feat(SPDX): Use new SPDX library (#1496) #1594

tuannn2 · 2022-07-18T02:15:42Z

Signed-off-by: Nguyen Nhu Tuan tuan2.nguyennhu@toshiba.co.jp

Please provide a summary of your changes here.

Which issue is this pull request belonging to and how is it solving it? (Refer to issue here)

Did you add or update any new dependencies that are required for your change?

Issue: #1496

Suggest Reviewer

You can suggest reviewers here with an @mention.

How To Test?

Import SPDX BOM in Project page

Use file bom.spdx.rdf.zip

Steps

Go to project page
Click "Import SPDX BOM" button
Upload bom.spdx.rdf file

Validate

"asoftware (1.1)" project was created
"Browser", "Buffer" and "CompressionEng" components were created
"Browser(2.1)", "Buffer(2.2)" and "CompressionEng 3.1" were created
linked releases of "asoftware (1.1)" project are Browser(2.1) and Buffer(2.2)
linked release of "Browser(2.1)" is "CompressionEng 3.1"

Import SPDX BOM in Component page

Use file bom.spdx.rdf.zip

Steps

Go to component page
Click "Import SPDX BOM" button
Upload bom.spdx.rdf file

Validate

"asoftware", "Browser", "Buffer" and "CompressionEng" components were created
"asoftware (1.1)", "Browser(2.1)", "Buffer(2.2)" and "CompressionEng 3.1" were created
linked releases of "asoftware (1.1)" release are Browser(2.1) and Buffer(2.2)
linked release of "Browser(2.1)" is "CompressionEng 3.1"

Import SPDX license to release

Use file
SPDX2_zlib128.zip_example-spdx.2.rdf.zip

Steps

Go to the edit page of Release Buffer(2.2)
In Attachments tab, add attachment SPDX2_time-1.9.tar.gz_1535120734-spdx.rdf
Click "Update Release" button
In the view page of Release Buffer(2.2), click Fossology icon to scan license on "Clearing details" tab
Click "Show License Info" button
Click "Add data to this release" button

Validate

At step 4th, the result same as the image

At step 6th, the result same as the image

Generate License Info in Project page

Steps

Go to the details page of "asoftware (1.1)" project
In "License Clearing" tab, click Generate License Info (project only) link

Validate

Readme generation was created same as the image

Checklist

Must:

All related issues are referenced in commit messages and in PR

KoukiHama · 2022-07-19T23:12:52Z

This PR does not change any SW360 functionality, it just changes the SPDX library used by SW360.
Testing should confirm that all existing SPDX related functionality is working fine.

Like this sw360vagrant PR, sw360/sw360vagrant#38 (comment)

-> tested with SPDX BOM import, SPDX license impoart and readme generation -> works nicely. Files used:

[SPDX2_time-1.9.tar.gz_1535120734-spdx.rdf.zip](https://github.com/sw360/sw360vagrant/files/6058100/SPDX2_time-1.9.tar.gz_1535120734-spdx.rdf.zip)
[SPDX2_zlib128.zip_example-spdx 2.rdf.zip](https://github.com/sw360/sw360vagrant/files/6058101/SPDX2_zlib128.zip_example-spdx.2.rdf.zip)

tienlee · 2022-08-31T08:44:17Z

I would like to attach the slides which are used in our telco today.
Let's keep to discuss the json format between anchore/syft and a perfect SPDX file (SPDXJSONExample-v2.2.spdx.json)

SW360-20220831 - Demo1594.pptx

akapti · 2022-09-12T09:16:05Z

Hi @tuannn2
I feel that rebase didn't went well, because PR contains changes which is totally unrelated to SPDX library upgrade.

for example:

It includes changes related to ChangeLogs in following file: https://github.com/eclipse/sw360/pull/1594/files#diff-29f4181fef7f3e6f651dde38f70234ffa90ccc0f7cfebb9cdd258071f8aa2e01 , https://github.com/eclipse/sw360/pull/1594/files#diff-e06edfe0b28e68467281adcf719a12122b6ca9565682e3523ea33ed4d39a52c7, https://github.com/eclipse/sw360/pull/1594/files#diff-7b84421f5372707112717574bd301252e3c831d747c1164593d83a2dbde26acf and few more files.

also the PR contains changes related to Thrift configuration in following files: https://github.com/eclipse/sw360/pull/1594/files#diff-c70fecc2e6dc5d8dc0441ca5fa4c26f109ebd954b2192cf3b4b5def24e24f23f

also removed changes related to Reading Obligation from README OSS in following files: https://github.com/eclipse/sw360/pull/1594/files#diff-74ca1a57d71f7fae13d891c82005a0a933bc9d39ab88b105ac531dc50f31712eL2706 and https://github.com/eclipse/sw360/pull/1594/files#diff-a47079862cba8e2c7eb02695e28dcd5e1016bdca7338e88075985b5dcb0e80baL308

Let me know in case I am wrong or if I missed something.
Or Can you please explain why changes related to ChangeLogs, Thrift configuration and ReadMe OSS obligations are part of this PR?

tuannn2 · 2022-09-12T09:30:40Z

Thank you for your reviewing, @akapti.
I will check and reply to you as soon as possible!

akapti

I have only reviewed the code.
will do the testing later.
Kindly incorporate the requested changes.

UPDATE: tested the changes, SPDX functionality is working fine with updated spdx library.

backend/src-common/pom.xml

...end/src-common/src/main/java/org/eclipse/sw360/datahandler/db/ChangeLogsDatabaseHandler.java

backend/src-common/src/main/java/org/eclipse/sw360/datahandler/db/ComponentDatabaseHandler.java

backend/src-common/src/main/java/org/eclipse/sw360/datahandler/db/DatabaseHandlerUtil.java

libraries/lib-datahandler/src/main/thrift/components.thrift

...360-portlet/src/main/java/org/eclipse/sw360/portal/portlets/components/ComponentPortlet.java

frontend/sw360-portlet/src/main/resources/META-INF/resources/html/components/view.jsp

backend/src-common/src/main/java/org/eclipse/sw360/datahandler/db/ComponentDatabaseHandler.java

backend/src-common/pom.xml

tienlee · 2022-09-20T11:44:05Z

@akapti and @heliocastro , we have committed to new changes. Please help me to check these changes.

mcjaeger · 2022-09-21T08:09:22Z

(from meeting:) needs re-review and re-test after PR comments have been implemented

akapti

Suggested some minor review comments. Please incorporate.

Tested the feature and it's working fine without any issues.

backend/src-common/src/main/java/org/eclipse/sw360/datahandler/db/ProjectDatabaseHandler.java

backend/src-common/src/main/java/org/eclipse/sw360/datahandler/db/ComponentDatabaseHandler.java

backend/src-common/src/main/java/org/eclipse/sw360/spdx/SpdxBOMImporter.java

tienlee · 2022-09-29T01:44:15Z

Suggested some minor review comments. Please incorporate.

Tested the feature and it's working fine without any issues.

Thank you very much. We will fix these minor defects soon.

Signed-off-by: Nguyen Nhu Tuan <tuan2.nguyennhu@toshiba.co.jp>

akapti

Code looks good to me.
Tested the changes and it's working as expected.

akapti · 2022-09-30T11:52:06Z

@tuannn2 @KoukiHama @ag4ums
The existing ( and old SBOM ) import functionality is such that whenever we import components from SBOM it does not set the component type field in component.
Since Component type is mandatory field in UI and REST API while creating the component.
It would be really good if we can set the component type to OSS while importing the components from SBOM.

Kindly include this change in the current PR if possible, or else create a new PR.

KoukiHama · 2022-09-30T11:55:52Z

@akapti @ag4ums

ok. I agree the idea about components type field

Could you merge this PR and make new issue and assign it to me?

base on the issue, we will make new PR as soon as possible.

KoukiHama · 2022-09-30T11:58:23Z

@akapti @ag4ums

It would be really good if we can set the component type to OSS while importing the components from SBO

we want to do it as new issue.

KoukiHama · 2022-09-30T12:07:46Z

@tienlee do you have idea about component type issue.

tienlee · 2022-10-03T02:01:01Z

@tienlee do you have idea about component type issue.

I think this is a bug from the old version. Please create new issue and I will fix it.

akapti · 2022-10-03T03:09:29Z

I think this is a bug from the old version. Please create new issue and I will fix it.

Created an new issue #1658 .
You can work on the above issue once this PR is merged.
This is present in current main branch as well (an existing issue)

…pdate_library_spdx feat(SPDX): Use new SPDX library (eclipse-sw360#1496) reviewed-by: abdul.kapti@siemens-healthineers.com tested-by: abdul.kapti@siemens-healthineers.com

tuannn2 force-pushed the releases/feature-update_library_spdx branch from 5bd9f61 to f0982de Compare July 18, 2022 02:24

KoukiHama added needs code review needs general test This is general testing, meaning that there is no org specific issue to check for labels Jul 19, 2022

tuannn2 force-pushed the releases/feature-update_library_spdx branch from f0982de to 26afaca Compare July 20, 2022 01:23

KoukiHama added in progress and removed needs code review needs general test This is general testing, meaning that there is no org specific issue to check for labels Jul 20, 2022

tuannn2 force-pushed the releases/feature-update_library_spdx branch from 26afaca to 64c43dc Compare July 20, 2022 10:49

KoukiHama added needs code review needs general test This is general testing, meaning that there is no org specific issue to check for and removed in progress labels Jul 21, 2022

KoukiHama assigned tuannn2 Jul 21, 2022

KoukiHama linked an issue Jul 21, 2022 that may be closed by this pull request

Use new SPDX library version 1.0.3 or later #1496

Closed

tienlee mentioned this pull request Aug 10, 2022

feat(SPDX): Use new SPDX library and New SPDX feature for import/export/edit #1503

Closed

1 task

akapti self-requested a review August 11, 2022 08:04

tuannn2 force-pushed the releases/feature-update_library_spdx branch from 64c43dc to 432d470 Compare September 12, 2022 06:52

akapti requested changes Sep 12, 2022

View reviewed changes

KoukiHama added in progress and removed needs code review needs general test This is general testing, meaning that there is no org specific issue to check for labels Sep 14, 2022

heliocastro reviewed Sep 15, 2022

View reviewed changes

backend/src-common/pom.xml Outdated Show resolved Hide resolved

tuannn2 force-pushed the releases/feature-update_library_spdx branch 2 times, most recently from 2f30008 to 32711cc Compare September 15, 2022 11:04

tuannn2 force-pushed the releases/feature-update_library_spdx branch from d4b33d0 to 9ab8eac Compare September 20, 2022 10:51

KoukiHama requested review from heliocastro and akapti September 20, 2022 12:25

KoukiHama added needs code review needs general test This is general testing, meaning that there is no org specific issue to check for and removed in progress labels Sep 21, 2022

tuannn2 force-pushed the releases/feature-update_library_spdx branch from 9ab8eac to 7a8a4f1 Compare September 26, 2022 02:11

akapti requested changes Sep 28, 2022

View reviewed changes

feat(SPDX): Use new SPDX library (eclipse-sw360#1496)

4596f06

Signed-off-by: Nguyen Nhu Tuan <tuan2.nguyennhu@toshiba.co.jp>

tuannn2 force-pushed the releases/feature-update_library_spdx branch from 7a8a4f1 to 4596f06 Compare September 29, 2022 02:33

akapti approved these changes Sep 29, 2022

View reviewed changes

akapti added ready ready to merge and removed needs code review needs general test This is general testing, meaning that there is no org specific issue to check for labels Sep 29, 2022

KoukiHama assigned tienlee and KoukiHama Sep 30, 2022

akapti merged commit ea23253 into eclipse-sw360:main Oct 3, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(SPDX): Use new SPDX library (#1496) #1594

feat(SPDX): Use new SPDX library (#1496) #1594

tuannn2 commented Jul 18, 2022 •

edited

Loading

KoukiHama commented Jul 19, 2022 •

edited

Loading

tienlee commented Aug 31, 2022

akapti commented Sep 12, 2022

tuannn2 commented Sep 12, 2022

akapti left a comment •

edited

Loading

tienlee commented Sep 20, 2022

mcjaeger commented Sep 21, 2022

akapti left a comment •

edited

Loading

tienlee commented Sep 29, 2022

akapti left a comment

akapti commented Sep 30, 2022 •

edited

Loading

KoukiHama commented Sep 30, 2022 •

edited

Loading

KoukiHama commented Sep 30, 2022 •

edited

Loading

KoukiHama commented Sep 30, 2022

tienlee commented Oct 3, 2022

akapti commented Oct 3, 2022 •

edited

Loading

feat(SPDX): Use new SPDX library (#1496) #1594

feat(SPDX): Use new SPDX library (#1496) #1594

Conversation

tuannn2 commented Jul 18, 2022 • edited Loading

Suggest Reviewer

How To Test?

Import SPDX BOM in Project page

Import SPDX BOM in Component page

Import SPDX license to release

Generate License Info in Project page

Checklist

KoukiHama commented Jul 19, 2022 • edited Loading

tienlee commented Aug 31, 2022

akapti commented Sep 12, 2022

tuannn2 commented Sep 12, 2022

akapti left a comment • edited Loading

Choose a reason for hiding this comment

tienlee commented Sep 20, 2022

mcjaeger commented Sep 21, 2022

akapti left a comment • edited Loading

Choose a reason for hiding this comment

tienlee commented Sep 29, 2022

akapti left a comment

Choose a reason for hiding this comment

akapti commented Sep 30, 2022 • edited Loading

KoukiHama commented Sep 30, 2022 • edited Loading

KoukiHama commented Sep 30, 2022 • edited Loading

KoukiHama commented Sep 30, 2022

tienlee commented Oct 3, 2022

akapti commented Oct 3, 2022 • edited Loading

tuannn2 commented Jul 18, 2022 •

edited

Loading

KoukiHama commented Jul 19, 2022 •

edited

Loading

akapti left a comment •

edited

Loading

akapti left a comment •

edited

Loading

akapti commented Sep 30, 2022 •

edited

Loading

KoukiHama commented Sep 30, 2022 •

edited

Loading

KoukiHama commented Sep 30, 2022 •

edited

Loading

akapti commented Oct 3, 2022 •

edited

Loading