Parse Python licenses from LicenseExpression entry in the Wheel Metadata

Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
anchore · Dec 14, 2023 · ac85fdf · ac85fdf
1 parent 09e62c3
commit ac85fdf
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 2 deletions.
diff --git a/syft/pkg/cataloger/python/package.go b/syft/pkg/cataloger/python/package.go
@@ -59,7 +59,9 @@ func newPackageForRequirementsWithMetadata(name, version string, metadata pkg.Py
 
 func newPackageForPackage(resolver file.Resolver, m parsedData, sources ...file.Location) pkg.Package {
 	var licenseSet pkg.LicenseSet
-	if m.Licenses != "" {
+	if m.LicenseExpression != "" {
+		licenseSet = pkg.NewLicenseSet(pkg.NewLicensesFromLocation(m.LicenseLocation, m.LicenseExpression)...)
+	} else if m.Licenses != "" {
 		licenseSet = pkg.NewLicenseSet(pkg.NewLicensesFromLocation(m.LicenseLocation, m.Licenses)...)
 	} else if m.LicenseLocation.Path() != "" {
 		// If we have a license file then resolve and parse it

diff --git a/syft/pkg/cataloger/python/parse_wheel_egg_metadata.go b/syft/pkg/cataloger/python/parse_wheel_egg_metadata.go
@@ -18,6 +18,7 @@ import (
 type parsedData struct {
 	Licenses          string `mapstructure:"License"`
 	LicenseFile       string `mapstructure:"LicenseFile"`
+	LicenseExpression string `mapstructure:"LicenseExpression"`
 	LicenseLocation   file.Location
 	pkg.PythonPackage `mapstructure:",squash"`
 }
@@ -81,7 +82,7 @@ func parseWheelOrEggMetadata(path string, reader io.Reader) (parsedData, error)
 	// add additional metadata not stored in the egg/wheel metadata file
 
 	pd.SitePackagesRootPath = determineSitePackagesRootPath(path)
-	if pd.Licenses != "" {
+	if pd.Licenses != "" || pd.LicenseExpression != "" {
 		pd.LicenseLocation = file.NewLocation(path)
 	} else if pd.LicenseFile != "" {
 		pd.LicenseLocation = file.NewLocation(filepath.Join(filepath.Dir(path), pd.LicenseFile))