From f47b340396d3df6ece0f6a2b5da2897fbdad9942 Mon Sep 17 00:00:00 2001 From: Sebastian Schildt Date: Sun, 5 May 2024 15:41:42 +0200 Subject: [PATCH] Remove createbom helper Signed-off-by: Sebastian Schildt --- DEPENDENCIES | 134 ------------ build-databroker-cli.sh | 3 +- build-databroker.sh | 3 +- createbom/README.md | 20 -- createbom/bomutil/maplicensefile.py | 40 ---- createbom/bomutil/quirks.py | 36 ---- createbom/createbom.py | 201 ------------------ createbom/licensestore/0BSD.txt.gz | Bin 401 -> 0 bytes createbom/licensestore/Apache-2.0.txt.gz | Bin 3977 -> 0 bytes createbom/licensestore/BSD-2-Clause.txt.gz | Bin 721 -> 0 bytes createbom/licensestore/BSD-3-Clause.txt.gz | Bin 37 -> 0 bytes createbom/licensestore/BSL-1.0.txt.gz | Bin 781 -> 0 bytes createbom/licensestore/BlueOak-1.0.0.md.gz | Bin 758 -> 0 bytes createbom/licensestore/CC0-1.0.txt.gz | Bin 2838 -> 0 bytes createbom/licensestore/ISC.txt.gz | Bin 459 -> 0 bytes createbom/licensestore/MIT.txt.gz | Bin 651 -> 0 bytes .../licensestore/Unicode-DFS-2016.txt.gz | Bin 1219 -> 0 bytes createbom/licensestore/Unlicense.txt.gz | Bin 723 -> 0 bytes createbom/licensestore/WTFPL.txt.gz | Bin 314 -> 0 bytes createbom/licensestore/Zlib.txt.gz | Bin 488 -> 0 bytes createbom/licensestore/ring.LICENSE.txt.gz | Bin 3341 -> 0 bytes createbom/licensestore/webpki.LICENSE.txt.gz | Bin 595 -> 0 bytes 22 files changed, 4 insertions(+), 433 deletions(-) delete mode 100644 DEPENDENCIES delete mode 100644 createbom/README.md delete mode 100644 createbom/bomutil/maplicensefile.py delete mode 100644 createbom/bomutil/quirks.py delete mode 100755 createbom/createbom.py delete mode 100644 createbom/licensestore/0BSD.txt.gz delete mode 100644 createbom/licensestore/Apache-2.0.txt.gz delete mode 100644 createbom/licensestore/BSD-2-Clause.txt.gz delete mode 100644 createbom/licensestore/BSD-3-Clause.txt.gz delete mode 100644 createbom/licensestore/BSL-1.0.txt.gz delete mode 100644 createbom/licensestore/BlueOak-1.0.0.md.gz delete mode 100644 createbom/licensestore/CC0-1.0.txt.gz delete mode 100644 createbom/licensestore/ISC.txt.gz delete mode 100644 createbom/licensestore/MIT.txt.gz delete mode 100644 createbom/licensestore/Unicode-DFS-2016.txt.gz delete mode 100644 createbom/licensestore/Unlicense.txt.gz delete mode 100644 createbom/licensestore/WTFPL.txt.gz delete mode 100644 createbom/licensestore/Zlib.txt.gz delete mode 100644 createbom/licensestore/ring.LICENSE.txt.gz delete mode 100644 createbom/licensestore/webpki.LICENSE.txt.gz diff --git a/DEPENDENCIES b/DEPENDENCIES deleted file mode 100644 index 06df9e6f..00000000 --- a/DEPENDENCIES +++ /dev/null @@ -1,134 +0,0 @@ -crate/cratesio/-/aho-corasick/0.7.20, MIT AND Unlicense, approved, #4240 -crate/cratesio/-/ansi_term/0.12.1, MIT, approved, clearlydefined -crate/cratesio/-/anyhow/1.0.68, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/arrayref/0.3.6, BSD-2-Clause, approved, clearlydefined -crate/cratesio/-/arrayvec/0.5.2, Apache-2.0 AND MIT, approved, clearlydefined -crate/cratesio/-/async-stream-impl/0.3.3, MIT, approved, clearlydefined -crate/cratesio/-/async-stream/0.3.3, MIT, approved, clearlydefined -crate/cratesio/-/async-trait/0.1.63, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #6666 -crate/cratesio/-/base64/0.13.1, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #6655 -crate/cratesio/-/bitflags/1.3.2, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/blake2b_simd/0.5.11, MIT, approved, clearlydefined -crate/cratesio/-/bytes/1.3.0, MIT, approved, clearlydefined -crate/cratesio/-/cfg-if/1.0.0, Apache-2.0 AND MIT, approved, clearlydefined -crate/cratesio/-/clap/3.2.23, Apache-2.0 AND MIT, approved, #4243 -crate/cratesio/-/clap_lex/0.2.4, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #4254 -crate/cratesio/-/constant_time_eq/0.1.5, CC0-1.0, approved, clearlydefined -crate/cratesio/-/crossbeam-utils/0.8.14, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/dirs-sys/0.3.7, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/dirs/1.0.5, Apache-2.0 AND MIT, approved, clearlydefined -crate/cratesio/-/dirs/4.0.0, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/either/1.8.0, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #4245 -crate/cratesio/-/fnv/1.0.7, Apache-2.0 AND MIT, approved, clearlydefined -crate/cratesio/-/futures-channel/0.3.25, Apache-2.0 AND MIT AND Apache-2.0 AND MIT AND BSD-2-Clause-Views, approved, #6671 -crate/cratesio/-/futures-core/0.3.25, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/futures-sink/0.3.25, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/futures-task/0.3.25, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/futures-util/0.3.25, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/getrandom/0.1.16, Apache-2.0 