Merge pull request #234 from cbgbt/spdx-3.25.0

update SPDX license data to 3.26.0
bottlerocket-os · Jan 7, 2025 · 11590a1 · 11590a1
2 parents 9de1991 + c37b7e0
commit 11590a1
Show file tree

Hide file tree

Showing 9 changed files with 254 additions and 32 deletions.
diff --git a/Dockerfile b/Dockerfile
@@ -733,7 +733,7 @@ RUN rm /license-scan/{clarify,deny}.toml
 
 FROM sdk-cargo as sdk-license-scan
 
-ENV SPDXVER="3.19"
+ENV SPDXVER="3.26.0"
 
 USER builder
 WORKDIR /home/builder/license-scan

diff --git a/configs/cargo-deny/clarify.toml b/configs/cargo-deny/clarify.toml
@@ -1,3 +1,10 @@
+[spdx]
+ignore-licenses = [
+    # Apache-2.0 is often misclassified as Pixar, which is a significantly more rare
+    # https://github.com/jpeddicord/askalono/issues/94
+    "Pixar"
+]
+
 [clarify.askalono]
 expression = "Apache-2.0"
 license-files = [

diff --git a/configs/cargo-make/clarify.toml b/configs/cargo-make/clarify.toml
@@ -1,3 +1,10 @@
+[spdx]
+ignore-licenses = [
+    # Apache-2.0 is often misclassified as Pixar, which is a significantly more rare
+    # https://github.com/jpeddicord/askalono/issues/94
+    "Pixar"
+]
+
 [clarify.bstr]
 expression = "(MIT OR Apache-2.0) AND Unicode-DFS-2016"
 license-files = [

diff --git a/hashes/license-scan b/hashes/license-scan
@@ -1,2 +1,2 @@
-# https://github.com/spdx/license-list-data/archive/v3.19.tar.gz#/license-list-data-3.19.tar.gz
-SHA512 (license-list-data-3.19.tar.gz) = 23d90eece2f164a00ad710c84c3f3194bf54830b4c2b5c2739c4bf713c95ab161697850eecb20d1c3dfbdad24aa795a75bf11f9473982824fc9fe885962b7433
+# https://github.com/spdx/license-list-data/archive/v3.26.0.tar.gz#/license-list-data-3.26.0.tar.gz
+SHA512 (license-list-data-3.26.0.tar.gz) = 67e618d4642dfe4f366935d9514d6f7941d3711e77c49bc1b340ac572d36015981b8f10c72a9f80f1d83e132ae7e5093c0155e0c0e786e4777ee16d1cb7b885a
diff --git a/license-scan/Cargo.lock b/license-scan/Cargo.lock
diff --git a/license-scan/Cargo.toml b/license-scan/Cargo.toml
@@ -17,8 +17,9 @@ ignore = "0.4"
 lazy_static = "1"
 semver = { version = "1", features = ["serde"] }
 serde = { version = "1", features = ["derive"] }
-spdx = "0.3"
+spdx = "0.10"
 structopt = { version = "0.3", default-features = false }
+tempfile = "3"
 toml = "0.8"
 twox-hash = "1"
 walkdir = "2"

diff --git a/license-scan/clarify.toml b/license-scan/clarify.toml
@@ -1,3 +1,10 @@
+[spdx]
+ignore-licenses = [
+    # Apache-2.0 is often misclassified as Pixar, which is a significantly more rare
+    # https://github.com/jpeddicord/askalono/issues/94
+    "Pixar"
+]
+
 [clarify.askalono]
 expression = "Apache-2.0"
 license-files = [
@@ -21,7 +28,6 @@ license-files = [
     { path = "COPYING", hash = 0x278afbcf },
     { path = "LICENSE-APACHE", hash = 0x24b54f4b },
     { path = "LICENSE-MIT", hash = 0x462dee44 },
-    { path = "src/unicode/data/LICENSE-UNICODE", hash = 0x70f7339 },
 ]
 
 [clarify.crossbeam-channel]
@@ -58,12 +64,16 @@ license-files = [
     { path = "src/unicode_tables/LICENSE-UNICODE", hash = 0xa7f28b93 },
 ]
 
-[clarify.unicode-ident]
-expression = "(MIT OR Apache-2.0) AND Unicode-DFS-2016"
+[clarify.spdx]
+expression = "MIT OR Apache-2.0"
 license-files = [
-    { path = "LICENSE-APACHE", hash = 0xb5518783 },
-    { path = "LICENSE-MIT", hash = 0x386ca1bc },
-    { path = "LICENSE-UNICODE", hash = 0x9698cbbe },
+    { path = "LICENSE-MIT", hash = 0xa502ee8a },
+    { path = "LICENSE-APACHE", hash = 0x4fccb6b7 },
+]
+skip-dirs = [
+    # The spdx crate contains the full text of referred licenses
+    "src/text/licenses",
+    "src/text/exceptions",
 ]
 
 [clarify.zstd-safe]