fix(SPDX): improve cross-platform output and data handling

pyproject.toml

@@ -31,7 +31,7 @@ dependencies = [
     "coloredlogs",
     "beautifulsoup4",
     "jsonmerge",
-    "spdx-tools==0.8.2; sys_platform == 'linux'",
+    "spdx-tools==0.8.2",
     "setuptools>=65.5.1",
     "numpy",
     "requests",

requirements-dev.txt

@@ -3,4 +3,5 @@ pytest
 pytest-cov
 flake8
 fosslight-source
+spdx-tools==0.8.2
 pyopenssl>=26.0.0 # not directly required, pinned by Snyk to avoid a vulnerability

src/fosslight_util/oss_item.py

@@ -23,6 +23,7 @@ def __init__(self, name="", version="", license="", dl_url=""):
         self.version = version
         self._license = []
         self.license = license
+        self.license_texts: Dict[str, str] = {}
         self.download_location = dl_url
         self.exclude = False
         self.comment = ""

src/fosslight_util/output_format.py

@@ -3,7 +3,6 @@
 # Copyright (c) 2021 LG Electronics Inc.
 # SPDX-License-Identifier: Apache-2.0
 import os
-import platform
 from fosslight_util.write_excel import write_result_to_excel, write_result_to_csv
 from fosslight_util.write_opossum import write_opossum
 from fosslight_util.write_yaml import write_yaml
@@ -189,11 +188,8 @@ def write_output_file(output_file_without_ext: str, file_extension: str, scan_it
         elif format == 'yaml':
             success, msg, _ = write_yaml(result_file, scan_item, False)
         elif format.startswith('spdx'):
-            if platform.system() == 'Windows' or platform.system() == 'Darwin':
-                success = False
-                msg = f'{platform.system()} not support spdx format.'
-            else:
-                success, msg, _ = write_spdx(output_file_without_ext, file_extension, scan_item, spdx_version)
+            success, msg, _ = write_spdx(output_file_without_ext, file_extension, scan_item, spdx_version,
+                                         scanner_covers=scanner_covers)
         elif format.startswith('cyclonedx'):
             success, msg, result_file = write_cyclonedx(
                 output_file_without_ext,

tests/test_cyclonedx.py

@@ -358,7 +358,7 @@ def test_cyclonedx_serialization_failure_is_reported(monkeypatch, scan_item):
 
 @pytest.mark.parametrize("system", ["Windows", "Darwin"])
 def test_cyclonedx_is_supported_on_all_platforms(monkeypatch, scan_item, system):
-    monkeypatch.setattr("fosslight_util.output_format.platform.system", lambda: system)
+    monkeypatch.setattr("platform.system", lambda: system)
     output_file_without_ext = os.path.join(constants.TEST_RESULT_DIR, system, "cyclonedx")
 
     success, err_msg, result_file = write_output_file(
@@ -369,15 +369,44 @@ def test_cyclonedx_is_supported_on_all_platforms(monkeypatch, scan_item, system)
 
 
 @pytest.mark.parametrize("system", ["Windows", "Darwin"])
-def test_spdx_platform_restriction_is_unchanged(monkeypatch, scan_item, system):
-    monkeypatch.setattr("fosslight_util.output_format.platform.system", lambda: system)
+@pytest.mark.parametrize("format_name, extension", [
+    ("spdx-json", ".json"),
+    ("spdx-xml", ".xml"),
+    ("spdx-tag", ".tag"),
+])
+def test_spdx_formats_are_supported_on_all_platforms(tmp_path, monkeypatch, scan_item, system, format_name, extension):
+    monkeypatch.setattr("platform.system", lambda: system)
+    success, err_msg, result_file = write_output_file(
+        os.path.join(str(tmp_path), format_name),
+        extension,
+        scan_item,
+        format=format_name,
+    )
+
+    assert success is True, err_msg
+    assert os.path.isfile(result_file)
+    if extension == ".json":
+        with open(result_file, encoding="utf-8") as spdx_file:
+            assert json.load(spdx_file)["spdxVersion"] == "SPDX-2.3"
+    elif extension == ".xml":
+        assert ElementTree.parse(result_file).getroot().tag == "Document"
+    else:
+        with open(result_file, encoding="utf-8") as spdx_file:
+            assert "SPDXVersion: SPDX-2.3" in spdx_file.read()
+
+
+def test_spdx_import_failure_is_reported(monkeypatch, tmp_path, scan_item):
+    monkeypatch.setattr(
+        "fosslight_util.write_spdx._spdx_import_error",
+        ImportError("spdx-tools is unavailable"),
+    )
 
     success, err_msg, _ = write_output_file(
-        os.path.join(constants.TEST_RESULT_DIR, system, "spdx"),
+        os.path.join(str(tmp_path), "spdx"),
         ".json",
         scan_item,
         format="spdx-json",
     )
 
     assert success is False
-    assert err_msg == f"{system} not support spdx format."
+    assert "spdx-tools is unavailable" in err_msg