Skip to content

Commit c343abe

Browse files
Gabriel Féronsschuberth
Gabriel Féron
authored and
sschuberth
committed
Cargo: replace / by OR in the license field of Rust crates
cargo supports the legacy '/' format to specify multiple licenses and the consensus is that crates.io should only accept SPDX 2.1 license expressions, but this is not enforced as of yet. see: rust-lang/cargo#2039 Signed-off-by: Gabriel Féron <[email protected]>
1 parent bfa7e23 commit c343abe

File tree

4 files changed

+44
-60
lines changed

4 files changed

+44
-60
lines changed

‎analyzer/src/funTest/assets/projects/synthetic/cargo-expected-output.yml

Lines changed: 32 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,9 @@ project:
33
id: "Cargo::lib:0.1.0"
44
definition_file_path: "<REPLACE_DEFINITION_FILE_PATH>"
55
declared_licenses:
6-
- "Apache-2.0"
7-
- "MIT"
6+
- "MIT OR Apache-2.0"
87
declared_licenses_processed:
9-
spdx_expression: "Apache-2.0 AND MIT"
8+
spdx_expression: "MIT OR Apache-2.0"
109
vcs:
1110
type: ""
1211
url: ""
@@ -128,10 +127,9 @@ packages:
128127
id: "Cargo::autocfg:0.1.6"
129128
purl: "pkg:cargo/[email protected]"
130129
declared_licenses:
131-
- "Apache-2.0"
132-
- "MIT"
130+
- "Apache-2.0 OR MIT"
133131
declared_licenses_processed:
134-
spdx_expression: "Apache-2.0 AND MIT"
132+
spdx_expression: "Apache-2.0 OR MIT"
135133
description: "Automatic cfg for Rust compiler features"
136134
homepage_url: ""
137135
binary_artifact:
@@ -159,10 +157,9 @@ packages:
159157
id: "Cargo::bitflags:1.1.0"
160158
purl: "pkg:cargo/[email protected]"
161159
declared_licenses:
162-
- "Apache-2.0"
163-
- "MIT"
160+
- "MIT OR Apache-2.0"
164161
declared_licenses_processed:
165-
spdx_expression: "Apache-2.0 AND MIT"
162+
spdx_expression: "MIT OR Apache-2.0"
166163
description: "A macro to generate structures which behave like bitflags.\n"
167164
homepage_url: ""
168165
binary_artifact:
@@ -190,10 +187,9 @@ packages:
190187
id: "Cargo::cfg-if:0.1.9"
191188
purl: "pkg:cargo/[email protected]"
192189
declared_licenses:
193-
- "Apache-2.0"
194-
- "MIT"
190+
- "MIT OR Apache-2.0"
195191
declared_licenses_processed:
196-
spdx_expression: "Apache-2.0 AND MIT"
192+
spdx_expression: "MIT OR Apache-2.0"
197193
description: "A macro to ergonomically define an item depending on a large number\
198194
\ of #[cfg]\nparameters. Structured like an if-else chain, the first matching\
199195
\ branch is the\nitem that gets emitted.\n"
@@ -313,10 +309,9 @@ packages:
313309
id: "Cargo::rand:0.6.5"
314310
purl: "pkg:cargo/[email protected]"
315311
declared_licenses:
316-
- "Apache-2.0"
317-
- "MIT"
312+
- "MIT OR Apache-2.0"
318313
declared_licenses_processed:
319-
spdx_expression: "Apache-2.0 AND MIT"
314+
spdx_expression: "MIT OR Apache-2.0"
320315
description: "Random number generators and other randomness functionality.\n"
321316
homepage_url: ""
322317
binary_artifact:
@@ -344,10 +339,9 @@ packages:
344339
id: "Cargo::rand_chacha:0.1.1"
345340
purl: "pkg:cargo/[email protected]"
346341
declared_licenses:
347-
- "Apache-2.0"
348-
- "MIT"
342+
- "MIT OR Apache-2.0"
349343
declared_licenses_processed:
350-
spdx_expression: "Apache-2.0 AND MIT"
344+
spdx_expression: "MIT OR Apache-2.0"
351345
description: "ChaCha random number generator\n"
352346
homepage_url: ""
353347
binary_artifact:
@@ -375,10 +369,9 @@ packages:
375369
id: "Cargo::rand_core:0.3.1"
376370
purl: "pkg:cargo/[email protected]"
377371
declared_licenses:
378-
- "Apache-2.0"
379-
- "MIT"
372+
- "MIT OR Apache-2.0"
380373
declared_licenses_processed:
381-
spdx_expression: "Apache-2.0 AND MIT"
374+
spdx_expression: "MIT OR Apache-2.0"
382375
description: "Core random number generator traits and tools for implementation.\n"
383376
homepage_url: ""
384377
binary_artifact:
@@ -406,10 +399,9 @@ packages:
406399
id: "Cargo::rand_core:0.4.2"
407400
purl: "pkg:cargo/[email protected]"
408401