AND MIT, approved, clearlydefined -crate/cratesio/-/getrandom/0.2.8, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/h2/0.3.15, MIT, approved, clearlydefined -crate/cratesio/-/hashbrown/0.12.3, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/hermit-abi/0.2.6, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/http-body/0.4.5, MIT, approved, clearlydefined -crate/cratesio/-/http/0.2.8, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/httparse/1.8.0, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #4256 -crate/cratesio/-/httpdate/1.0.2, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/hyper-timeout/0.4.1, Apache-2.0 AND MIT, approved, clearlydefined -crate/cratesio/-/hyper/0.14.23, MIT, approved, clearlydefined -crate/cratesio/-/indexmap/1.9.2, Apache-2.0 OR MIT, approved, clearlydefined -crate/cratesio/-/itertools/0.10.5, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #4247 -crate/cratesio/-/itoa/1.0.5, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/lazy_static/1.4.0, Apache-2.0 AND MIT, approved, clearlydefined -crate/cratesio/-/libc/0.2.139, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/linefeed/0.6.0, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/log/0.4.17, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/matchers/0.1.0, MIT, approved, clearlydefined -crate/cratesio/-/memchr/2.5.0, Unlicense OR MIT, approved, clearlydefined -crate/cratesio/-/memoffset/0.6.5, MIT, approved, clearlydefined -crate/cratesio/-/mio/0.8.5, MIT, approved, clearlydefined -crate/cratesio/-/mortal/0.2.3, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/nix/0.23.2, MIT, approved, clearlydefined -crate/cratesio/-/nom/5.1.2, MIT, approved, clearlydefined -crate/cratesio/-/nu-ansi-term/0.46.0, MIT, approved, clearlydefined -crate/cratesio/-/num_cpus/1.15.0, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/once_cell/1.17.0, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/os_str_bytes/6.4.1, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/overload/0.1.1, MIT, approved, clearlydefined -crate/cratesio/-/percent-encoding/2.2.0, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/phf/0.11.1, MIT, approved, clearlydefined -crate/cratesio/-/phf_shared/0.11.1, MIT, approved, clearlydefined -crate/cratesio/-/pin-project-internal/1.0.12, Apache-2.0 OR MIT, approved, clearlydefined -crate/cratesio/-/pin-project-lite/0.2.9, Apache-2.0 OR MIT, approved, clearlydefined -crate/cratesio/-/pin-project/1.0.12, Apache-2.0 OR MIT, approved, clearlydefined -crate/cratesio/-/pin-utils/0.1.0, Apache-2.0 AND MIT, approved, clearlydefined -crate/cratesio/-/ppv-lite86/0.2.17, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/proc-macro2/1.0.50, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/prost-derive/0.9.0, Apache-2.0, approved, clearlydefined -crate/cratesio/-/prost-types/0.9.0, Apache-2.0, approved, clearlydefined -crate/cratesio/-/prost/0.9.0, Apache-2.0, approved, clearlydefined -crate/cratesio/-/quote/1.0.23, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/rand/0.8.5, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/rand_chacha/0.3.1, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/rand_core/0.6.4, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/redox_syscall/0.1.57, MIT, approved, clearlydefined -crate/cratesio/-/redox_syscall/0.2.16, MIT, approved, clearlydefined -crate/cratesio/-/redox_users/0.3.5, MIT, approved, clearlydefined -crate/cratesio/-/redox_users/0.4.3, MIT, approved, clearlydefined -crate/cratesio/-/regex-automata/0.1.10, MIT OR (MIT AND Unlicense), approved, clearlydefined -crate/cratesio/-/regex-syntax/0.6.28, Apache-2.0 AND MIT AND Apache-2.0 AND MIT AND Unicode-DFS-2016, approved, #4252 -crate/cratesio/-/regex/1.7.1, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/rust-argon2/0.8.3, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/ryu/1.0.12, Apache-2.0 AND BSL-1.0 AND CC-BY-SA-3.0, approved, #4267 -crate/cratesio/-/serde/1.0.152, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/serde_derive/1.0.152, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/serde_json/1.0.91, Apache-2.0 AND MIT, approved, #4264 -crate/cratesio/-/sharded-slab/0.1.4, MIT, approved, clearlydefined -crate/cratesio/-/signal-hook-registry/1.4.0, Apache-2.0 OR MIT, approved, clearlydefined -crate/cratesio/-/siphasher/0.3.10, Apache-2.0 AND MIT, approved, #6665 -crate/cratesio/-/slab/0.4.7, MIT, approved, clearlydefined -crate/cratesio/-/smallstr/0.2.0, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/smallvec/1.10.0, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/socket2/0.4.7, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/sqlparser/0.16.0, Apache-2.0, approved, #6669 -crate/cratesio/-/syn/1.0.107, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/terminfo/0.7.5, WTFPL AND X11-distribute-modifications-variant, approved, #6663 -crate/cratesio/-/textwrap/0.16.0, MIT, approved, #6657 -crate/cratesio/-/thiserror-impl/1.0.38, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/thiserror/1.0.38, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/thread_local/1.1.4, Apache-2.0 OR MIT, approved, clearlydefined -crate/cratesio/-/tinyvec/1.6.0, Zlib OR (Apache-2.0 OR MIT), approved, clearlydefined -crate/cratesio/-/tinyvec_macros/0.1.0, MIT OR (Apache-2.0 AND MIT) OR (MIT AND Zlib), approved, clearlydefined -crate/cratesio/-/tokio-io-timeout/1.2.0, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/tokio-macros/1.8.2, MIT, approved, clearlydefined -crate/cratesio/-/tokio-stream/0.1.11, MIT, approved, clearlydefined -crate/cratesio/-/tokio-util/0.6.10, MIT, approved, clearlydefined -crate/cratesio/-/tokio-util/0.7.4, MIT, approved, clearlydefined -crate/cratesio/-/tokio/1.24.2, MIT, approved, #6659 -crate/cratesio/-/tonic/0.6.2, MIT AND Apache-2.0, approved, #6653 -crate/cratesio/-/tower-layer/0.3.2, MIT, approved, clearlydefined -crate/cratesio/-/tower-service/0.3.2, MIT, approved, clearlydefined -crate/cratesio/-/tower/0.4.13, MIT AND Apache-2.0, approved, #6661 -crate/cratesio/-/tracing-attributes/0.1.23, MIT, approved, clearlydefined -crate/cratesio/-/tracing-core/0.1.30, MIT, approved, clearlydefined -crate/cratesio/-/tracing-futures/0.2.5, MIT, approved, clearlydefined -crate/cratesio/-/tracing-subscriber/0.3.16, MIT AND BSD-3-Clause AND BSD-2-Clause AND LicenseRef-Public-Domain, approved, #6670 -crate/cratesio/-/tracing/0.1.37, MIT, approved, clearlydefined -crate/cratesio/-/try-lock/0.2.4, MIT, approved, clearlydefined -crate/cratesio/-/unicode-ident/1.0.6, , approved, #4138 -crate/cratesio/-/unicode-normalization/0.1.22, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/unicode-width/0.1.10, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/want/0.3.0, MIT, approved, clearlydefined -crate/cratesio/-/wasi/0.11.0+wasi-snapshot-preview1, (Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT), approved, #6667 -crate/cratesio/-/wasi/0.9.0+wasi-snapshot-preview1, (Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT), approved, #6654 -crate/cratesio/-/winapi-i686-pc-windows-gnu/0.4.0, Apache-2.0 AND MIT, approved, #6664 -crate/cratesio/-/winapi-x86_64-pc-windows-gnu/0.4.0, Apache-2.0 AND MIT, approved, #6658 -crate/cratesio/-/winapi/0.3.9, Apache-2.0 AND MIT, approved, clearlydefined -crate/cratesio/-/windows-sys/0.42.0, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/windows_aarch64_gnullvm/0.42.1, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/windows_aarch64_msvc/0.42.1, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/windows_i686_gnu/0.42.1, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/windows_i686_msvc/0.42.1, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/windows_x86_64_gnu/0.42.1, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/windows_x86_64_gnullvm/0.42.1, MIT OR Apache-2.0, approved, clearlydefined -crate/cratesio/-/windows_x86_64_msvc/0.42.1, MIT OR Apache-2.0, approved, clearlydefined diff --git a/build-databroker-cli.sh b/build-databroker-cli.sh index cfae6ffb..bb35d000 100755 --- a/build-databroker-cli.sh +++ b/build-databroker-cli.sh @@ -6,7 +6,8 @@ # Uses cross for cross-compiling. Needs to be executed # before docker build, as docker collects the artifacts # created by this script -# this needs the have cross, cargo-license and createbom dependencies installed +# this needs the have cross, cargo-license and kuksa sbom helper +# installed # # SPDX-License-Identifier: Apache-2.0 diff --git a/build-databroker.sh b/build-databroker.sh index 1bfc8323..4f46c814 100755 --- a/build-databroker.sh +++ b/build-databroker.sh @@ -6,7 +6,8 @@ # Uses cross for cross-compiling. Needs to be executed # before docker build, as docker collects the artifacts # created by this script -# this needs the have cross, cargo-license and createbom dependencies installed +# this needs the have cross, cargo-license and the kuksa-sbom helper +# installed # # SPDX-License-Identifier: Apache-2.0 diff --git a/createbom/README.md b/createbom/README.md deleted file mode 100644 index 874585ac..00000000 --- a/createbom/README.md +++ /dev/null @@ -1,20 +0,0 @@ -# BOM Generator - -Generates a BOM - -## Troubleshooting - -If you run it and you get errors like: - -``` -Could not find license file for 0BSD in adler -Error: BOM creation failed, unresolved licenses detected -``` - -The a possible reason is that the `Cargo.lock` in the repository has been updated and some components use licenses -not covered here. This can be solved by: - -* Find the corresponding license test. Check for instance [SPDX](https://spdx.org/licenses/) -* Verify that license is feasible for our use. -* Download or create a text file with the license text, do `gzip` and put it in `licensestore` folder. -* Add the identifier (in the example above `0BSD`) to `maplicensefile.py` diff --git a/createbom/bomutil/maplicensefile.py b/createbom/bomutil/maplicensefile.py deleted file mode 100644 index 044f587d..00000000 --- a/createbom/bomutil/maplicensefile.py +++ /dev/null @@ -1,40 +0,0 @@ -#! /usr/bin/env python -######################################################################## -# Copyright (c) 2022, 2023 Robert Bosch GmbH -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -# SPDX-License-Identifier: Apache-2.0 -######################################################################## - -"""Mapping of license identifiers of cargo license to the filenames of the actual license texts.""" - -MAP = { - "Apache-2.0": "Apache-2.0.txt.gz", - "BlueOak-1.0.0": "BlueOak-1.0.0.md.gz", - "MIT": "MIT.txt.gz", - "Unlicense": "Unlicense.txt.gz", - "BSL-1.0": "BSL-1.0.txt.gz", - "Unicode-DFS-2016": "Unicode-DFS-2016.txt.gz", - "BSD-2-Clause": "BSD-2-Clause.txt.gz", - "CC0-1.0": "CC0-1.0.txt.gz", - "WTFPL": "WTFPL.txt.gz", - "Zlib": "Zlib.txt.gz", - "ISC": "ISC.txt.gz", - "ring": "ring.LICENSE.txt.gz", - "rustls-webpki": "webpki.LICENSE.txt.gz", - # License text taken from https://spdx.org/licenses/0BSD.html - "0BSD": "0BSD.txt.gz", - # License test taken from https://spdx.org/licenses/BSD-3-Clause.html - "BSD-3-Clause": "BSD-3-Clause.txt.gz" -} diff --git a/createbom/bomutil/quirks.py b/createbom/bomutil/quirks.py deleted file mode 100644 index 70df6fa2..00000000 --- a/createbom/bomutil/quirks.py +++ /dev/null @@ -1,36 +0,0 @@ -#! /usr/bin/env python -######################################################################## -# Copyright (c) 2022, 2023 Robert Bosch GmbH -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -# SPDX-License-Identifier: Apache-2.0 -######################################################################## - -'''Hook for applying some sanitation to make further processing easier''' - -def apply_quirks(component): - ''' - Takes one component entry from cargo license and might return - a modified/extended entry. - Use sparingly. Comment what you are doing - Use narrow matching (name and complete license string) to catch - changes - ''' - if component["name"] in {"io-lifetimes", "linux-raw-sys", "rustix", "wasi"} \ - and component["license"] == "Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT": - # All licenses are "OR", we already ship Apache-2.0 and MIT. The LLVM exception - # does not apply to us, so lets keep it clean. - component["license"] = "Apache-2.0 OR MIT" - return component - return component diff --git a/createbom/createbom.py b/createbom/createbom.py deleted file mode 100755 index 4785195f..00000000 --- a/createbom/createbom.py +++ /dev/null @@ -1,201 +0,0 @@ -#!/usr/bin/env python3 -######################################################################## -# Copyright (c) 2022,2023 Robert Bosch GmbH -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -# SPDX-License-Identifier: Apache-2.0 -######################################################################## - -""" -This script will generate a list of all dependencies and licenses of a -Rust project. It will create a folder called thirdparty in that -project folder containing a list of dependencies and a copy -of each license used in dependencies -""" - -import argparse -import sys -import json -import re -import os -import gzip - -from subprocess import check_output, CalledProcessError - -from bomutil.maplicensefile import MAP as supported_licenses -from bomutil import quirks - - -class LicenseException(Exception): - pass - - -class RunCargoException(Exception): - pass - - -def extract_license_ids(license): - """Extract valid licenses for each dependency. We most of the time - do not care whether it is "AND" or "OR" currently, we currently assume we are - compatible to all "OR" variants, and thus include all""" - license_ids = [] - if license: - license_ids = re.split(r"\s*AND\s*|\s*OR\s*|\(|\)", license) - license_ids = list(filter(None, license_ids)) - - return license_ids - - -def extract_license_filenames(crate): - license_files = [] - crate = quirks.apply_quirks(crate) - - crate_name = crate["name"] - license_ids = extract_license_ids(crate["license"]) - license_file = crate["license_file"] - - if not license_ids and not license_file: - raise LicenseException( - f"Neither license nor license file specified for {crate_name}" - ) - - if license_file: - license_ids.append(crate_name) - - missing = [] - for license_id in license_ids: - if license_id in supported_licenses: - license_file = supported_licenses[license_id] - license_files.append(license_file) - else: - missing.append(license_id) - - if missing: - missing_licenses = ", ".join(missing) - raise LicenseException( - f"Could not find license file for {missing_licenses} in {crate_name}" - ) - - return license_files - - -def generate_bom(source_path, target_path, dashout): - try: - cargo_output = check_output( - [ - "cargo", - "license", - "--json", - "--avoid-build-deps", - "--current-dir", - source_path, - ] - ) - except CalledProcessError as e: - raise RunCargoException(f"Error running cargo license: {e}") - - crates = json.loads(cargo_output) - dashlist = [] - - # Cargo will also pick up our own dependencies. As they are not thirdparty - # creating a new list without our own packages - crates = [ - crate for crate in crates if not crate["name"].startswith("databroker") - and not crate["name"].startswith("kuksa") - ] - - license_files = set() - errors = [] - for crate in crates: - try: - print(f"License for {crate['name']} {crate['version']}: ", end="") - license_filenames = extract_license_filenames(crate) - for license_filename in license_filenames: - license_files.add(license_filename) - unpacked_filenames = [ - filename[:-3] if filename.endswith(".gz") else filename - for filename in license_filenames - ] - print(" ".join(unpacked_filenames)) - del crate["license_file"] - crate["license_files"] = unpacked_filenames - dashlist.append( - f"crate/cratesio/-/{crate['name']}/{crate['version']}") - except LicenseException as e: - errors.append(e) - - if errors: - for error in errors: - print(error) - raise LicenseException( - "BOM creation failed, unresolved licenses detected") - - # Exporting - os.mkdir(target_path) - - for license_file in license_files: - print(f"Copying {license_file[:-2]}") - with gzip.open("licensestore/" + license_file, "rb") as inf: - content = inf.read() - with open(os.path.join(target_path, license_file[:-3]), "wb") as outf: - outf.write(content) - - print("Writing thirdparty_components.txt") - with open( - os.path.join(target_path, "thirdparty_components.txt"), "w", encoding="utf-8" - ) as jsonout: - json.dump(crates, jsonout, indent=4) - - if dashout is not None: - print(f"Exporting dash output to {dashout}") - with open(dashout, 'w') as f: - for line in dashlist: - f.write(f"{line}\n") - - -def main(args=None): - parser = argparse.ArgumentParser() - parser.add_argument("dir", help="Rust project directory") - parser.add_argument("--dash", default=None, type=str, - help="if present, write an input file for dash PATH", metavar="PATH") - args = parser.parse_args(args) - - source_path = os.path.abspath(args.dir) - target_path = os.path.join(source_path, "thirdparty") - - if os.path.exists(target_path): - print( - f"Folder {target_path} already exists. Remove it before running this script." - ) - return -2 - - if args.dash is not None and os.path.exists(args.dash): - print( - f"Requested Dash output file {args.dash} exists. Remove it before running this script.") - return -3 - - print(f"Generating BOM for project in {source_path}") - try: - generate_bom(source_path, target_path, args.dash) - except LicenseException as e: - print(f"Error: {e}") - return -100 - except RunCargoException as e: - print(f"Error: {e}") - return -1 - - -if __name__ == "__main__": - - sys.exit(main(sys.argv[1:])) diff --git a/createbom/licensestore/0BSD.txt.gz b/createbom/licensestore/0BSD.txt.gz deleted file mode 100644 index d6b2a6dc9572d57e6c9a2289bd26c7671ac812a3..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 401 zcmV;C0dD>uiwFoYFv4U21295UL@soAbO2S5QE#I#5QN|JD@J`rx!1~+jVZ34)ai3FxKjZCD;B7n&XFZSC)30&D zX_%L3c)c$P%Vn4`kLTt6I3=9*=kfZ$?LOVcIpKX+F3@lJ9PbOxDM9s@G^N)E{!Yj1 zl1|&rCbkUmbv#gD7{NaHXH#*7ClZ~XK(0a-Q6F0$P#GyLnNC2~La9J58WtQ(Y!SGj zpn9)}n*B3&rR^)@nw2u$-WrYgLHimVhqBd?cE+0cvIf^CIu_Zg0h|Xvvx|^6oBZgs zV^~8w%cylC_X62-X~-5@H*gsX<-gxlQFSp`w5$}$u~rMYG3irA<6Ty3XbhAaIBu+I*p-|?zpA4TD(vM8 vC_uqTPV{}uv|kO?!||u%y6(IKZL#Ka(93tUy4L@%f4lhr2J-0|UjhICY`4dF diff --git a/createbom/licensestore/Apache-2.0.txt.gz b/createbom/licensestore/Apache-2.0.txt.gz deleted file mode 100644 index 43305c2eb64f5cfea476fbb3f65a5a57a131d446..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 3977 zcmV;44|eb$iwFoQjcQ{613_?MV`ybEE_8Tw0Nq+!bKAxhe$TJia;8&h2Bw``+c-~* zB`0hhN+Zg3GnqUrfd#oWfJJrzQS7hpx$F%jCA-tNYBH@!V$YsEm+yS%EQI*P-=df0 zPKkHARGm{_JoDr~ly%y4;;Z?qLi|m3qqGO{)vH(EJh^B$4E^huFZcWXT+%jkW4A9G z-palF0vFz2-~GH6i`A8QbF;cy-Y;)fYw`BxPP|`V7vk>v_U`8D{Tuwcpr@{u>-)Rq z5AX3C67c0*T&Y@jdI06z{0pzm%%5l`+)g%)XqD{504E)kZJm%^B}&s(yh_x@iqWY; zSk+rojU|3vcv1LlrQKllX2kD>bfUs7RV6kDu~sDu`4Z$?Gj4a{J7H@0py4@Fj;-p3 zW4(+$QLHrm!Rqa95N6*gD?lY!sE31)DEeE*lp<{Z--0) zwUv#yCebHKj2#}3v{yowBqeA8W`JkC7y}P@1+{X#H5hcTrYVH9Dtu^2=>kuK-;P}c z%SzL>rt^~ggJQ3T9n0Yj=i;rgq(?v6-ay18t44u?F^WQ4Ic!JgB!r==mT(*RW3*bksH;45lRiN zoJh~~OfLV$j5BcoYw=%pcA0w}{zIEQ=xRh+R^;*F1*k{RRy$M#^lr6t6z~*hoCM^S zlTcg3ZY883q*r?!X}wjovKE%puQgfxBW}@}O2g44WmRyn?