feat(sbom): export licenses + real top-level version (SK Telecom supplier compat)#289
Merged
Conversation
…lier compat) SBOM export previously emitted NOASSERTION for every SPDX license and omitted CycloneDX `licenses` entirely, despite scans persisting real LicenseFinding rows — an oversight, not a deliberate choice. The top-level component version also used the scan UUID instead of a real software version. - Load licenses (`_load_scan_licenses`): join license_findings JOIN licenses, group by component_version + kind, deduped + sorted (byte-stable). - CycloneDX: per-component `licenses` from concluded -> declared -> detected; SPDX id -> license.id, else license.name. JSON + XML. - SPDX: licenseDeclared / licenseConcluded as SPDX expressions (concluded falls back to declared). SPDX-id-only; LicenseRef-* -> NOASSERTION (follow-up). copyrightText stays NOASSERTION (no source yet). - Top-level version: scan_metadata['release'] (Feature #18) when present, else scan id fallback -- no new input field. - Log generic_purls count to surface pkg:generic components (rejected by some supplier programs); root-cause fix out of scope (cdxgen/input limitation). - Tests: +13 (license id/name, concluded>declared, multi AND sorted, no-id NOASSERTION, no-license, byte-stability with licenses, version from release). - Docs (EN+KO) + ADR 0003. No schema change (data already persisted). Assessed against SK Telecom supplier SBOM requirements. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Follow-up to the SBOM license/version export feature. Updates the user guide (EN + KO): - "What's included per component": licenses (concluded > declared > detected; SPDX expression vs NOASSERTION; copyrightText still NOASSERTION) and top-level version (scan_metadata.release with scan-id fallback). - "Supplier submission compatibility": SK Telecom supplier requirements coverage + caveats (pkg:generic rejection, LicenseRef NOASSERTION). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
배경
Report 탭의 SBOM 다운로드가 SK텔레콤 공급사 SBOM 요구사항(https://sktelecom.github.io/guide/supply-chain/for-suppliers/requirements/)을 충족하는지 조사하다 발견한 보완점을 반영합니다.
조사 결과: 형식(CycloneDX 1.5 / SPDX 2.3)·메타데이터·name/version/PURL·전이 의존성은 충족하나, 라이선스가 누락(SPDX는 항상
NOASSERTION, CycloneDX는licenses생략)되고 최상위 version이 scan UUID였습니다. 라이선스는LicenseFinding에 이미 persist되는데 export 쿼리가 JOIN하지 않은 우발적 갭이었습니다.변경
_load_scan_licenses):license_findings JOIN licenses, component_version + kind로 그룹화, 중복 제거 + 정렬(byte-stable).licenses를concluded → declared → detected우선순위로 채움. SPDX id면license.id, 없으면license.name. JSON + XML.licenseDeclared/licenseConcluded를 SPDX expression으로(concluded 없으면 declared fallback). SPDX-id만 expression화,LicenseRef-*는NOASSERTION(후속).copyrightText는 데이터원 없어NOASSERTION유지.scan_metadata['release'](Feature Phase 4 PR #15 — 컴포넌트 승인 워크플로우 (/approvals) #18) 우선, 없으면 scan id fallback — 신규 입력 필드 없음.generic_purls카운트 추가(일부 공급사 프로그램이pkg:generic/반려). 근본 해결은 cdxgen/입력 한계로 범위 밖.테스트 (로컬, 실 DB)
A AND B정렬, SPDX-id 없을 때NOASSERTION, 라이선스 없음, 라이선스 포함 byte-stability, release→version.문서
sbom.md(EN + KO): 라이선스 export·SPDX expression 한계·version=release·공급사 제출 호환성/caveat.0003-sbom-license-and-version-export.md.DB 스키마 변경 없음(데이터는 이미 persist). API 응답 스키마 불변(OpenAPI 영향 없음).
🤖 Generated with Claude Code