Merge pull request #117 from spdx/offline-licenses

Use local cache for licenses

src/main/java/org/spdx/sbom/gradle/utils/SpdxKnownLicenses.java

@@ -42,15 +42,16 @@ private SpdxKnownLicenses(Map<String, String> licenses) {
     this.licenses = ImmutableMap.copyOf(licenses);
   }
 
-  public static SpdxKnownLicenses knownLicenses()
-      throws IOException, InterruptedException, JsonParseException {
+  public static SpdxKnownLicenses knownLicenses() throws IOException, JsonParseException {
     InputStream inputStream =
-        SpdxKnownLicenses.class.getClassLoader().getResourceAsStream("spdx-licenses.json");
+        SpdxKnownLicenses.class
+            .getClassLoader()
+            .getResourceAsStream("standard_licenses/licenses.json");
     return fromStream(inputStream);
   }
 
   private static SpdxKnownLicenses fromStream(InputStream stream)
-      throws IOException, InterruptedException, JsonParseException {
+      throws IOException, JsonParseException {
     try (BufferedReader reader = new BufferedReader(new InputStreamReader(stream))) {
       return new SpdxKnownLicenses(getLicenseToUrlMap(reader));
     }

src/main/java/org/spdx/sbom/gradle/utils/SpdxKnownLicensesService.java

@@ -25,7 +25,7 @@ public abstract class SpdxKnownLicensesService
 
   private final SpdxKnownLicenses spdxKnownLicenses;
 
-  public SpdxKnownLicensesService() throws IOException, InterruptedException {
+  public SpdxKnownLicensesService() throws IOException {
     this.spdxKnownLicenses = SpdxKnownLicenses.knownLicenses();
   }
 

src/main/java/org/spdx/sbom/gradle/utils/SpdxLicenses.java

@@ -27,6 +27,7 @@
 import org.spdx.library.model.license.AnyLicenseInfo;
 import org.spdx.library.model.license.ExtractedLicenseInfo;
 import org.spdx.library.model.license.LicenseInfoFactory;
+import org.spdx.library.model.license.ListedLicenses;
 import org.spdx.library.model.license.SpdxNoAssertionLicense;
 import org.spdx.sbom.gradle.maven.PomInfo.LicenseInfo;
 import org.spdx.storage.IModelStore;
@@ -56,7 +57,9 @@ private SpdxLicenses(
   }
 
   public static SpdxLicenses newSpdxLicenes(
-      Logger logger, SpdxDocument doc, SpdxKnownLicenses spdxKnownLicenses) {
+      Logger logger, SpdxDocument doc, SpdxKnownLicenses spdxKnownLicenses)
+      throws InvalidSPDXAnalysisException {
+    ListedLicenses.initializeListedLicenses(new SpdxListedLicenseEmbeddedStore());
     return new SpdxLicenses(
         logger, doc, doc.getModelStore(), doc.getCopyManager(), spdxKnownLicenses);
   }

src/main/java/org/spdx/sbom/gradle/utils/SpdxListedLicenseEmbeddedStore.java

@@ -0,0 +1,78 @@
+/*
+ * Copyright 2024 The Project Authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.spdx.sbom.gradle.utils;
+
+import java.io.IOException;
+import java.io.InputStream;
+import org.spdx.library.InvalidSPDXAnalysisException;
+import org.spdx.storage.listedlicense.SpdxListedLicenseModelStore;
+
+/**
+ * Original Author: @goneall {@link org.spdx.storage.listedlicense.SpdxListedLicenseLocalStore}
+ *
+ * <p>Model store for listend licenses using embedded JSON files in the resources/standard_licenses
+ * directory.
+ */
+public class SpdxListedLicenseEmbeddedStore extends SpdxListedLicenseModelStore {
+
+  static final String LISTED_LICENSE_JSON_LOCAL_DIR = "standard_licenses";
+
+  public SpdxListedLicenseEmbeddedStore() throws InvalidSPDXAnalysisException {
+    super();
+  }
+
+  @Override
+  public InputStream getTocInputStream() throws IOException {
+    String fileName = LISTED_LICENSE_JSON_LOCAL_DIR + "/licenses.json";
+    InputStream retval = SpdxListedLicenseEmbeddedStore.class.getResourceAsStream("/" + fileName);
+    if (retval == null) {
+      throw new IOException("Unable to open local local license table of contents file");
+    }
+    return retval;
+  }
+
+  @Override
+  public InputStream getLicenseInputStream(String licenseId) throws IOException {
+
+    String fileName = LISTED_LICENSE_JSON_LOCAL_DIR + "/" + licenseId + ".json";
+    InputStream retval = SpdxListedLicenseEmbeddedStore.class.getResourceAsStream("/" + fileName);
+    if (retval == null) {
+      throw new IOException(
+          "Unable to open local local license JSON file for license ID " + licenseId);
+    }
+    return retval;
+  }
+
+  @Override
+  public InputStream getExceptionTocInputStream() throws IOException {
+    String fileName = LISTED_LICENSE_JSON_LOCAL_DIR + "/exceptions.json";
+    InputStream retval = SpdxListedLicenseEmbeddedStore.class.getResourceAsStream("/" + fileName);
+    if (retval == null) {
+      throw new IOException("Unable to open local local license table of contents file");
+    }
+    return retval;
+  }
+
+  @Override
+  public InputStream getExceptionInputStream(String exceptionId) throws IOException {
+    return getLicenseInputStream(exceptionId);
+  }
+
+  @Override
+  public void close() throws Exception {
+    // Nothing to do for the embedded store
+  }
+}

