Write out checksums for SPDX binary / source packages #7066

sschuberth · 2023-05-30T20:14:34Z

See 1 for the background discussion.

codecov · 2023-05-30T21:11:49Z

Codecov Report

Patch coverage has no change and project coverage change: -0.01 ⚠️

Comparison is base (65c6612) 64.56% compared to head (a59503d) 64.55%.

Additional details and impacted files

@@             Coverage Diff              @@
##               main    #7066      +/-   ##
============================================
- Coverage     64.56%   64.55%   -0.01%     
  Complexity     1969     1969              
============================================
  Files           331      331              
  Lines         16617    16619       +2     
  Branches       2373     2374       +1     
============================================
  Hits          10729    10729              
- Misses         4844     4845       +1     
- Partials       1044     1045       +1

Flag	Coverage Δ
funTest-non-docker	`29.58% <ø> (+0.57%)`	⬆️
test	`40.32% <0.00%> (-0.01%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
utils/spdx/src/main/kotlin/model/SpdxPackage.kt	`78.46% <0.00%> (-2.50%)`	⬇️

☔ View full report in Codecov by Sentry.
📢 Do you have feedback about the report comment? Let us know in this issue.

utils/spdx/src/main/kotlin/model/SpdxPackage.kt

plugins/reporters/spdx/src/main/kotlin/Extensions.kt

…ction This fits better with the other functions in this file. Signed-off-by: Sebastian Schuberth <[email protected]>

Signed-off-by: Sebastian Schuberth <[email protected]>

The suffix will be used in an upcoming change. While at it, also default the infix to "Package". Signed-off-by: Sebastian Schuberth <[email protected]>

Signed-off-by: Sebastian Schuberth <[email protected]>

…ypes Signed-off-by: Sebastian Schuberth <[email protected]>

See [1] for the background discussion. [1]: #7064 Signed-off-by: Sebastian Schuberth <[email protected]>

Align with the remaining functions in this file an specifiy the return type explicitly. Signed-off-by: Sebastian Schuberth <[email protected]>

fviernau · 2023-06-02T15:16:05Z

plugins/reporters/spdx/src/main/kotlin/Extensions.kt

@@ -0,0 +1,171 @@
+/*


Now, as we have move to such a fine grained module structure - to me it makes even less sense to determine a location for a function based on whether it's an extension function or not and then as second priority the alphabetical order.

IMO cohesion is more important: e.g. if a non-extension utility function is closely related to an extension function, then IMO it should be located nearby.

What do you think? In particular about the alternatives to

Keep the functions where they currently are

Have a utils class where when can also put non-extension functions.

to me it makes even less sense to determine a location for a function based on whether it's an extension function or not [...] if a non-extension utility function is closely related to an extension function, then IMO it should be located nearby

I'm open to the idea to group functions, extensions or not, by purpose instead of syntax, although having an Extensions.kt seems to be pretty common in Kotlin projects. Anyway, I guess we should do this consistently throughout the code base in a separate PR then.

plugins/reporters/spdx/src/main/kotlin/Extensions.kt

fviernau · 2023-06-02T15:26:32Z

plugins/reporters/spdx/src/main/kotlin/Extensions.kt

+ * Convert an ORT [Hash] to an [SpdxChecksum], or return null if a conversion is not possible.
+ */
+private fun Hash.toSpdxChecksum(): SpdxChecksum? =
+ SpdxChecksum.Algorithm.values().find { it.name in algorithm.aliases }?.let {


Would it make sense to add a code comment like: // Assume that algorithm aliases in ORT and SPDX match.?

I'll do it in a follow-up PR.

sschuberth · 2023-06-02T18:29:35Z

Merging despite the unrelated GoModFunTest failure.

sschuberth requested a review from a team as a code owner May 30, 2023 20:14

sschuberth force-pushed the spdx-package-checksum branch from a621fa5 to f96d1f1 Compare May 30, 2023 20:28

sschuberth marked this pull request as draft May 30, 2023 20:46

sschuberth force-pushed the spdx-package-checksum branch 2 times, most recently from 0e5fb20 to 41b8174 Compare May 31, 2023 08:35

github-advanced-security bot found potential problems May 31, 2023

View reviewed changes

utils/spdx/src/main/kotlin/model/SpdxPackage.kt Fixed Show fixed Hide fixed

sschuberth force-pushed the spdx-package-checksum branch 3 times, most recently from b9fa63c to a8f3bf1 Compare May 31, 2023 09:43

