Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[blackduck] Export tree-ouput does not work on Golang #88

Open
JeroenKnoops opened this issue Jul 19, 2021 · 0 comments
Open

[blackduck] Export tree-ouput does not work on Golang #88

JeroenKnoops opened this issue Jul 19, 2021 · 0 comments

Comments

@JeroenKnoops
Copy link
Member

Problem

When creating a tree output from a blackduck project with Golang components, the tree output does generate github and generic packages.

Package-url spec

https://github.com/package-url/purl-spec/blob/master/PURL-TYPES.rst#golang

Both tree and spdx outputs are wrong

tree output

Command

spdx-builder blackduck --tree project version

Example part of the tree output

TREE start ----------8<----------
pkg:generic/project@version
  pkg:github/golang/[email protected] [dynamic]
  pkg:github/google/[email protected] [dynamic]
  pkg:github/kubernetes-sigs/[email protected] [dynamic]
    pkg:generic/[email protected] [dynamic]
    pkg:generic/uber-go%[email protected] [dynamic]
    pkg:github/beorn7/[email protected] [dynamic]
...

Expected tree output

TREE start ----------8<----------
pkg:golang/project@versoin
  pkg:golang/github.com/golang/[email protected] [dynamic]
  pkg:golang/github.com/google/[email protected] [dynamic]
  pkg:golang/github.com/kubernetes-sigs/[email protected] [dynamic]
    pkg:golang/google.golang.org/[email protected] [dynamic]
    pkg:golang/google.golang.org/uber-go%[email protected] [dynamic]
    pkg:golang/google.golang.org/beorn7/[email protected] [dynamic]
...

spdx output

Command

spdx-builder blackduck -o output.spdx project version

Example part of the spdx output

## Start of package pkg:github/golang/[email protected]
PackageName: golang/mock
SPDXID: SPDXRef-7
PackageVersion: v1.4.4
PackageSummary: golang-mock
PackageDescription: GoMock is a mocking framework for the Go programming language.
PackageHomePage: https://github.com/golang/mock
ExternalRef: PACKAGE-MANAGER purl pkg:github/golang/[email protected]
PackageDownloadLocation: NOASSERTION
PackageLicenseConcluded: Apache-2.0
PackageLicenseDeclared: NOASSERTION
FilesAnalyzed: false
PackageCopyrightText: NOASSERTION
...

Expected spdx output

## Start of package pkg:golang/github.com/golang/[email protected]
PackageName: golang/mock
SPDXID: SPDXRef-7
PackageVersion: v1.4.4
PackageSummary: golang-mock
PackageDescription: GoMock is a mocking framework for the Go programming language.
PackageHomePage: https://github.com/golang/mock
ExternalRef: PACKAGE-MANAGER purl pkg:golang/github.com/golang/[email protected]
PackageDownloadLocation: NOASSERTION
PackageLicenseConcluded: Apache-2.0
PackageLicenseDeclared: NOASSERTION
FilesAnalyzed: false
PackageCopyrightText: NOASSERTION
...
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant