Support archives as package src, autonamespace and other improvements #4
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This commit modifies the spdx.PackageFromLayerTarball to make it generic. The idea is to be able to generate packages from any tarbal, not just layers.
This commit adds more testing to the spdx package which currently has a low coverage. These new tests sover the following functions: spdx.GetImageReferences spdx.TestPullImagesToArchive spdx.TestGetDirectoryTree spdx.TestIgnorePatterns Signed-off-by: Adolfo García Veytia (Puerco) <adolfo.garcia@uservers.net>
This commit modifies the method signatures of the SPDX package building funcs in the implementation to make their signatures alike: recive an options struct as the first arg and then each package type data. Signed-off-by: Adolfo García Veytia (Puerco) <adolfo.garcia@uservers.net>
The spdx package now supports compressed tar files when creating packages from tarfiles or container images. Signed-off-by: Adolfo García Veytia (Puerco) <adolfo.garcia@uservers.net>
This commit moves the spdx.PackageFromDirectory() to the implementation to make it mockable. Signed-off-by: Adolfo García Veytia (Puerco) <adolfo.garcia@uservers.net>
Signed-off-by: Adolfo García Veytia (Puerco) <adolfo.garcia@uservers.net>
SPDX objects now support an option to add prefixes to identifiers. The purpose of the prefix is to add an arbitrary string to IDs to help avoid colisions when generating identifiers. Signed-off-by: Adolfo García Veytia (Puerco) <adolfo.garcia@uservers.net>
This commit deprecates the `bom generate --tarball` and renames it to `--image-archive`. The old flag still works but it is marked as deprecated. Signed-off-by: Adolfo García Veytia (Puerco) <adolfo.garcia@uservers.net>
bom and the underlying lubraries now support generating packages from archives. Currently only tar|tar.gz files are supported but more can be added in the future. Signed-off-by: Adolfo García Veytia (Puerco) <adolfo.garcia@uservers.net>
Previously, we required the SPDX document namespace to be supplied in a config file or a flag. This commits adds support to automatically generate the namespace using the https://spdx.org/spdxdocs/ URL as described in the SPDX spec. Signed-off-by: Adolfo García Veytia (Puerco) <adolfo.garcia@uservers.net>
When autogenerating a SPDX ID, we now preserve the special chars in seed strings to avoid reducing them to a point where collisions start to happen. Signed-off-by: Adolfo García Veytia (Puerco) <adolfo.garcia@uservers.net>
|
@puerco: GitHub didn't allow me to request PR reviews from the following users: kubernetes/release-engineering, kubernetes/release-managers. Note that only kubernetes-sigs members and repo collaborators can review this PR, and authors cannot review their own PRs. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
k8s-ci-robot
added
kind/bug
k8s-ci-robot
added
the
lgtm
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: cpanato, puerco The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What type of PR is this?
/kind bug
/kind cleanup
/kind feature
/kind deprecation
What this PR does / why we need it:
This PR adds a bunch of improvements to the bom tool and the spdx libraries:
spdxpackage to cover the following functions:spdx.GetImageReferencesspdx.TestPullImagesToArchivespdx.TestGetDirectoryTreespdx.TestIgnorePatterns--tarballsflag is now deprecated. It has been replaced with--image-archiveduring demos and chats, it proved to be confusing (it still works but will print a warning)--archivethat adds archives (currently tars) as packages. Its files are license-scanned and listed in the packageWhich issue(s) this PR fixes:
Special notes for your reviewer:
Replay of kubernetes/release#2319 on
k-sigs/bom/cc @kubernetes/release-engineering @kubernetes/release-managers
Does this PR introduce a user-facing change?