sschuberth marked this pull request as ready for review May 31, 2023 10:18

sschuberth changed the title ~~feat(spdx-reporter): Write out the checksum for the binary package~~ Write out checksums for SPDX binary / source packages May 31, 2023

fviernau requested a review from tsteenbe June 1, 2023 07:26

fviernau requested changes Jun 1, 2023

View reviewed changes

utils/spdx/src/main/kotlin/model/SpdxPackage.kt Show resolved Hide resolved

plugins/reporters/spdx/src/main/kotlin/Extensions.kt Outdated Show resolved Hide resolved

sschuberth added 8 commits June 2, 2023 10:00

refactor(spdx-reporter): Make getSpdxCopyrightText an extension fun…

0356378

…ction This fits better with the other functions in this file. Signed-off-by: Sebastian Schuberth <[email protected]>

refactor(spdx-reporter): Move extension functions to a separate file

a8882e1

Signed-off-by: Sebastian Schuberth <[email protected]>

chore(spdx-reporter): Sort extension functions alphabetically

c647882

Signed-off-by: Sebastian Schuberth <[email protected]>

docs(spdx-reporter): Document the extension functions

e166ebf

Signed-off-by: Sebastian Schuberth <[email protected]>

feat(spdx-utils): Validate also the characters in an SPDX ID

015382f

Signed-off-by: Sebastian Schuberth <[email protected]>

refactor(spdx-utils): Improve readability of String.toSpdxId()

fa808f2

Signed-off-by: Sebastian Schuberth <[email protected]>

refactor(spdx-reporter): Allow Identifier.toSpdxId() to take a suffix

e1eaf7b

The suffix will be used in an upcoming change. While at it, also default the infix to "Package". Signed-off-by: Sebastian Schuberth <[email protected]>

refactor(spdx-reporter): Simplify getting the package verification code

e66e469

Signed-off-by: Sebastian Schuberth <[email protected]>

sschuberth force-pushed the spdx-package-checksum branch from a8f3bf1 to 0a061a2 Compare June 2, 2023 08:00

sschuberth added 3 commits June 2, 2023 10:03

refactor(spdx-reporter): Generalize toSpdxPackage() for different t…

2b37814

…ypes Signed-off-by: Sebastian Schuberth <[email protected]>

feat(spdx-reporter): Write out checksums for binary / source packages

2904e86

See [1] for the background discussion. [1]: #7064 Signed-off-by: Sebastian Schuberth <[email protected]>

chore(spdx-reporter): Use an explicit return type

a59503d

Align with the remaining functions in this file an specifiy the return type explicitly. Signed-off-by: Sebastian Schuberth <[email protected]>

sschuberth force-pushed the spdx-package-checksum branch from 0a061a2 to a59503d Compare June 2, 2023 08:07

sschuberth requested a review from fviernau June 2, 2023 08:07

sschuberth enabled auto-merge (rebase) June 2, 2023 08:21

sschuberth disabled auto-merge June 2, 2023 12:08

fviernau approved these changes Jun 2, 2023

View reviewed changes

sschuberth merged commit f646809 into main Jun 2, 2023

sschuberth deleted the spdx-package-checksum branch June 2, 2023 18:29

sschuberth added the release notes Changes that should be mentioned in release notes label Jun 8, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Write out checksums for SPDX binary / source packages #7066

Write out checksums for SPDX binary / source packages #7066

sschuberth commented May 30, 2023

codecov bot commented May 30, 2023 •

edited

Loading

fviernau Jun 2, 2023

sschuberth Jun 2, 2023

fviernau Jun 2, 2023

sschuberth Jun 2, 2023

sschuberth Jun 2, 2023

sschuberth commented Jun 2, 2023

Write out checksums for SPDX binary / source packages #7066

Write out checksums for SPDX binary / source packages #7066

Conversation

sschuberth commented May 30, 2023

codecov bot commented May 30, 2023 • edited Loading

Codecov Report

fviernau Jun 2, 2023

Choose a reason for hiding this comment

sschuberth Jun 2, 2023

Choose a reason for hiding this comment

fviernau Jun 2, 2023

Choose a reason for hiding this comment

sschuberth Jun 2, 2023

Choose a reason for hiding this comment

sschuberth Jun 2, 2023

Choose a reason for hiding this comment

sschuberth commented Jun 2, 2023

codecov bot commented May 30, 2023 •

edited

Loading