#gB)Q$P}m&J3c_t;XHK zkIvM?9>dGghTxP6tRHfZ1bH$1KoRo4*4xq2@8Fh3W$6W5OYfw3Gt63&)5Fz^3!ZYGnmL z@*s61H%-X@43`Q-Qw+dT`cRS)7XrG08Q|dvZ)_=eSd&@hFko#V3k7YxhzmG?dX#Ms zJHtYNb_jD`h)*v1Uct_fkW7u)UnVPDDXSmAiVsSlLEP*(0&tJ>Ht?tSlGp}8@r`uo zypB?_!aXqhA$l0Aa4T{b=E8ob%UuQr;H&{^0A!|B51L$wQ4FT>c_I{8*x2w1M0hvn z+2n;`l~WEPg{&`OGt*E~z%sqn9qe-I^HV$yI8{&5zYxdf^VY*?_P!(WzG_(2N*(i4 z_0m$Lpk3$~t+J{)Kpu1-$#5Hp7L1clw(2rCT>}u=T9#BKimXOPqn;>*)={QTUVnp7 z?rZ#6k00kiOxbL|Xh5HEp_WEHP}syL6vLHgB0-X2+t4cb{VC;(EGY&=eFIxJ0k++^ z0qpSL5qJkh7imuF`Bb2d2**!oMes6}yJxFKPE-(;X?u+KjRIrVV2Y>7%jZ>lF^gxK zd0AZVBP_!r)j$GT17KXB7dEn?INDoW*Ae*`J8yk~S&$oDB}1W|2A7hB?C*+aOHstG zd=L09=>&+V8(iD~r37hN$%<6S9o(Q=mqR$z+)-f(DXB*KC)oX1`IxOlu9X|T$Y5j= z1(~(cZoqNN(NUGB9b3XnPa{7N;-%809)l64XASWPM{&I_M>9G|-d5U=2z@rOqd>Wo z)7y@)A3_m*M20;Zi3nD+71&#fJXhzl(-c19*YVgP13yW5aswhhwnv+a9VoL=5KllE z6(Kn&o$r&9(5c@?h@S?xEe+V4%QX_-Ed3aWzM6|4kyhchZ{qO-vl8o(i>r^-v&~GF zW;rS=sFETxkU$6lor%Q}F931~rv!%As{t$%!VjRYsrDMVMrXPg7wL$?JhAjf));}fJyaNds_SPNE!KD;uf7-u!HKIItoK$*mi4vxDq)PFhXbSzAD#(9tLzYG0oC z7w!_;VACmI5dr>ykwjKc%Z?X>196Azt1YO{ByXym-(ruh2(@l5mNoi6_CgMj3S&At zWzbtzL2f1fOd#hQ_ls1pBDc22xff(GJVt3oPlo2Sbt?}E*^W^Na8L(sGr^;0SRT0qX(Mbl z0?1JuA)|r+H?bm5+h#7|Pas*5S|Kt>3awTt_Hu0+=!v+#2kd$s>gY3!r0f9Ii&#Snt_L3bD@ z+&#K%dxW?c(kK&K_bnMiv7G77Wwx_b10+}xcyrdmQ+EIw9Um^+IBu8%qQDGG)v@r= zT_7x03VBnJkqHXXA*Gu?8;>B)=yMFI_?MU)qi2vo%2kF4EmRpiCYqBo&JL+?@kvfg z_0(w9C4yG;zi<4|)w9*j{qoKA43h70AbVrl`8|+wXZz&Yl|jInOgXVE`709@T2Bc+ zloj=uDd^N$vmz)-obzU4Jg5;e@ImMZ#pl>H6La3eXYESC1~M8Y9kx^Xl-@5%*$Tu6 zHhmq`ltIU2>tvxxRJmt$_&x{oNs#4vJsm&^T_>EulDSP4@KnCB#i^BL;Ck7V%l8In ztW+Om3K0nC0NGg}&{i+-kca4-4(D^wFe9;05}MHa9d}`fU#Diy{7vM6Tj@CDgB~I^ zugFlQ>iFCu#5zo7^RaBms=|L;?052r%%lX>y@fs}6AHGz14ra%qJ9d;8&##cYHR~- zokUCk7ViIoJC8Aq3>=0SV1~2FMAIthnV1LI@i_k2Fi+iEoHbGEDu}kyu$~FP(cmj{ z1q$)!$W_LXoJQ6ZYYxiVrg*KP!61`6kh~k8e}f<8!@}!0V!B9wnSU#=_v3IK0~M@ zQ;(|5AfA9X8pNutw0y60+8ML5(S$2iHYQCO zL~~LZaOwa}E}4oNB6|w4V9fjF{k!V|tiF1&T)n+pu714!`FeFjMif<92Ze4txJ@aVKuy-`(DeC*=c& zGQnkyrj7kXfLtqExt-4NadmhlAiW&mdWCoE+3hnV6cAg!N42cI!T8DSu@mA}G8&BRnF&tkqc>W*Cc6!ZoZDZE&=A*u zjX;`Ul=LO0lWtKGqNhnw76yJMj6IXC8J{uXIp4`Pb+k>TYG_w@1u*04%;;R&mXIir z>uAN4&ZD*Iw#-kC0h6IC$7Yp>sKx2rcysV%BOT~~7DzUYWPYDTV@4aJE*!wut1GOl z=U#)O-xs&H@W}F?uhE4xEdWG4_}3TmSNHHYQe_|SlHl+DGZz&8HHzspA<$|AS!1CM zAHr0lNS%DGRZ}?u1p<0Sg<47gYST zpOXd@r)N2CAj*)ja@$2Tvk%2MT&-?YdS!)fNP{L07tTOA8eAg=&#+cZZ$ACYFQ_I2 zo{snN-g4pIHI8S}kVD#Xhd0(74CylQ*8}|hCVnNoLC>RG*5BxHA0$=QGfl&%$X^H* z7x+MY=koG<6cPFn1OhH!etaHiyzYD(O3)Z1DpDMgx_+~vX_=gi>_Q;RA%y#jlHvVZP}(SC$I zI}rfr5X@to(hbdTT9C2sD%-c?ijd3C8j$NGgf|W7u31pmUu1X%UdjK;fTO#{)l1(F zb4b^N;nG(O-(hovzM9+7R^9X-bhu8~JTZW#Oe!>Jxi)*MIAC2Uxf2ObAU=ReIWSoq zl-Q&OQkf-OX`p$6uenhoE{(*8Gpcd(jQ9r455TVq#kB^hKx~UlAQ+-6nj67&1R`fy znTUK70RliS4P;^~42~HYc~bIu4dfcOT(J~?(pY4|9DH)DkE5#Q3XY* z3aL4uEs_Y$GAgz_Ss^n<=|15C`nO2c6zW#WS- znyZ~)T>pSf>X25cc?1bHG!P>MMulyx<5G(dn#c`Tsw|9<`2{-PV=Rg=imORTSLVSg zCM4CtgZd0Y_z~<=j_=9`8j_+u0*#3=b23Jd4+AtO9wFzOOl)}0xK|@R%3f%GfwvOc z4~SRVJw?tkSoSwURV0)r|JW#862uy4vJ+nRaTsr}#qoaVIiwFp;j%s57142_wEio=IE_8Tw0CkeVZtFG>Mfd!QK~{Z$66C!u3Unu1 zbWBth4T?^hB`whwTS+uXDyjSRossP{K~X>plA3$x&LJ1x#{{)Mq<0f6l&-O3v~Um4 zHbmz~`2O&SyL>uMSoi&x)MfDF@$qNIwl)kd&NVJVXM^3J;TX)AY@5L$SPT9DO=rT< zW{^CX@eC()MS&0a9nI+eHVF-w-zVcnHy*)2<4)AZLdej<~*+jMu|D8>{qPOzuo+o{22>*A?5=XsHW+fT`6%>HE? zTFi|T4iyKN=14cQ>n{%{^rDEZ4ekx&yjghn;m>%Tf&EuN;Kj3IrzT!?+E5s#x(8;VsOVU!RQmhh~UPr-g6jY zg%BO?BcilKG{e%SpIS6yq%eDg`$2TR;OwFdmVh<$4P5L#1tFYGZ`@!*#s+#kdwX@p zVK5C%fiY?L>uvu_3V$Pw-qJ(CH9?y3F%ta`=uh%#>}`z5sOdghgiktl(GiA-UHbEl z&cTO)>;}_xZnXE8XJGb}$i+9w&3O_#!+Kk3Kx$Wvn^W za;0B##X;1tRq|OBynwsB#{FFeFG8>7P6Jk`ywa~ASCCh)@SCWL4EXO`#p@cRVq&u` z1;;Z{Ez4aYswY^Wu96x`u@M?gwFGK-wGzB0vkh0vHE#2TD20B_*h=V%JXcad4%=L5 zvD}rpg6&RiWz93tLYEv<6zE>vi)y8?8{hCsKVWw}1pbU0Rn3W=b0kYs2JztcZtuEzI143+dWlv#iEio=IE-)@_WB|QXO^?(t487-9SlR=ys%92( zLkMX>dsqpU6>=rMFQW&|b} zDV$)m+$v7Fk!l`w$k75BZRxOpv9%7N55#EL`UVVn4z?VaLR592PKxT%I?K}`GrBbf zd)D3vse2C;Dh#PyK!ZXH_=0Ew6Ai*GGUz5CrZ~${g~4Gw06et_`3+R>5+M;SiCdu3 z*+#SU6xHB!tyV8^9eR2BDv_>ij!6}yW>|p^>gUS96GKH3KS?F&G)V({X)?65-!w7^ zr8Bqr&(w#}K4DOhROd2YP0rCc3-g)!Nm5%@>Q2ivE|gr^#Ec^pg-4#=3npsMWTe4W zASz%Ot%zcM9VCAFdV&8cDzjFXDA9PP^gt|yqxvg?uozbO%|ByH&>%<9kYHpON>qYg z2i^v=G0UEiHj0^cR)bp_SeaG}xmbX9aRC(S!1&Dn%vaL1{O~7HLw#tO`}qENEM+f9 zp9~G&Sa+b%9G8S+UWt!$TX)Z9NIP*~r)j1RWEQrzi@qYj7;JX)HoI1zbCl@R_0D27 zv;Vay^!xRdpI>i^b=Gh~?6aBF%DS9@^(g^sF+d-*?2OS4B4eMem(iz;EiB&Ms7g;F zYt7lWGf#u!e4(Dohz}N9Mk;p3Rp_e-w(GF6n$a!W_b6}w9~?H%Kh*-`wC$oC5uCCt z7b7fD8kXSF<<;JHE;0R%+u=~^fp%mQOu#dp_UB?XtsKNH^ZNSwHbSjKx?4#?r^lo| zjbgODGZUAX!fY(mV#?fzd=1+3lqhefqR5xS?