src/main/resources/standard_licenses/0BSD.json

@@ -0,0 +1,33 @@
+{
+  "isDeprecatedLicenseId": false,
+  "licenseText": "Copyright (C) YEAR by AUTHOR EMAIL\n\nPermission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.\n",
+  "standardLicenseTemplate": "\u003c\u003cbeginOptional\u003e\u003e\u003c\u003cvar;name\u003d\"title\";original\u003d\"BSD Zero Clause License\";match\u003d\"(BSD Zero[ -]Clause|Zero[ -]Clause BSD)( License)?( \\(0BSD\\))?\"\u003e\u003e\n\n\u003c\u003cendOptional\u003e\u003e \u003c\u003cvar;name\u003d\"copyright\";original\u003d\"Copyright (C) YEAR by AUTHOR EMAIL  \";match\u003d\".{0,5000}\"\u003e\u003e\n\nPermission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.\n\n",
+  "name": "BSD Zero Clause License",
+  "licenseId": "0BSD",
+  "crossRef": [
+    {
+      "match": "N/A",
+      "url": "https://opensource.org/licenses/0BSD",
+      "isValid": true,
+      "isLive": false,
+      "timestamp": "2024-03-01T20:23:10Z",
+      "isWayBackLink": false,
+      "order": 1
+    },
+    {
+      "match": "false",
+      "url": "http://landley.net/toybox/license.html",
+      "isValid": true,
+      "isLive": true,
+      "timestamp": "2024-03-01T20:23:10Z",
+      "isWayBackLink": false,
+      "order": 0
+    }
+  ],
+  "seeAlso": [
+    "http://landley.net/toybox/license.html",
+    "https://opensource.org/licenses/0BSD"
+  ],
+  "isOsiApproved": true,
+  "licenseTextHtml": "\n      \u003cdiv class\u003d\"optional-license-text\"\u003e \n         \u003cp\u003e\u003cvar class\u003d\"replaceable-license-text\"\u003e BSD Zero Clause License\u003c/var\u003e\u003c/p\u003e\n\n      \u003c/div\u003e\n      \u003cdiv class\u003d\"replaceable-license-text\"\u003e \n         \u003cp\u003eCopyright (C) YEAR by AUTHOR EMAIL\u003c/p\u003e\n\n      \u003c/div\u003e\n\n      \u003cp\u003ePermission to use, copy, modify, and/or distribute this software for any purpose with or without fee is\n         hereby granted.\u003c/p\u003e\n\n      \u003cp\u003eTHE SOFTWARE IS PROVIDED \u0026quot;AS IS\u0026quot; AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE\n         INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE\n         LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING\n         FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS\n         ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.\u003c/p\u003e\n\n    "
+}

