feat(scanner): propagate copyleft-strength license classes to artifacts#420
Merged
Conversation
The copyleft-strength classification (network/strong/weak copyleft, permissive, uncategorized) existed only in the web UI, so the SBOM a supplier submits and the risk report a reviewer reads carried less information than the screen showed. Mirror the UI's tier logic in the shared license-flags.jq and stamp every component with a bomlens:licenseClass property in normalize (worst-of precedence identical to the UI, including unknown licenses outranking confirmed-permissive; no-license components stay uncategorized, never assumed permissive). The risk report gains a per-class count table and lists the network/strong-copyleft components driving the exposure (md + html). The report recomputes with the same jq rather than trusting the property, so ANALYZE inputs that predate the property classify identically. A drift guard in test-postprocess.sh diffs the license-id sets and tier patterns between licenses.ts and the jq mirror, so the two implementations cannot silently diverge. Classification cases cover each tier, dual-license worst-of, and the no-license fallback; the normalize snapshots were deliberately regenerated (the only diff is the new property). Output stays deterministic under --byte-stable. Docs: reports-explained (en/ko) notes the property and the new report section.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The copyleft-strength classification (network/strong/weak copyleft, permissive, uncategorized) existed only in the web UI. The artifacts that actually travel — the SBOM a supplier submits, the risk report a reviewer reads — carried less information than the screen showed.
What
license-flags.jq: mirrors the UI's tier logic; normalize stamps every component with onebomlens:licenseClassproperty. Precedence is identical to the UI (worst-of: network > strong > weak > uncategorized > permissive — an unknown license outranks confirmed-permissive, and no-license components areuncategorized, never assumed permissive).bomlens:licenseReview(AI behavioral-use / non-commercial) is unchanged and independent.generate-risk-report.sh: the license section gains a per-class count table and, when network/strong copyleft is present, lists up to 10 driving components by name@version (md + html). The report recomputes with the shared jq instead of trusting the property, so ANALYZE inputs predating the property classify identically.test-postprocess.shextracts the license-id sets and tier patterns from bothlicenses.tsand the jq mirror and fails naming any divergence, so the two implementations stay in lock-step.bomlens:*idiom;--byte-stableoutput verified byte-identical and idempotent across re-runs.Verification
tests/test-postprocess.sh185/0 (incl. per-tier cases, dual-license worst-of, no-license fallback, drift guard, report cases)tests/test-snapshot.sh3/0,tests/test-merge.sh17/0,tests/check-docs-drift.shpassnetwork-copyleft, MIT →permissive, no license →uncategorizedFollow-ups (not in this PR)