fix(reporter): Add authors to concluded license in disclosure document

Include authors for package dependencies when both `concluded_license` and `authors` are curated, and ORT is configured with the `addAuthorsToCopyrights` option enabled. This ensures that package authors appear under the respective concluded license in the Disclosure Document. This behavior applies when the Scanner option `skipConcluded` is enabled, having the effect that the scan stage is skipped for the particular package dependency in this case. Fixes #9599. Signed-off-by: Wolfgang Klenk <[email protected]>
oss-review-toolkit · Dec 13, 2024 · 75abb71 · 75abb71
1 parent 709053a
commit 75abb71
Show file tree

Hide file tree

Showing 2 changed files with 63 additions and 17 deletions.
diff --git a/model/src/main/kotlin/licenses/LicenseInfoResolver.kt b/model/src/main/kotlin/licenses/LicenseInfoResolver.kt
@@ -83,6 +83,10 @@ class LicenseInfoResolver(
                 licenseInfo.concludedLicenseInfo.concludedLicense?.also {
                     originalExpressions += ResolvedOriginalExpression(expression = it, source = LicenseSource.CONCLUDED)
                 }
+
+                licenseInfo.declaredLicenseInfo.authors.takeIf { it.isNotEmpty() && addAuthorsToCopyrights }?.also {
+                    locations += getAuthorsAsCopyrightTextLocation(it)
+                }
             }
         }
 
@@ -98,23 +102,7 @@ class LicenseInfoResolver(
                 }.keys
 
                 licenseInfo.declaredLicenseInfo.authors.takeIf { it.isNotEmpty() && addAuthorsToCopyrights }?.also {
-                    locations += ResolvedLicenseLocation(
-                        provenance = UnknownProvenance,
-                        location = UNDEFINED_TEXT_LOCATION,
-                        appliedCuration = null,
-                        matchingPathExcludes = emptyList(),
-                        copyrights = it.mapTo(mutableSetOf()) { author ->
-                            val statement = "Copyright (C) $author".takeUnless {
-                                author.contains("Copyright", ignoreCase = true)
-                            } ?: author
-
-                            ResolvedCopyrightFinding(
-                                statement = statement,
-                                location = UNDEFINED_TEXT_LOCATION,
-                                matchingPathExcludes = emptyList()
-                            )
-                        }
-                    )
+                    locations += getAuthorsAsCopyrightTextLocation(it)
                 }
             }
         }
@@ -287,6 +275,25 @@ class LicenseInfoResolver(
 
         return ResolvedLicenseFileInfo(id, licenseFiles)
     }
+
+    private fun getAuthorsAsCopyrightTextLocation(authors: Set<String>): ResolvedLicenseLocation =
+        ResolvedLicenseLocation(
+            provenance = UnknownProvenance,
+            location = UNDEFINED_TEXT_LOCATION,
+            appliedCuration = null,
+            matchingPathExcludes = emptyList(),
+            copyrights = authors.mapTo(mutableSetOf()) { author ->
+                val statement = "Copyright (C) $author".takeUnless {
+                    author.contains("Copyright", ignoreCase = true)
+                } ?: author
+
+                ResolvedCopyrightFinding(
+                    statement = statement,
+                    location = UNDEFINED_TEXT_LOCATION,
+                    matchingPathExcludes = emptyList()
+                )
+            }
+        )
 }
 
 private class ResolvedLicenseBuilder(val license: SpdxSingleLicenseExpression) {

diff --git a/model/src/test/kotlin/licenses/LicenseInfoResolverTest.kt b/model/src/test/kotlin/licenses/LicenseInfoResolverTest.kt
@@ -575,6 +575,27 @@ class LicenseInfoResolverTest : WordSpec({
             )
         }
 
+        "resolve copyrights from authors in concluded license" {
+            // In case of a concluded license (due to a package curation) verify that the authors named
+            // in the package curation are added as copyright statement under the concluded license
+            val licenseInfos = listOf(
+                createLicenseInfo(
+                    id = pkgId,
+                    authors = authors,
+                    declaredLicenses = setOf("MIT"),
+                    concludedLicense = SpdxExpression.parse("BSD-2-Clause")
+                )
+            )
+
+            val resolver = createResolver(licenseInfos, addAuthorsToCopyrights = true)
+
+            val result = resolver.resolveLicenseInfo(pkgId)
+            result should containCopyrightStatementsForLicenseExactly(
+                "BSD-2-Clause",
+                "Copyright (C) The Author", "Copyright (C) The Other Author"
+            )
+        }
+
         "not resolve copyrights from authors if disabled" {
             val licenseInfos = listOf(
                 createLicenseInfo(
@@ -589,6 +610,24 @@ class LicenseInfoResolverTest : WordSpec({
             result should containCopyrightStatementsForLicenseExactly("LicenseRef-a")
             result should containCopyrightStatementsForLicenseExactly("LicenseRef-b")
         }
+
+        "not resolve copyrights from authors in concluded license if disabled" {
+            // In case of a concluded license (due to a package curation) verify that the authors named
+            // in the package curation are added as copyright statement under the concluded license
+            val licenseInfos = listOf(
+                createLicenseInfo(
+                    id = pkgId,
+                    authors = authors,
+                    declaredLicenses = setOf("MIT"),
+                    concludedLicense = SpdxExpression.parse("BSD-2-Clause")
+                )
+            )
+
+            val resolver = createResolver(licenseInfos, addAuthorsToCopyrights = false)
+
+            val result = resolver.resolveLicenseInfo(pkgId)
+            result should containCopyrightStatementsForLicenseExactly("BSD-2-Clause")
+        }
     }
 
     "resolveLicenseFiles()" should {