src/main/resources/standard_licenses/389-exception.json

@@ -0,0 +1,13 @@
+{
+  "isDeprecatedLicenseId": false,
+  "licenseExceptionText": "This Program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; version 2 of the License.\n\nThis Program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.\n\nYou should have received a copy of the GNU General Public License along with this Program; if not, write to the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.\n\nIn addition, as a special exception, Red Hat, Inc. gives You the additional right to link the code of this Program with code not covered under the GNU General Public License (\"Non-GPL Code\") and to distribute linked combinations including the two, subject to the limitations in this paragraph. Non-GPL Code permitted under this exception must only link to the code of this Program through those well defined interfaces identified in the file named EXCEPTION found in the source code files (the \"Approved Interfaces\"). The files of Non-GPL Code may instantiate templates or use macros or inline functions from the Approved Interfaces without causing the resulting work to be covered by the GNU General Public License. Only Red Hat, Inc. may make changes or additions to the list of Approved Interfaces. You must obey the GNU General Public License in all respects for all of the Program code and other code used in conjunction with the Program except the Non-GPL Code covered by this exception. If you modify this file, you may extend this exception to your version of the file, but you are not obligated to do so. If you do not wish to provide this exception without modification, you must delete this exception statement from your version and license this file solely under the GPL without exception.\n",
+  "name": "389 Directory Server Exception",
+  "licenseComments": "Specified to be associated with GPL-2.0-only",
+  "seeAlso": [
+    "http://directory.fedoraproject.org/wiki/GPL_Exception_License_Text",
+    "https://web.archive.org/web/20080828121337/http://directory.fedoraproject.org/wiki/GPL_Exception_License_Text"
+  ],
+  "licenseExceptionId": "389-exception",
+  "licenseExceptionTemplate": "This Program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; version 2 of the License.\n\nThis Program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.\n\nYou should have received a copy of the GNU General Public License along with this Program; if not, write to the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.\n\nIn addition, as a special exception, Red Hat, Inc. gives You the additional right to link the code of \u003c\u003cvar;name\u003d\"name1\";original\u003d\"this Program\";match\u003d\"this Program|FRYSK\"\u003e\u003e with code not covered under the GNU General Public License (\"Non-GPL Code\") and to distribute linked combinations including the two, subject to the limitations in this paragraph. Non-GPL Code permitted under this exception must only link to the code of \u003c\u003cvar;name\u003d\"name2\";original\u003d\"this Program\";match\u003d\"this Program|FRYSK\"\u003e\u003e through those well defined interfaces identified in the file named EXCEPTION found in the source code files (the \"Approved Interfaces\"). The files of Non-GPL Code may instantiate templates or use macros or inline functions from the Approved Interfaces without causing the resulting work to be covered by the GNU General Public License. Only Red Hat, Inc. may make changes or additions to the list of Approved Interfaces. You must obey the GNU General Public License in all respects for all of the \u003c\u003cvar;name\u003d\"name3\";original\u003d\"Program\";match\u003d\"Program|FRYSK\"\u003e\u003e code and other code used in conjunction with \u003c\u003cvar;name\u003d\"name4\";original\u003d\"the Program\";match\u003d\"the Program|FRYSK\"\u003e\u003e except the Non-GPL Code covered by this exception. If you modify this file, you may extend this exception to your version of the file, but you are not obligated to do so. If you do not wish to provide this exception without modification, you must delete this exception statement from your version and license this file solely under the GPL without exception.\n\n",
+  "exceptionTextHtml": "\n      \u003cp\u003eThis Program is free software; you can redistribute it and/or\n       modify it under the terms of the GNU General Public License as\n       published by the Free Software Foundation; version 2 of the\n       License.\u003c/p\u003e\n\n      \u003cp\u003eThis Program is distributed in the hope that it will be useful,\n       but WITHOUT ANY WARRANTY; without even the implied warranty of\n       MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n       GNU General Public License for more details.\u003c/p\u003e\n\n      \u003cp\u003eYou should have received a copy of the GNU General Public License\n       along with this Program; if not, write to the Free Software\n       Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA\n       02111-1307 USA.\u003c/p\u003e\n\n      \u003cp\u003eIn addition, as a special exception, Red Hat, Inc. gives You the\n       additional right to link the code of \u003cvar class\u003d\"replaceable-license-text\"\u003e this Program\u003c/var\u003e with code\n       not covered under the GNU General Public License (\u0026quot;Non-GPL\n       Code\u0026quot;) and to distribute linked combinations including the\n       two, subject to the limitations in this paragraph. Non-GPL\n       Code permitted under this exception must only link to the code\n         of \u003cvar class\u003d\"replaceable-license-text\"\u003e this Program\u003c/var\u003e through those well defined interfaces\n       identified in the file named EXCEPTION found in the source\n       code files (the \u0026quot;Approved Interfaces\u0026quot;). The files of Non-GPL\n       Code may instantiate templates or use macros or inline\n       functions from the Approved Interfaces without causing the\n       resulting work to be covered by the GNU General Public\n       License. Only Red Hat, Inc. may make changes or additions to\n       the list of Approved Interfaces. You must obey the GNU General\n       Public License in all respects for all of the \u003cvar class\u003d\"replaceable-license-text\"\u003e Program\u003c/var\u003e code and\n       other code used in conjunction with \u003cvar class\u003d\"replaceable-license-text\"\u003e the Program\u003c/var\u003e except the\n       Non-GPL Code covered by this exception. If you modify this\n       file, you may extend this exception to your version of the\n       file, but you are not obligated to do so. If you do not wish\n       to provide this exception without modification, you must\n       delete this exception statement from your version and license\n       this file solely under the GPL without exception.\u003c/p\u003e\n\n    "
+}