Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

[SPIKE] Parse Fossa text report

Description

With https://github.com/fossas/fossa-cli it's quite easy and flexible to generate a text version with the mapping between licenses and dependencies; example reported on https://gist.github.com/maoo/1bae6b420d79cc54df8563ef0b8c13fa

If we could parse this file into a map, given a simple data representation of our license policies (ie a config .yaml file), we could easily sort the result, (FINALLY!) filter out entries with duplicate licenses and flag the unidentified ones.

It would be also quite easy to build a whitelist for false negative dependencies that are flagged across multiple repositories.

"fossa test" command may help, but we're blocked on https://github.com/fossas/fossa-cli/issues/126 .

Sent email to Kevin to ask for help.

Acceptance Criteria

None

Attachments

1

Activity

Maurizio PillituSeptember 6, 2019 at 9:56 AM

That's a good question . I believe the current format is FOSSA-generated (see JSON reported on https://gist.github.com/maoo/40a4f7a9df8315290a1b0c347dd018da ).

The identifiers that you see being mentioned are SPDX IDs, which allow to have a consolidated set of license definitions.

Definitely worth discussing this with FOSSA, hopefully during next ODP meeting.

Jamie JonesSeptember 4, 2019 at 4:29 PM

Is this a fossa-generated format, or is this following one of the standard BOM formats being developed by the community for greater reuse?

Existing efforts that i’m aware of in this space are:

  • SPDX (probably the most deeply ingrained, lots of tool support, very focused on licensing, verbose)

  • SPDX-Lite (subset of SPDX being driven by a working group in Japan, mainly automotive)

  • NTIA

  • MITRE

  • CycloneDX (I just came across this one recently, it's out of an OASIS working group)

Maurizio PillituAugust 28, 2019 at 1:31 PM

Using "FOSSA_API_KEY" and fossa-cli latest version (1.0.3) I managed to get the code working again on https://gist.github.com/maoo/40a4f7a9df8315290a1b0c347dd018da

This simple snippet of code is the spike we were expecting: generate a JSON model of all (direct and transitive) dependency licenses, given the Git endpoint of a code repository.

This code is supposed to be "wrapped" into a containerised architecture, triggered by a GitHub event (ie commit/push), which will eventually notify the developer teams via GitHub Issues and/or email (to enforce confidentiality, if it applies); refer to https://finosfoundation.atlassian.net/browse/ODP-9 for further developments of this feature.

Maurizio PillituJuly 11, 2019 at 4:30 PM

Sharing slides that describe high-level objectives and requirements.

[^[AGENDA] Continuous license validation for FINOS.pdf]

Maurizio PillituJune 14, 2019 at 3:03 PM

Done

Details

Assignee

Reporter

Priority

Parent

Created June 18, 2018 at 9:56 AM
Updated September 6, 2019 at 9:56 AM
Resolved August 28, 2019 at 1:33 PM