spdx · armintaenzertng · Jan 2, 2023 · Dec 29, 2022 · Dec 29, 2022 · Dec 29, 2022
diff --git a/src/datetime_conversions.py b/src/datetime_conversions.py
@@ -0,0 +1,28 @@
+#  Copyright (c) 2022 spdx contributors
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#    http://www.apache.org/licenses/LICENSE-2.0
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+from datetime import datetime
+
+from src.parser.error import SPDXParsingError
+
+
+def datetime_from_str(date_str: str) -> datetime:
+    if not isinstance(date_str, str):
+        raise TypeError(f"Could not convert str to datetime, invalid type: {type(date_str).__name__}")
+
+    date = datetime.strptime(date_str, "%Y-%m-%dT%H:%M:%SZ") # raises ValueError if format does not match
+    return date
+
+def datetime_to_iso_string(date: datetime) -> str:
+    """
+    Return an ISO-8601 representation of a datetime object.
+    """
+    return date.isoformat() + "Z"
+
diff --git a/src/model/actor.py b/src/model/actor.py
@@ -29,3 +29,10 @@ class Actor:
 
     def __init__(self, actor_type: ActorType, name: str, email: Optional[str] = None):
         check_types_and_set_values(self, locals())
+
+    def to_serialized_string(self) -> str:
+        """
+        All serialization formats use the same representation of an actor, so this method is included in the data model
+        """
+        optional_email = f" ({self.email})" if self.email else ""
+        return "".join([f"{self.actor_type.name.title()}:", f" {self.name}", optional_email])
diff --git a/src/parser/json/annotation_parser.py b/src/parser/json/annotation_parser.py
@@ -15,8 +15,9 @@
 from src.model.annotation import Annotation, AnnotationType
 from src.parser.error import SPDXParsingError
 from src.parser.json.actor_parser import ActorParser
-from src.parser.json.dict_parsing_functions import datetime_from_str, construct_or_raise_parsing_error, \
+from src.parser.json.dict_parsing_functions import construct_or_raise_parsing_error, \
     parse_field_or_log_error, append_parsed_field_or_log_error, raise_parsing_error_if_logger_has_messages
+from src.datetime_conversions import datetime_from_str
 from src.parser.logger import Logger
 
 

diff --git a/src/parser/json/creation_info_parser.py b/src/parser/json/creation_info_parser.py
@@ -19,9 +19,10 @@
 from src.parser.error import SPDXParsingError
 from src.parser.json.actor_parser import ActorParser
 from src.parser.json.checksum_parser import ChecksumParser
-from src.parser.json.dict_parsing_functions import append_parsed_field_or_log_error, datetime_from_str, \
+from src.parser.json.dict_parsing_functions import append_parsed_field_or_log_error, \
     raise_parsing_error_if_logger_has_messages, construct_or_raise_parsing_error, parse_field_or_log_error, \
     parse_field_or_no_assertion
+from src.datetime_conversions import datetime_from_str
 from src.parser.logger import Logger
 
 

diff --git a/src/parser/json/dict_parsing_functions.py b/src/parser/json/dict_parsing_functions.py
@@ -8,7 +8,6 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-from datetime import datetime
 from typing import Any, Callable, Dict, List, Optional
 
 from src.model.spdx_no_assertion import SpdxNoAssertion
@@ -18,17 +17,6 @@
 from src.parser.logger import Logger
 
 
-def datetime_from_str(date_str: str) -> datetime:
-    if not isinstance(date_str, str):
-        raise SPDXParsingError([f"Could not convert str to datetime, invalid type: {type(date_str).__name__}"])
-    try:
-        date = datetime.strptime(date_str, "%Y-%m-%dT%H:%M:%SZ")
-    except ValueError:
-        raise SPDXParsingError(
-            [f'Could not convert str to datetime, format of {date_str} does not match "%Y-%m-%dT%H:%M:%SZ"'])
-    return date
-
-
 def json_str_to_enum_name(json_str: str) -> str:
     if not isinstance(json_str, str):
         raise SPDXParsingError([f"Type for enum must be str not {type(json_str).__name__}"])
@@ -54,7 +42,9 @@ def parse_field_or_log_error(logger: Logger, field: Any, parsing_method: Callabl
             return parsing_method(field)
     except SPDXParsingError as err:
         logger.extend(err.get_messages())
-        return default
+    except (TypeError, ValueError) as err:
+        logger.extend(err.args[0])
+    return default
 
 
 def append_parsed_field_or_log_error(logger: Logger, list_to_append_to: List[Any], field: Any,
@@ -64,6 +54,8 @@ def append_parsed_field_or_log_error(logger: Logger, list_to_append_to: List[Any
         list_to_append_to.append(parsed_element)
     except SPDXParsingError as err:
         logger.extend(err.get_messages())
+    except (TypeError, ValueError) as err:
+        logger.extend(err.args[0])
     return list_to_append_to
 
