diff --git a/sbom/examples/container_image/from_catalog.py b/sbom/examples/container_image/from_catalog.py index ab55e0f..8fa0638 100644 --- a/sbom/examples/container_image/from_catalog.py +++ b/sbom/examples/container_image/from_catalog.py @@ -60,6 +60,7 @@ def create_sbom(doc_id, image_id, root_package, packages, rel_type): ], }, "name": image_id, + "documentNamespace": f"https://www.redhat.com/{image_id}.spdx.json", "packages": [root_package] + packages, "relationships": relationships, } @@ -113,9 +114,13 @@ def generate_sboms_for_image(image_nvr): # Get license information from labels if it is set image_license = "NOASSERTION" + spdx_license_ids = { + "Apache License 2.0": "Apache-2.0", + } for label in image["parsed_data"]["labels"]: if label["name"].lower() == "license": image_license = label["value"] + image_license = spdx_license_ids.get(image_license, image_license) # Create an index image object, but since all arch-specific images are descendents of one # and the same index image, we only have to create it once. Its SBOM is created at the diff --git a/sbom/examples/container_image/kernel-module-management-operator-container-1.1.2-25.spdx.json b/sbom/examples/container_image/kernel-module-management-operator-container-1.1.2-25.spdx.json index 5ff8624..93ac901 100644 --- a/sbom/examples/container_image/kernel-module-management-operator-container-1.1.2-25.spdx.json +++ b/sbom/examples/container_image/kernel-module-management-operator-container-1.1.2-25.spdx.json @@ -9,6 +9,7 @@ ] }, "name": "kernel-module-management-operator-container-1.1.2-25", + "documentNamespace": "https://access.redhat.com/security/data/sbom/beta/spdx/kernel-module-management-operator-container-1.1.2-25.spdx.json", "packages": [ { "SPDXID": "SPDXRef-image-index", @@ -16,7 +17,7 @@ "versionInfo": "1.1.2-25", "supplier": "Organization: Red Hat", "downloadLocation": "NOASSERTION", - "licenseDeclared": "Apache License 2.0", + "licenseDeclared": "Apache-2.0", "externalRefs": [ { "referenceCategory": "PACKAGE-MANAGER", @@ -37,7 +38,7 @@ "versionInfo": "1.1.2-25", "supplier": "Organization: Red Hat", "downloadLocation": "NOASSERTION", - "licenseDeclared": "Apache License 2.0", + "licenseDeclared": "Apache-2.0", "externalRefs": [ { "referenceCategory": "PACKAGE-MANAGER", @@ -58,7 +59,7 @@ "versionInfo": "1.1.2-25", "supplier": "Organization: Red Hat", "downloadLocation": "NOASSERTION", - "licenseDeclared": "Apache License 2.0", + "licenseDeclared": "Apache-2.0", "externalRefs": [ { "referenceCategory": "PACKAGE-MANAGER", @@ -79,7 +80,7 @@ "versionInfo": "1.1.2-25", "supplier": "Organization: Red Hat", "downloadLocation": "NOASSERTION", - "licenseDeclared": "Apache License 2.0", + "licenseDeclared": "Apache-2.0", "externalRefs": [ { "referenceCategory": "PACKAGE-MANAGER", diff --git a/sbom/examples/container_image/kernel-module-management-operator-container-1.1.2-25_amd64.spdx.json b/sbom/examples/container_image/kernel-module-management-operator-container-1.1.2-25_amd64.spdx.json index f5ab10b..f5fc892 100644 --- a/sbom/examples/container_image/kernel-module-management-operator-container-1.1.2-25_amd64.spdx.json +++ b/sbom/examples/container_image/kernel-module-management-operator-container-1.1.2-25_amd64.spdx.json @@ -9,6 +9,7 @@ ] }, "name": "kernel-module-management-operator-container-1.1.2-25_amd64", + "documentNamespace": "https://access.redhat.com/security/data/sbom/beta/spdx/kernel-module-management-operator-container-1.1.2-25_amd64.spdx.json", "packages": [ { "SPDXID": "SPDXRef-kernel-module-management-operator-container-amd64", @@ -16,7 +17,7 @@ "versionInfo": "1.1.2-25", "supplier": "Organization: Red Hat", "downloadLocation": "NOASSERTION", - "licenseDeclared": "Apache License 2.0", + "licenseDeclared": "Apache-2.0", "externalRefs": [ { "referenceCategory": "PACKAGE-MANAGER", diff --git a/sbom/examples/container_image/kernel-module-management-operator-container-1.1.2-25_arm64.spdx.json b/sbom/examples/container_image/kernel-module-management-operator-container-1.1.2-25_arm64.spdx.json index 498ed86..4dc4242 100644 --- a/sbom/examples/container_image/kernel-module-management-operator-container-1.1.2-25_arm64.spdx.json +++ b/sbom/examples/container_image/kernel-module-management-operator-container-1.1.2-25_arm64.spdx.json @@ -9,6 +9,7 @@ ] }, "name": "kernel-module-management-operator-container-1.1.2-25_arm64", + "documentNamespace": "https://access.redhat.com/security/data/sbom/beta/spdx/kernel-module-management-operator-container-1.1.2-25_arm64.spdx.json", "packages": [ { "SPDXID": "SPDXRef-kernel-module-management-operator-container-arm64", @@ -16,7 +17,7 @@ "versionInfo": "1.1.2-25", "supplier": "Organization: Red Hat", "downloadLocation": "NOASSERTION", - "licenseDeclared": "Apache License 2.0", + "licenseDeclared": "Apache-2.0", "externalRefs": [ { "referenceCategory": "PACKAGE-MANAGER", diff --git a/sbom/examples/container_image/kernel-module-management-operator-container-1.1.2-25_ppc64le.spdx.json b/sbom/examples/container_image/kernel-module-management-operator-container-1.1.2-25_ppc64le.spdx.json index c20ef73..5bd863c 100644 --- a/sbom/examples/container_image/kernel-module-management-operator-container-1.1.2-25_ppc64le.spdx.json +++ b/sbom/examples/container_image/kernel-module-management-operator-container-1.1.2-25_ppc64le.spdx.json @@ -9,6 +9,7 @@ ] }, "name": "kernel-module-management-operator-container-1.1.2-25_ppc64le", + "documentNamespace": "https://access.redhat.com/security/data/sbom/beta/spdx/kernel-module-management-operator-container-1.1.2-25_ppc64le.spdx.json", "packages": [ { "SPDXID": "SPDXRef-kernel-module-management-operator-container-ppc64le", @@ -16,7 +17,7 @@ "versionInfo": "1.1.2-25", "supplier": "Organization: Red Hat", "downloadLocation": "NOASSERTION", - "licenseDeclared": "Apache License 2.0", + "licenseDeclared": "Apache-2.0", "externalRefs": [ { "referenceCategory": "PACKAGE-MANAGER", diff --git a/sbom/examples/container_image/ubi9-micro-container-9.4-6.1716471860.spdx.json b/sbom/examples/container_image/ubi9-micro-container-9.4-6.1716471860.spdx.json index 1fb4e8a..412649c 100644 --- a/sbom/examples/container_image/ubi9-micro-container-9.4-6.1716471860.spdx.json +++ b/sbom/examples/container_image/ubi9-micro-container-9.4-6.1716471860.spdx.json @@ -9,6 +9,7 @@ ] }, "name": "ubi9-micro-container-9.4-6.1716471860", + "documentNamespace": "https://access.redhat.com/security/data/sbom/beta/spdx/ubi9-micro-container-9.4-6.1716471860.spdx.json", "packages": [ { "SPDXID": "SPDXRef-image-index", diff --git a/sbom/examples/container_image/ubi9-micro-container-9.4-6.1716471860_amd64.spdx.json b/sbom/examples/container_image/ubi9-micro-container-9.4-6.1716471860_amd64.spdx.json index 5d37604..126f254 100644 --- a/sbom/examples/container_image/ubi9-micro-container-9.4-6.1716471860_amd64.spdx.json +++ b/sbom/examples/container_image/ubi9-micro-container-9.4-6.1716471860_amd64.spdx.json @@ -9,6 +9,7 @@ ] }, "name": "ubi9-micro-container-9.4-6.1716471860_amd64", + "documentNamespace": "https://access.redhat.com/security/data/sbom/beta/spdx/ubi9-micro-container-9.4-6.1716471860_amd64.spdx.json", "packages": [ { "SPDXID": "SPDXRef-ubi9-micro-container-amd64", diff --git a/sbom/examples/container_image/ubi9-micro-container-9.4-6.1716471860_arm64.spdx.json b/sbom/examples/container_image/ubi9-micro-container-9.4-6.1716471860_arm64.spdx.json index d727593..78f480f 100644 --- a/sbom/examples/container_image/ubi9-micro-container-9.4-6.1716471860_arm64.spdx.json +++ b/sbom/examples/container_image/ubi9-micro-container-9.4-6.1716471860_arm64.spdx.json @@ -9,6 +9,7 @@ ] }, "name": "ubi9-micro-container-9.4-6.1716471860_arm64", + "documentNamespace": "https://access.redhat.com/security/data/sbom/beta/spdx/ubi9-micro-container-9.4-6.1716471860_arm64.spdx.json", "packages": [ { "SPDXID": "SPDXRef-ubi9-micro-container-arm64", diff --git a/sbom/examples/container_image/ubi9-micro-container-9.4-6.1716471860_ppc64le.spdx.json b/sbom/examples/container_image/ubi9-micro-container-9.4-6.1716471860_ppc64le.spdx.json index 3191bdb..c81619e 100644 --- a/sbom/examples/container_image/ubi9-micro-container-9.4-6.1716471860_ppc64le.spdx.json +++ b/sbom/examples/container_image/ubi9-micro-container-9.4-6.1716471860_ppc64le.spdx.json @@ -9,6 +9,7 @@ ] }, "name": "ubi9-micro-container-9.4-6.1716471860_ppc64le", + "documentNamespace": "https://access.redhat.com/security/data/sbom/beta/spdx/ubi9-micro-container-9.4-6.1716471860_ppc64le.spdx.json", "packages": [ { "SPDXID": "SPDXRef-ubi9-micro-container-ppc64le", diff --git a/sbom/examples/container_image/ubi9-micro-container-9.4-6.1716471860_s390x.spdx.json b/sbom/examples/container_image/ubi9-micro-container-9.4-6.1716471860_s390x.spdx.json index 1a4c77d..8a3c0cf 100644 --- a/sbom/examples/container_image/ubi9-micro-container-9.4-6.1716471860_s390x.spdx.json +++ b/sbom/examples/container_image/ubi9-micro-container-9.4-6.1716471860_s390x.spdx.json @@ -9,6 +9,7 @@ ] }, "name": "ubi9-micro-container-9.4-6.1716471860_s390x", + "documentNamespace": "https://access.redhat.com/security/data/sbom/beta/spdx/ubi9-micro-container-9.4-6.1716471860_s390x.spdx.json", "packages": [ { "SPDXID": "SPDXRef-ubi9-micro-container-s390x",