Function write_spdx

src/formattedcode/output_spdx.py:181–407

Write scan output as SPDX Tag/value to ``output_file`` file-like object using the ``files`` list of scanned file data. Write as RDF XML if ``as_tagvalue`` is False. Use the ``notice`` string as a notice included in a document comment. Include the ``tool_name`` and ``tool_versio

(
    codebase,
    output_file,
    files,
    tool_name,
    tool_version,
    notice,
    package_name='',
    download_location=SpdxNoAssertion(),
    as_tagvalue=True,
    spdx_version = (2, 2),
    with_notice_text=False,
)

def write_spdx(
    codebase,
    output_file,
    files,
    tool_name,
    tool_version,
    notice,
    package_name='',
    download_location=SpdxNoAssertion(),
    as_tagvalue=True,
    spdx_version = (2, 2),
    with_notice_text=False,
):
    """
    Write scan output as SPDX Tag/value to ``output_file`` file-like
    object using the ``files`` list of scanned file data.
    Write as RDF XML if ``as_tagvalue`` is False.

    Use the ``notice`` string as a notice included in a document comment.
    Include the ``tool_name`` and ``tool_version`` to indicate which tool is
    producing this SPDX document.
    Use ``package_name`` as a Package name and as a namespace prefix base.
    """
    from licensedcode import cache
    licenses = cache.get_licenses_db()
    licensing = Licensing()

    as_rdf = not as_tagvalue

    ns_prefix = '_'.join(package_name.lower().split())
    comment = notice + f'\nSPDX License List: {scancode_config.spdx_license_list_version}'

    version_major, version_minor = scancode_config.spdx_license_list_version.split(".")
    spdx_license_list_version = Version(major=version_major, minor=version_minor)

    tool_name = tool_name or 'ScanCode'
    creator = Actor(ActorType.TOOL, f'{tool_name} {tool_version}')

    creation_info = CreationInfo(
        spdx_id="SPDXRef-DOCUMENT",
        spdx_version=f"SPDX-{spdx_version[0]}.{spdx_version[1]}",
        data_license='CC0-1.0',
        document_comment=comment,
        document_namespace=f'http://spdx.org/spdxdocs/{ns_prefix}-{uuid.uuid4()}',
        license_list_version=spdx_license_list_version,
        name='SPDX Document created by ScanCode Toolkit',
        creators=[creator],
        created=datetime.now(),
    )


    package_id = '001'
    package = Package(
        name=package_name,
        download_location=download_location,
        spdx_id=f'SPDXRef-{package_id}',
    )