 

diff --git a/src/parser/json/package_parser.py b/src/parser/json/package_parser.py
@@ -20,9 +20,10 @@
 from src.parser.error import SPDXParsingError
 from src.parser.json.actor_parser import ActorParser
 from src.parser.json.checksum_parser import ChecksumParser
-from src.parser.json.dict_parsing_functions import append_parsed_field_or_log_error, datetime_from_str, \
+from src.parser.json.dict_parsing_functions import append_parsed_field_or_log_error, \
     raise_parsing_error_if_logger_has_messages, json_str_to_enum_name, construct_or_raise_parsing_error, \
     parse_field_or_log_error, parse_field_or_no_assertion_or_none, parse_field_or_no_assertion
+from src.datetime_conversions import datetime_from_str
 from src.parser.json.license_expression_parser import LicenseExpressionParser
 from src.parser.logger import Logger
 

diff --git a/src/writer/tagvalue/__init__.py b/src/writer/tagvalue/__init__.py
diff --git a/src/writer/tagvalue/annotation_writer.py b/src/writer/tagvalue/annotation_writer.py
@@ -0,0 +1,23 @@
+#  Copyright (c) 2022 spdx contributors
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#    http://www.apache.org/licenses/LICENSE-2.0
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+from typing import TextIO
+
+from src.datetime_conversions import datetime_to_iso_string
+from src.model.annotation import Annotation
+from src.writer.tagvalue.tagvalue_writer_helper_functions import write_value, write_text_value
+
+
+def write_annotation(annotation: Annotation, text_output: TextIO):
+    write_value("Annotator", annotation.annotator.to_serialized_string(), text_output)
+    write_value("AnnotationDate", datetime_to_iso_string(annotation.annotation_date), text_output)
+    write_value("AnnotationType", annotation.annotation_type.name, text_output)
+    write_value("SPDXREF", annotation.spdx_id, text_output)
+    write_text_value("AnnotationComment", annotation.annotation_comment, text_output)
diff --git a/src/writer/tagvalue/checksum_writer.py b/src/writer/tagvalue/checksum_writer.py
@@ -0,0 +1,31 @@
+#  Copyright (c) 2022 spdx contributors
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#    http://www.apache.org/licenses/LICENSE-2.0
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+from src.model.checksum import Checksum, ChecksumAlgorithm
+
+
+def write_checksum_to_tag_value(checksum: Checksum) -> str:
+    algorithm_name: str = checksum.algorithm.name
+    # Convert underscores to dashes, and other Blake2b-specific casing rules
+    if "_" in algorithm_name:
+        algorithm_name = CHECKSUM_ALGORITHM_TO_TV.get(algorithm_name)
+        if algorithm_name is None:
+            raise ValueError(f"Missing conversion rule for converting {checksum.algorithm.name} to tag-value string")
+    return f"{algorithm_name}: {checksum.value}"
+
+
+CHECKSUM_ALGORITHM_TO_TV = {
+    ChecksumAlgorithm.BLAKE2B_256.name: "BLAKE2b-256",
+    ChecksumAlgorithm.BLAKE2B_384.name: "BLAKE2b-384",
+    ChecksumAlgorithm.BLAKE2B_512.name: "BLAKE2b-512",
+    ChecksumAlgorithm.SHA3_256.name: "SHA3-256",
+    ChecksumAlgorithm.SHA3_384.name: "SHA3-384",
+    ChecksumAlgorithm.SHA3_512.name: "SHA3-512"
+}
diff --git a/src/writer/tagvalue/creation_info_writer.py b/src/writer/tagvalue/creation_info_writer.py
@@ -0,0 +1,39 @@
+#  Copyright (c) 2022 spdx contributors
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#    http://www.apache.org/licenses/LICENSE-2.0
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+from typing import TextIO
+
+from src.datetime_conversions import datetime_to_iso_string
+from src.model.document import CreationInfo
+from src.writer.tagvalue.tagvalue_writer_helper_functions import write_value, write_text_value, write_optional_heading, \
+    write_separator
+
+
+def write_creation_info(creation_info: CreationInfo, text_output: TextIO):
+    write_value("SPDXVersion", creation_info.spdx_version, text_output)
+    write_value("DataLicense", creation_info.data_license, text_output)
+    write_value("SPDXID", creation_info.spdx_id, text_output)
+    write_value("DocumentName", creation_info.name, text_output)
+    write_value("DocumentNamespace", creation_info.document_namespace, text_output)
+    write_text_value("DocumentComment", creation_info.document_comment, text_output)
+
+    write_optional_heading(creation_info.external_document_refs, "\n## External Document References\n", text_output)