declared_licenses:
409-
- "Apache-2.0"
410-
- "MIT"
402+
- "MIT OR Apache-2.0"
411403
declared_licenses_processed:
412-
spdx_expression: "Apache-2.0 AND MIT"
404+
spdx_expression: "MIT OR Apache-2.0"
413405
description: "Core random number generator traits and tools for implementation.\n"
414406
homepage_url: ""
415407
binary_artifact:
@@ -437,10 +429,9 @@ packages:
437429
id: "Cargo::rand_hc:0.1.0"
438430
purl: "pkg:cargo/[email protected]"
439431
declared_licenses:
440-
- "Apache-2.0"
441-
- "MIT"
432+
- "MIT OR Apache-2.0"
442433
declared_licenses_processed:
443-
spdx_expression: "Apache-2.0 AND MIT"
434+
spdx_expression: "MIT OR Apache-2.0"
444435
description: "HC128 random number generator\n"
445436
homepage_url: ""
446437
binary_artifact:
@@ -468,10 +459,9 @@ packages:
468459
id: "Cargo::rand_isaac:0.1.1"
469460
purl: "pkg:cargo/[email protected]"
470461
declared_licenses:
471-
- "Apache-2.0"
472-
- "MIT"
462+
- "MIT OR Apache-2.0"
473463
declared_licenses_processed:
474-
spdx_expression: "Apache-2.0 AND MIT"
464+
spdx_expression: "MIT OR Apache-2.0"
475465
description: "ISAAC random number generator\n"
476466
homepage_url: ""
477467
binary_artifact:
@@ -529,10 +519,9 @@ packages:
529519
id: "Cargo::rand_os:0.1.3"
530520
purl: "pkg:cargo/[email protected]"
531521
declared_licenses:
532-
- "Apache-2.0"
533-
- "MIT"
522+
- "MIT OR Apache-2.0"
534523
declared_licenses_processed:
535-
spdx_expression: "Apache-2.0 AND MIT"
524+
spdx_expression: "MIT OR Apache-2.0"
536525
description: "OS backed Random Number Generator"
537526
homepage_url: ""
538527
binary_artifact:
@@ -560,10 +549,9 @@ packages:
560549
id: "Cargo::rand_pcg:0.1.2"
561550
purl: "pkg:cargo/[email protected]"
562551
declared_licenses:
563-
- "Apache-2.0"
564-
- "MIT"
552+
- "MIT OR Apache-2.0"
565553
declared_licenses_processed:
566-
spdx_expression: "Apache-2.0 AND MIT"
554+
spdx_expression: "MIT OR Apache-2.0"
567555
description: "Selected PCG random number generators\n"
568556
homepage_url: ""
569557
binary_artifact:
@@ -591,10 +579,9 @@ packages:
591579
id: "Cargo::rand_xorshift:0.1.1"
592580
purl: "pkg:cargo/[email protected]"
593581
declared_licenses:
594-
- "Apache-2.0"
595-
- "MIT"
582+
- "MIT OR Apache-2.0"
596583
declared_licenses_processed:
597-
spdx_expression: "Apache-2.0 AND MIT"
584+
spdx_expression: "MIT OR Apache-2.0"
598585
description: "Xorshift random number generator\n"
599586
homepage_url: ""
600587
binary_artifact:
@@ -684,10 +671,9 @@ packages:
684671
id: "Cargo::winapi-i686-pc-windows-gnu:0.4.0"
685672
purl: "pkg:cargo/[email protected]"
686673
declared_licenses:
687-
- "Apache-2.0"
688-
- "MIT"
674+
- "MIT OR Apache-2.0"
689675
declared_licenses_processed:
690-
spdx_expression: "Apache-2.0 AND MIT"
676+
spdx_expression: "MIT OR Apache-2.0"
691677
description: "Import libraries for the i686-pc-windows-gnu target. Please don't\
692678
\ use this crate directly, depend on winapi instead."
693679
homepage_url: ""
@@ -716,10 +702,9 @@ packages:
716702
id: "Cargo::winapi-x86_64-pc-windows-gnu:0.4.0"
717703
purl: "pkg:cargo/[email protected]"
718704
declared_licenses:
719-
- "Apache-2.0"
720-
- "MIT"
705+
- "MIT OR Apache-2.0"
721706
declared_licenses_processed:
722-
spdx_expression: "Apache-2.0 AND MIT"
707+
spdx_expression: "MIT OR Apache-2.0"
723708
description: "Import libraries for the x86_64-pc-windows-gnu target. Please don't\
724709
\ use this crate directly, depend on winapi instead."
725710
homepage_url: ""
@@ -748,10 +733,9 @@ packages:
748733
id: "Cargo::winapi:0.3.8"
749734
purl: "pkg:cargo/[email protected]"
750735
declared_licenses:
751-
- "Apache-2.0"
752-
- "MIT"
736+
- "MIT OR Apache-2.0"
753737
declared_licenses_processed:
754-
spdx_expression: "Apache-2.0 AND MIT"
738+
spdx_expression: "MIT OR Apache-2.0"
755739
description: "Raw FFI bindings for all of Windows API."
756740
homepage_url: ""
757741
binary_artifact:

