@@ -50,6 +50,8 @@ const (
5050 PackageSupplierNoAssertion = "NOASSERTION"
5151 PackageSupplierOrganization = "Organization"
5252
53+ PackageAnnotatorToolField = "Tool"
54+
5355 RelationShipContains = common .TypeRelationshipContains
5456 RelationShipDescribe = common .TypeRelationshipDescribe
5557 RelationShipDependsOn = common .TypeRelationshipDependsOn
@@ -122,14 +124,17 @@ func (m *Marshaler) Marshal(ctx context.Context, bom *core.BOM) (*spdx.Document,
122124 packages []* spdx.Package
123125 )
124126
127+ // Lock time to use same time for all spdx fields
128+ timeNow := clock .Now (ctx ).UTC ().Format (time .RFC3339 )
129+
125130 root := bom .Root ()
126131 pkgDownloadLocation := m .packageDownloadLocation (root )
127132
128133 // Component ID => SPDX ID
129134 packageIDs := make (map [uuid.UUID ]spdx.ElementID )
130135
131136 // Root package contains OS, OS packages, language-specific packages and so on.
132- rootPkg , err := m .rootSPDXPackage (root , pkgDownloadLocation )
137+ rootPkg , err := m .rootSPDXPackage (root , timeNow , pkgDownloadLocation )
133138 if err != nil {
134139 return nil , xerrors .Errorf ("failed to generate a root package: %w" , err )
135140 }
@@ -144,7 +149,7 @@ func (m *Marshaler) Marshal(ctx context.Context, bom *core.BOM) (*spdx.Document,
144149 if c .Root {
145150 continue
146151 }
147- spdxPackage , err := m .spdxPackage (c , pkgDownloadLocation )
152+ spdxPackage , err := m .spdxPackage (c , timeNow , pkgDownloadLocation )
148153 if err != nil {
149154 return nil , xerrors .Errorf ("spdx package error: %w" , err )
150155 }
@@ -216,7 +221,7 @@ func (m *Marshaler) Marshal(ctx context.Context, bom *core.BOM) (*spdx.Document,
216221 CreatorType : "Tool" ,
217222 },
218223 },
219- Created : clock . Now ( ctx ). UTC (). Format ( time . RFC3339 ) ,
224+ Created : timeNow ,
220225 },
221226 Packages : packages ,
222227 Relationships : relationShips ,
@@ -237,7 +242,7 @@ func (m *Marshaler) packageDownloadLocation(root *core.Component) string {
237242 return location
238243}
239244
240- func (m * Marshaler ) rootSPDXPackage (root * core.Component , pkgDownloadLocation string ) (* spdx.Package , error ) {
245+ func (m * Marshaler ) rootSPDXPackage (root * core.Component , timeNow , pkgDownloadLocation string ) (* spdx.Package , error ) {
241246 var externalReferences []* spdx.PackageExternalReference
242247 // When the target is a container image, add PURL to the external references of the root package.
243248 if root .PkgIdentifier .PURL != nil {
@@ -258,17 +263,25 @@ func (m *Marshaler) rootSPDXPackage(root *core.Component, pkgDownloadLocation st
258263 PackageName : root .Name ,
259264 PackageSPDXIdentifier : elementID (camelCase (string (root .Type )), pkgID ),
260265 PackageDownloadLocation : pkgDownloadLocation ,
261- PackageAttributionTexts : m . spdxAttributionTexts (root ),
266+ Annotations : m . spdxAnnotations (root , timeNow ),
262267 PackageExternalReferences : externalReferences ,
263268 PrimaryPackagePurpose : pkgPurpose ,
264269 }, nil
265270}
266271
267- func (m * Marshaler ) appendAttributionText ( attributionTexts []string , key , value string ) []string {
272+ func (m * Marshaler ) appendAnnotation ( annotations []spdx. Annotation , timeNow , key , value string ) []spdx. Annotation {
268273 if value == "" {
269- return attributionTexts
274+ return annotations
270275 }
271- return append (attributionTexts , fmt .Sprintf ("%s: %s" , key , value ))
276+ return append (annotations , spdx.Annotation {
277+ AnnotationDate : timeNow ,
278+ AnnotationType : spdx .CategoryOther ,
279+ Annotator : spdx.Annotator {
280+ Annotator : fmt .Sprintf ("%s-%s" , CreatorTool , m .appVersion ),
281+ AnnotatorType : PackageAnnotatorToolField ,
282+ },
283+ AnnotationComment : fmt .Sprintf ("%s: %s" , key , value ),
284+ })
272285}
273286
274287func (m * Marshaler ) purlExternalReference (packageURL string ) * spdx.PackageExternalReference {
@@ -287,7 +300,7 @@ func (m *Marshaler) advisoryExternalReference(primaryURL string) *spdx.PackageEx
287300 }
288301}
289302
290- func (m * Marshaler ) spdxPackage (c * core.Component , pkgDownloadLocation string ) (spdx.Package , error ) {
303+ func (m * Marshaler ) spdxPackage (c * core.Component , timeNow , pkgDownloadLocation string ) (spdx.Package , error ) {
291304 pkgID , err := calcPkgID (m .hasher , c )
292305 if err != nil {
293306 return spdx.Package {}, xerrors .Errorf ("failed to get os metadata package ID: %w" , err )
@@ -343,7 +356,7 @@ func (m *Marshaler) spdxPackage(c *core.Component, pkgDownloadLocation string) (
343356 PrimaryPackagePurpose : purpose ,
344357 PackageDownloadLocation : pkgDownloadLocation ,
345358 PackageExternalReferences : pkgExtRefs ,
346- PackageAttributionTexts : m . spdxAttributionTexts ( c ),
359+ Annotations : m . spdxAnnotations ( c , timeNow ),
347360 PackageSourceInfo : sourceInfo ,
348361 PackageSupplier : supplier ,
349362 PackageChecksums : m .spdxChecksums (digests ),
@@ -365,16 +378,15 @@ func spdxPkgName(component *core.Component) string {
365378 }
366379 return component .Name
367380}
368-
369- func (m * Marshaler ) spdxAttributionTexts (c * core.Component ) []string {
370- var texts []string
381+ func (m * Marshaler ) spdxAnnotations (c * core.Component , timeNow string ) []spdx.Annotation {
382+ var annotations []spdx.Annotation
371383 for _ , p := range c .Properties {
372384 // Add properties that are not in other fields.
373385 if ! slices .Contains (duplicateProperties , p .Name ) {
374- texts = m .appendAttributionText ( texts , p .Name , p .Value )
386+ annotations = m .appendAnnotation ( annotations , timeNow , p .Name , p .Value )
375387 }
376388 }
377- return texts
389+ return annotations
378390}
379391
380392func (m * Marshaler ) spdxLicense (c * core.Component ) string {
0 commit comments