+    for external_document_ref in creation_info.external_document_refs:
+        external_document_ref_str = " ".join([external_document_ref.document_ref_id, external_document_ref.document_uri,
+                                              external_document_ref.checksum.algorithm.name + ": " + external_document_ref.checksum.value])
+        write_value("ExternalDocumentRef", external_document_ref_str, text_output)
+    write_separator(text_output)
+
+    text_output.write("## Creation Information\n")
+    write_value("LicenseListVersion", str(creation_info.spdx_version), text_output)
+    for creator in creation_info.creators:
+        write_value("Creator", creator.to_serialized_string(), text_output)
+    write_value("Created", datetime_to_iso_string(creation_info.created), text_output)
+    write_text_value("CreatorComment", creation_info.creator_comment, text_output)
diff --git a/src/writer/tagvalue/extracted_licensing_info_writer.py b/src/writer/tagvalue/extracted_licensing_info_writer.py
@@ -0,0 +1,25 @@
+#  Copyright (c) 2022 spdx contributors
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#    http://www.apache.org/licenses/LICENSE-2.0
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+from typing import TextIO
+
+from src.model.extracted_licensing_info import ExtractedLicensingInfo
+from src.writer.tagvalue.tagvalue_writer_helper_functions import write_value, write_text_value
+
+
+def write_extracted_licensing_info(extracted_licensing_info: ExtractedLicensingInfo, text_output: TextIO):
+    write_value("LicenseID", extracted_licensing_info.license_id, text_output)
+    write_text_value("ExtractedText", extracted_licensing_info.extracted_text, text_output)
+    write_value("LicenseName", extracted_licensing_info.license_name, text_output)
+
+    for cross_reference in sorted(extracted_licensing_info.cross_references):
+        write_value("LicenseCrossReference", cross_reference, text_output)
+
+    write_text_value("LicenseComment", extracted_licensing_info.comment, text_output)
diff --git a/src/writer/tagvalue/file_writer.py b/src/writer/tagvalue/file_writer.py
@@ -0,0 +1,43 @@
+#  Copyright (c) 2022 spdx contributors
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#    http://www.apache.org/licenses/LICENSE-2.0
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+from typing import TextIO
+
+from src.model.file import File
+from src.writer.tagvalue.tagvalue_writer_helper_functions import write_value, write_text_value, \
+    write_license_expression
+from src.writer.tagvalue.checksum_writer import write_checksum_to_tag_value
+
+
+def write_file(file: File, text_output: TextIO):
+    text_output.write("## File Information\n")
+
+    write_value("FileName", file.name, text_output)
+    write_value("SPDXID", file.spdx_id, text_output)
+
+    for file_type in file.file_type:
+        write_value("FileType", file_type.name, text_output)
+
+    for file_checksum in file.checksums:
+        write_value("FileChecksum", write_checksum_to_tag_value(file_checksum), text_output)
+
+    write_license_expression("LicenseConcluded", file.concluded_license, text_output)
+    write_license_expression("LicenseInfoInFile", file.license_info_in_file, text_output)
+    write_text_value("LicenseComments", file.license_comment, text_output)
+    write_text_value("FileCopyrightText", file.copyright_text, text_output)
+
+    write_text_value("FileComment", file.comment, text_output)
+    write_text_value("FileNotice", file.notice, text_output)
+
+    for contributor in sorted(file.contributors):
+        write_value("FileContributor", contributor, text_output)
+
+    for attribution_text in file.attribution_texts:
+        write_text_value("FileAttributionText", attribution_text, text_output)
diff --git a/src/writer/tagvalue/package_writer.py b/src/writer/tagvalue/package_writer.py
@@ -0,0 +1,81 @@
+#  Copyright (c) 2022 spdx contributors
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#    http://www.apache.org/licenses/LICENSE-2.0
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+from typing import TextIO
+
+from src.datetime_conversions import datetime_to_iso_string
+from src.model.package import Package, PackageVerificationCode
+from src.writer.tagvalue.tagvalue_writer_helper_functions import write_value, write_text_value, \