‎analyzer/src/funTest/assets/projects/synthetic/cargo-subcrate-client-expected-output.yml

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -32,10 +32,9 @@ packages:
3232
id: "Cargo::cfg-if:0.1.9"
3333
purl: "pkg:cargo/[email protected]"
3434
declared_licenses:
35-
- "Apache-2.0"
36-
- "MIT"
35+
- "MIT OR Apache-2.0"
3736
declared_licenses_processed:
38-
spdx_expression: "Apache-2.0 AND MIT"
37+
spdx_expression: "MIT OR Apache-2.0"
3938
description: "A macro to ergonomically define an item depending on a large number\
4039
\ of #[cfg]\nparameters. Structured like an if-else chain, the first matching\
4140
\ branch is the\nitem that gets emitted.\n"

‎analyzer/src/funTest/assets/projects/synthetic/cargo-subcrate-lib-expected-output.yml

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,9 @@ project:
33
id: "Cargo::lib:0.1.0"
44
definition_file_path: "<REPLACE_DEFINITION_FILE_PATH>"
55
declared_licenses:
6-
- "Apache-2.0"
7-
- "MIT"
6+
- "MIT OR Apache-2.0"
87
declared_licenses_processed:
9-
spdx_expression: "Apache-2.0 AND MIT"
8+
spdx_expression: "MIT OR Apache-2.0"
109
vcs:
1110
type: ""
1211
url: ""
@@ -39,10 +38,9 @@ packages:
3938
id: "Cargo::cfg-if:0.1.9"
4039
purl: "pkg:cargo/[email protected]"
4140
declared_licenses:
42-
- "Apache-2.0"
43-
- "MIT"
41+
- "MIT OR Apache-2.0"
4442
declared_licenses_processed:
45-
spdx_expression: "Apache-2.0 AND MIT"
43+
spdx_expression: "MIT OR Apache-2.0"
4644
description: "A macro to ergonomically define an item depending on a large number\
4745
\ of #[cfg]\nparameters. Structured like an if-else chain, the first matching\
4846
\ branch is the\nitem that gets emitted.\n"

‎analyzer/src/main/kotlin/managers/Cargo.kt

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ import com.fasterxml.jackson.databind.JsonNode
2424
import com.moandjiezana.toml.Toml
2525

2626
import java.io.File
27+
import java.util.SortedSet
2728

2829
import org.ossreviewtoolkit.analyzer.AbstractPackageManagerFactory
2930
import org.ossreviewtoolkit.analyzer.PackageManager
@@ -89,11 +90,13 @@ class Cargo(
8990
private fun extractVcsInfo(node: JsonNode) =
9091
VcsHost.toVcsInfo(extractRepositoryUrl(node))
9192

92-
private fun extractDeclaredLicenses(node: JsonNode) =
93-
node["license"].textValueOrEmpty().split("/")
93+
private fun extractDeclaredLicenses(node: JsonNode): SortedSet<String> {
94+
val licenses = node["license"].textValueOrEmpty().split('/')
9495
.map { it.trim() }
9596
.filter { it.isNotEmpty() }
96-
.toSortedSet()
97+
98+
return if (licenses.isEmpty()) sortedSetOf() else sortedSetOf(licenses.joinToString(" OR "))
99+
}
97100

98101
private fun extractSourceArtifact(
99102
node: JsonNode,

0 commit comments

Comments
 (0)