}(|q*d^whH}|v{tWJg%s7iNQJTB~= os8gkgy{r^oT)_EgrCc#il@`HaBc92!9;7|>2kq>>hY$t;08`IvGynhq diff --git a/createbom/licensestore/CC0-1.0.txt.gz b/createbom/licensestore/CC0-1.0.txt.gz deleted file mode 100644 index 579708c83cc882847ea9afed890828ae8be1739e..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 2838 zcmV+x3+eP9iwFoik85K914BbFEio=IE_8Tw0Hs;mZrex_edkv+{IWK{D3jg60NFe# zvYZHGOMxUOn8y~`vN|EzoNiKz{(eqXH7P2#bJ-mXVDVP>I(4cu@kTdxZ`8zVk-APEEgYV*He~rJAF64RjcXp<7_frjnwsQwO-EN-m{#= zjat8luj&ZmF9nB30jwdM4d4OzXPeHcA9HR@lna27C| z-z=7QVm$sI&(+0v^gt<>#o{C0LbTmPjXLS2vV z#_wRva=N;|U6bmY<>HP-{Vz83`dLD6!zf8sjc!b7sz$l3`q28?1r*47XH=mNfo_&A zH0pEfZOCobSgNIF=Uw}-b8Um4Mjf0la;4kGm8iK)7sXL!uG$)(n6FvU2C2jP=KwX0ZkMrG`LLf?dT6U^T&+j^*szYJIE(&%i* z5}`H44|T!MF0ROQTsr8q6)GP_e!;y2X6~F1J6qFdFP&Ff<+{-u9gK*B7(shp|b>EHv7!&Db5p?IN}}{B3qx(owgY0&isSo-ETF zm`D*i*oITKHQFaoLK*NXE3_?Hsjapi#z-}6T8o@g9#T|5Znwu2FJun(dwi!TB2eZN zHYA0n7JiW$Z*m*NHQWel>y04`f`aS8ZVLWbS4WCUsSYqZI0GEwByTApcoriSSZmSd z6s69A!j=|gi&Es68J}4MsQY3>)k`s!gq8YuinXCgQ;a%Pq)d8OI(mZJHaCz&mBVHy z5`FQDo^M-EPSZDe%gyk7w$v$GU69}#6h2Tnc~iI12i$!i36R@Ij_y+^pv`)zAzLN2 z_D$D(Y)=<+v&G8|XOXjlAS5^Pxx7Jj?!@#MCjJhN+dW$m(z6;t3edZ?$vPVml03Kc z8{Q$F0ip7}{YXP?s=(K&6d{aoRiZ<1$PO1dO&yZoHN_>pcQM{>tuLu#(=IvYYeOZ- z1&vF{4?C0C!2L{FC3C)uCsxpd)TCGhJ1(&&m}Mc1}M7;?N{@aRU4 zVLQ7HqZuDhSc81O8huyY2&0=-l{!aB?6oa4^`baLBB@h0CP8gCP()x%oimi^qeOUD z8Qk4C0*nss2#f}AC+GSBrauY?^*NeoL-mKIt6Yd&j(X0#s_2fGZkKJ zlN0!I1p|`wgV*&={eG#@!aTrXfqK${*xg=df)vO^FeL&fm!}cZ%8;bNELIG?+arek z$nJ_Sv_u3#>P~y;dG-4BA1YE5?oN@^c`AU}nHZr}OrhB(?xI+1SrQnUzcH!P5+x$1fu9Q5m@}0`kt;t2f++dn!4>{(#&S+NTOM3Po2im7+rM-UN*L ze9+D398W|G(IcO7@}3|ReM2Y$vdGho=GamE9eNsbc;;^CTm^Rhd!#;T+C@fcEoCMX z5ycvZ0r4%{2r3Cg03N6+c(&_3OYxX-EyXl1=+A)4rHMr- z_Acv56LL>+5jSw}KxR@#H+b5Q&CudA%5NYZN;I=mipKpe>T#svki^}{#^`RQ(FB2r zTGuUyo#8ZM*zm;R(c4z?^YTF_xw zows1&7UpmX94z7VrNt|eq+ob_wPjnXyp5~?y|A~rAmpP$Nu*GQMn?l1TSfvvl^w2F zO*91sm2sfCYUP8Z1l@$*A$P3Waw8-Gy)3AvG?rqS0IVX42EAYtZ*eFQha^R49pPg@8a>%16{dN3k1@Iz#z(ki*Zi0f9k zLERB`46-+Lh!JAZM{XgI44Dj`(VnoQoKtsg%mDlo=?keuz(oe==HJ*eG89?I{ishn zJdeQ^@DUb++!OdTTntipN*tkgP3M z2*g3|1WpER5&f1UMVPBoU+B;^SWc{)_e6{=4&ZrL z4|la^yR=gn-A<%U)&JS1Ot44|oi)TSiNc?M%#{3upz%E&H%Mwju*A?xXOzrZX+Tmv+`%mO{^eh4m*9?!f1IIf8o{T3%J$G44hK~}p8O(l% z_k0+fHiQ>89>g#!sAPo&?Drfw?t2IA31e*}Y{&%=Kc@g@##h~HB|(niOPO!m-VI1> zfoI1v(|>ThcBYoaU|%G3CRo_viQd@465|JR;o9e><94)J3#!tA0|R;@o80M`QI5o5 zx!%C%jCa05GSweg<%WVwc$NVOu_>orP?!lww3up~WB|LF>~xHo4lK|lU>O;)f0;0h z@~)TkI@+;T3^Cy#NlJ3aW>F_-XZwb$)pd>l)$&DZ+L21-!)hR=|54!oUjH!)Hhrpm+I<*92$pf%F%@_|pwu zmtjhNEMQ*ZM;QG`X+xr$hv5`IJj>-vc)cW;Vj{@ge{Y40xcYcYnZ_U zH>B5Op|IazRm#2+>ae*)+etwcf84r;7ERgE$oE1D_snu}Eu2DYcN73h13sa0V4EEB zhiQ)>1>Z}AnkKHE!FE^*E(^jnSh|7<_5B2-D7CWq*i#m1pyDk*WQ4o*XFN9CSxt=w z4BB40OkW$_GO6tb+*_mq?s&G+-U!wfL;nV8d6I-yloQ>imN6DT}LaX?if8JXVH zP8$;T_S;YZH^Syd-Mj48TOeg9yeH;$Z#y809MhqppKtk=TK~WP-4|V-Q(?sd004Qd B*Bk%< diff --git a/createbom/licensestore/MIT.txt.gz b/createbom/licensestore/MIT.txt.gz deleted file mode 100644 index 37744a6241720397968b18f574da303151dd507f..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 651 zcmV;60(AW!iwFpUjcQ{615HU(09{gFZ<{a>fA^<2<*AiW_r5m=oW>epWJtTH>H`52 zJP{mWvnbzwcO+fcNs*B6?)UF5nXDkSjTyaREOzJXWRHD-hvpI9uBM*e;jNp8VXRN) zow349C+od+BUlf;natq|$EhBJX(Q++W59LL^!0Q!5d;VIc!jf>JObPy)ONJv5o%~q zh~Z@Dk;c0&TR*#EFYwCg75vcdk zf{P8kn*&V7hsid?5rG|>VQ$I8M|-d*dsiU%lHM~UojoQXpAno~YdiXyCDwU94A%D% zw3et3bHJjf;p=@>IF>?({W@^{ktx5hcxn zX&tU?QT%0^KouJA+%UKcMQhyHT1w=TftVPiNNAopfkQs#Z3xB#VMCr1PRahvsh3H zSu~@un>%>j3M!Ev$6s7Yl~asZ<(0-~gei6P7y2qo5dqh-q=js>$|6SVM1)#M5SNP^ l3#}TyTm(nxy(`6ELP!Kpk*g#yMf@0k`U7}2iMcEU005g;K7{}P diff --git a/createbom/licensestore/Unicode-DFS-2016.txt.gz b/createbom/licensestore/Unicode-DFS-2016.txt.gz deleted file mode 100644 index 7a0140108eafec0c08087b4da0a943da8384fdad..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1219 zcmV;!1U&m6iwFqnk!oWA166KmV{c?-Eks6BEiy1MHZF8{bO4oAQEuZl5dGIF2Ki|g z&^q1x?V>0kOLRQBX@EdsJ+Nb2^J} z8_Ih_KUKr9@4wvL9goM!p|R_>G?TX5-mTmHOJ}#$FsX)J{j;}eJ1Wh_Hg>RWGschG zNjB@rKY#q$Q&bEE&1`LYDw>jXyBUr}XC|JPs0?LNrYP4U{X!u=Zw__+LY*l}8Y)AZ zwyxWwZMIaKZBbLP?Tp!(W|(->6-DYPiB%BEHf+p-Li|NtNhvP3qUKO*}ax&J-yETjPR%emfuka`y4y zSeH6W)Wg|=PM0NTYiOak7uuVyM?m{L6cB2&^$KEO-pR$B1zWOCHy539 zWYPES+7?`V*{%<)yMl%8-E!c~tFmuC5GLV_)So2&y*THQ018Sj4Rj7tc5wfliC6CH^xwbnyCURh><{-tPH@?Rl__S+FyW#)FQMNxk*S4>G zDld)m`51Rd-y3uoQI@OOc<WP+&| zzb#Xt-89R^GM2(QK^W(3h=lQXE)mOx%m4~AV&geMN#X2fA<}S;*I+7RnZY_{GD{e9 z2GD?(K?(=R;~=GFo-P&NC`kn4PGmAmk!8GFM&C*!w|_;>OEkQT9fZUqZ_#r$KW5<7 zZRRSDM9SrlPx@3nibW_p;rWVyi^ejT#$v1s41{qY7e1Zd^iqT}h!GaaRD>CShp%eb zGm>KkKEDVaguXcO1Bz#?#{?k0KP*2V8@vxi_=y$yRG#>e>z^gPPeclvLNowLp2O665s!>ql&;&H)d zdN%AD4xlK%nr^T?TMY)L~h|Qu>Rz4{d>cAv9Nt- hF^0#^4ue7F1HN|l+vsVh@qJtLiwFqrjcQ{6166KpX=7z>b7d}ccys`5R9%moI23*7S6ua(&b+Uxl{|^l zSS1h{((F7sU?