+    write_license_expression, transform_enum_name_to_tv, write_actor
+from src.writer.tagvalue.checksum_writer import write_checksum_to_tag_value
+
+
+def write_package(package: Package, text_output: TextIO):
+    text_output.write("## Package Information\n")
+
+    write_value("PackageName", package.name, text_output)
+    write_value("SPDXID", package.spdx_id, text_output)
+    write_value("PackageVersion", package.version, text_output)
+    write_value("PackageFileName", package.file_name, text_output)
+    write_actor("PackageSupplier", package.supplier, text_output)
+    write_actor("PackageOriginator", package.originator, text_output)
+    write_value("PackageDownloadLocation", package.download_location, text_output)
+
+    write_value("FilesAnalyzed", package.files_analyzed, text_output)
+    if package.verification_code:
+        package_verification_code = get_package_verification_code_string(package.verification_code)
+        write_value("PackageVerificationCode", package_verification_code, text_output)
+
+    for package_checksum in package.checksums:
+        write_value("PackageChecksum", write_checksum_to_tag_value(package_checksum), text_output)
+
+    write_value("PackageHomePage", package.homepage, text_output)
+    write_text_value("PackageSourceInfo", package.source_info, text_output)
+
+    write_license_expression("PackageLicenseConcluded", package.license_concluded, text_output)
+    write_license_expression("PackageLicenseInfoFromFiles", package.license_info_from_files, text_output)
+    write_license_expression("PackageLicenseDeclared", package.license_declared, text_output)
+    write_text_value("PackageLicenseComments", package.license_comment, text_output)
+    write_text_value("PackageCopyrightText", package.copyright_text, text_output)
+
+    write_text_value("PackageSummary", package.summary, text_output)
+    write_text_value("PackageDescription", package.description, text_output)
+    write_text_value("PackageComment", package.comment, text_output)
+
+    for external_reference in package.external_references:
+        external_reference_str = " ".join(
+            [transform_enum_name_to_tv(external_reference.category.name), external_reference.reference_type,
+             external_reference.locator]
+        )
+        write_value("ExternalRef", external_reference_str, text_output)
+        if external_reference.comment:
+            write_text_value("ExternalRefComment", external_reference.comment, text_output)
+
+    for attribution_text in package.attribution_texts:
+        write_text_value("PackageAttributionText", attribution_text, text_output)
+
+    if package.primary_package_purpose:
+        write_value("PrimaryPackagePurpose", transform_enum_name_to_tv(package.primary_package_purpose.name),
+                    text_output)
+
+    if package.release_date:
+        write_value("ReleaseDate", datetime_to_iso_string(package.release_date), text_output)
+    if package.built_date:
+        write_value("BuiltDate", datetime_to_iso_string(package.built_date), text_output)
+    if package.valid_until_date:
+        write_value("ValidUntilDate", datetime_to_iso_string(package.valid_until_date), text_output)
+
+
+def get_package_verification_code_string(verification_code: PackageVerificationCode) -> str:
+    if not verification_code.excluded_files:
+        return verification_code.value
+
+    excluded_files_str = " (excludes: " + " ".join(verification_code.excluded_files) + ")"
+    return verification_code.value + excluded_files_str
diff --git a/src/writer/tagvalue/relationship_writer.py b/src/writer/tagvalue/relationship_writer.py
@@ -0,0 +1,21 @@
+#  Copyright (c) 2022 spdx contributors
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#    http://www.apache.org/licenses/LICENSE-2.0
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+from typing import TextIO
+
+from src.model.relationship import Relationship
+from src.writer.tagvalue.tagvalue_writer_helper_functions import write_value, write_text_value
+
+
+def write_relationship(relationship: Relationship, text_output: TextIO):
+    write_value("Relationship", " ".join(
+        [relationship.spdx_element_id, relationship.relationship_type.name, relationship.related_spdx_element_id]),
+                text_output)
+    write_text_value("RelationshipComment", relationship.comment, text_output)