0.11.0 to 0.12.0 (#1912) chore(deps): bump golang.org/x/term from 0.9.0 to 0.10.0 (#1913) doc(readme): add installation section with scoop (#1909) Refactor source API (#1846) chore(deps): update bootstrap tools to latest versions (#1905)
|
Ahh - didn't merge into main to get my own race fix! |
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
This was referenced Jul 12, 2023
Merged
This was referenced Jul 28, 2023
GijsCalis
pushed a commit
to GijsCalis/syft
that referenced
this pull request
Feb 19, 2024
…nchore#1907) * fix: or-later suffix has been updated to consider deprecated + If a given license has the suffix "or-later" it previously could have been considered or represented with a "+". Example "GFDL-1.0-or-later" could have been represented as "GFDL-1.0+". This PR allows the license list generation to consider "or-later" as == to "+" when generating permutations for upgrading deprecated licenses. --------- Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #1899
If a given license has the suffix "or-later" it previously could have been considered or represented with a "+".
Example "GFDL-1.0-or-later" could have been represented as "GFDL-1.0+" in the past. This PR allows the license list generation to consider
or-lateras==to+when generating permutations for upgrading deprecated licenses.Note
The case
assert.Equal(t, "GPL-2.0-or-later", licenseIDs["gpl2+"])was considered previously becausegpl2+was explicitly included in the SPDX license list as a deprecated license.This fix is for deprecated licenses that do NOT exist in the json data we read from the SPDX license list publisher.