$#zNo~_A`|I~ylFoEiDQgm$9<`f=bYwf zbG#cbZoosd!;sSyvd+a6+-Xk0vZr6tIavq20A=jWp|t>amij4-z>$e$e$jQ=$$1l? z*7F;Gg=)A=cfrwy)|r7pe)1pRcJih1)0Gj~XpN8PM|t{t4lZ`CO>XiLu1rD>?eyZ^ zKX&OZxR-OH!TgN*l8Kqq8SJdRJjHD4-*-cu1))iHamTV|7=GhIya+z>12bl?xc^O^ zj+RFA?Vi}38fKUFx%_0k?OnRrctsob9A0kceJAcL(jTo)gj&Q*XX`@biY(4;Yhy$^ ziy&KM+m6f>r3mWE^?53a7%;Uyk z#G5x4-%^-;he>!BJ&vl`N~)_(a}-*Vs%fvQuWBvV^g+~Ef5_>mnr(Gx2o+kC%`;US z66G^}QRO<%zXP}YPTrb_IQ{E7wD zTTv8?lsLe>uIWj_gm^0CjTQb^g;2Yk)?z0 diff --git a/createbom/licensestore/WTFPL.txt.gz b/createbom/licensestore/WTFPL.txt.gz deleted file mode 100644 index 9e57dae5fdd3e640c372b3833ff48e29c67b0d4f..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 314 zcmV-A0mc3wiwFq3k85K916Nc=P)sg#cys`jP|-@mFcf|7SDZ(MQHJ;^V%K&q=$f&% zjy-10T^m`Fk*1UVy=i?AK?E;c$UQmtoXY{eE92O$k_y!-$Ffdeu;(>)Nf8i^O}%(! zDMIH(nMe4g-pKXJ8r;p0QA7Gb4tMkUeH0U5Qrj5pj?+8Zd>6D31GLC*k@XzR~ ze7i1@6d6)pWUOMmD6!<*FmCp&cn$%wvf8pmJ$_BZHP6_RrO614-t!oHJK%lj{h#jf MC*s~{ZsGv|00Lf_UH||9 diff --git a/createbom/licensestore/Zlib.txt.gz b/createbom/licensestore/Zlib.txt.gz deleted file mode 100644 index f9c19c9ecfda58795346ed73132288aada6df1e5..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 488 zcmVl;3425_73T{b(tAVszI~AP*WayAB z$RNwK%|;SkN;=p5^(F1=AwjyyC-U*VkGemRdU&9KxuA2m-#@_9hF+fGX>2iOpYYka z$C(Ng9_#7_LC=funFbu-#+Q#&ZceaLow-%;c?0~t2$ljYKxv7DgVRRwxo#c6eTK|{ zXUtW*VuU&)_@?brphuW74iL%r5n)sbQyhHq6Bg%%3grn#;k5U)g21C5Um5J2`+<_E z6yj`dCmXG1E1MW+w3BtdX}b|Y+M^NwKLYpJ$RC#UAE5)bf1m{u epH;!0$i?3N2JO9Ed|sEXX1l*c5T5y00{{S^c=2ce diff --git a/createbom/licensestore/ring.LICENSE.txt.gz b/createbom/licensestore/ring.LICENSE.txt.gz deleted file mode 100644 index 651640e65488a31ffb59549a77292d17d2ca088e..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 3341 zcmV+o4f66IiwFpmMC)S!19E9@XD&=hLq$$gMJ{xBbO6m-ZFAek5&n)}aicGmI1m-P zd2y8KOdt}H&{Bj7fOa&UP6L8R5-|v{coD;Y-)HykK#-y>+f^sgIFSV6_ICGnpL?D= zjf+}}dKuRu#lK3(xY~+&QQ{eXo2MB*EyP0BqG<5nTvXdU5u3DL;teUXG?95FE0N~( zyHyoUnMjcoGs%OizVPZ-l_+IWtX49g$r;(hFYCCJ$4rQh35)01z&n`0=sGQO7+A_u z_ARSdrum{rPS0eSKH`IUS**lWLC?c*WW!Wv20Rp1S~oFSp~>3uR+X;OEH25jcJyw7 zhMbFY;e~_qs@`U;%lQ65?nZFhIC2=zPmnJ$*Kc=OHc@6PeR@5NP_!hvvwboBY9ds(j1s-j5XG(5CnVZF7*s+gs7 ze2??l1>BjXRb8gjh8G!`s)~8Nq0E!7alR#6>!w^6h=!Am$Ml^RdoCp0jMiIqv9r$-*sH(LeQ`~ls0x;fpWr8xwam8Mr_1;e^(bzNVv)&C5mWW5 zzSp*7Uqn>RrvFm{HuS@+Nzf0v8>U5F1BT#M3!w;YP~@r+i?Z6o8Fr|Y|7p@vVdK2W zvSP!gP}QPr$aQMh!4mM6Hmgf(S=a08^5P=N;{HrN%B( zyW&7C6iu!6741M@gg{F6&{DaV$Kwj4UY$(`F&^W;I2TVVzMILjJyn3rKzk*lG6#0azjW20IAeP1VL<(h5>$ z8Wn)5y$!ni5_s|Ehc|D3c>Uv#=Et{hzuEox7updH770(z_rEObq9^|P0$-Nsb@t!W z2#TCr=44v6xfumWZ4(mnKw_J!K9tU7-uxn{-6B8 zq}mF-F)NaW7-wwOj@Xn!wG~Uj- zsC8||w6QJ=^HOA>@Rar@Y)zZZrr&{?i?b7*hi}!6lE*8|esVDWgjeX~VCoYUEfyCj zOS2QuX@4LofHVZy6x)i_jE?a@7VOjCPJmi{lDaDIKpKd{(dYIdx+*gt$5<8m zcYTWJS>IMzQ5|c7-9qjXa?+N0$#1pKJ8W8kt4gn7@_X@_n0LUfAo&TnX|KOOiWRg8 zac`13s|plP`2;iClGIcFfra^eT^>k-j_kO4U<%t#8~A?%y%oRy%5vn@D;5OI?R&!g zrisYRQ7!T*A)@q!xOc$O2a}N#kd^yM zaPNb7Q$R)|xkGGP$3@FwfIb_6Xi&nygTF^L%@G}gD3LmNIVJH~fjlKT$+>M-u%+KVMBC zWhjr{IC6tva!>N*jK<#j?^$FGoCz%}<=h{0*vOe5Jdj<=2QSHqF?tYBN=MdtEPts4p6=lu-J09wN==*I|mS;hbxXt{+`Hny`%ZdA|tg611Rig zs#@%eno_Q?KUbYPc~#l!s6(Bu@YX&!ILWItJ60+hd8K8cgdo>bI=@&Ix^9K14?a3| z%an~y`b@Lh-7>AfQ8JSFVgX8ox9T=Uyrz{R{H!SrS80!a)cLNeKbofBR%L>2nYMg@ z3z>KeYjM)%AV?MY7ZX1sC|c1;LRmL!kV&qZNskBdm?SN|79qBOK!wDw5-Jg!R&aA~C#`55D!Lxwo$} zS2EX{V%y%6^cQ;I^b2FZZd-hz3jzsqVr9_E^=4cQ7867pr z?%rdWyXW?9>GDvTBxii7Y@53-FHeltc)1(p-izHR_g>&e*_`ft(VcP&M&Xk?<=zY2 zDfhnqPWjlCa_>d1lzT6HrQCb5E9Kr-Un#5JiHvADxCy0;OZ0L{*Nt3uz;n}Nmvm)& z*f;8rF_?T|=(!>$?QPd-C1raxyFke|Q@)D@OFv&{j~AUW7t^emUaaB@sCA+LSO9d! z>NMezK4Ec9w023?-!|)9!aBejq1u#)I`ctp8|#orYLQnJkl@6i_K7b4u?k2Bf;$QI zh?6s(WG3Ux(i$KI5q?I*q${bUw8`N2Wl<|yoylgIe zk4dUaRa*y&L-ms zOb@8>{|=0>J7mz(VAWxON2m_B-X}?)Z9T{M812UX*c)F5n1xx>M^Mi)e@VkIcK;A~ zH@6WO&}ir$J&I<~w!0X|NMjx6LoHhELlu*tF5TGy6QQAPb>ZnKHnl54lxl}n3iXDr XGlDH*b{yjF4`BWa+LesVjVAyAc}s|4 diff --git a/createbom/licensestore/webpki.LICENSE.txt.gz b/createbom/licensestore/webpki.LICENSE.txt.gz deleted file mode 100644 index 5da686a854fa35ab341cf1ec1e8a6975d607f185..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 595 zcmV-Z0<8TXiwFqb9Ux=?19xR&aBFEUOi4pUPE$oLba-?CZBtEe+aMUe^DAEUv`KEe zP1OpdXDG|Ru=i_?!y+R0!)pRa-a?(CGHjo{P4hO>(nMxSh7 zKsvYxQ}DlRmjIW8>+Be952vxW0Y6*V`(f~BH$Ib3T$i^oT?YFZk`2fBgOJism*Acc z3BG;#`W+U*wIk@GONTo`wg_@DIzK}4aEi8o4)FyXeed@8Y{&lI2k2c)!9AUly#|VY zpU!Q_-T^TeGM&QYG4&aB0pI1PKPA{(n^R*c`*eZl(2jE}EcD`fY>^IanoG1#{>75+ zJuKG8rrG~>1RqJ?K24Kt1Go{|VaTzajabQ4476OC9aRjthOLqhe94w@LpAPifQlt# z5N%8)m4+n_t)_efw5|bJiVDM-COd8_P;5;V;w4g0>_b?Tb+hDRJ+t^`TXVGdV1rzd z4O3->Te{#iH;=RNiW|YSzC!^J64(P126UB0{?4>uP;|Q>H>BZ!)z)?rh?GYa49kxO^u>Cfne*JubC)WCdwIYq(We$;YuigDz3AmY)qbx zoCQ%su&d%c?>q!dG5a%x=G h3|_C^#tzRhZrn)z$GER~$#9l;