Class Package
-
- All Implemented Interfaces:
public final class PackageA generic descriptor for a software package. It contains all relevant metadata about a package like the name, version, and how to retrieve the package and its source code. It does not contain information about the package's dependencies, however. This is because at this stage we would only be able to get the declared dependencies, whereas we are interested in the resolved dependencies. Resolved dependencies might differ from declared dependencies due to specified version ranges, or change depending on how the package is used in a project due to the build system's dependency resolution process. For example, if multiple versions of the same package are used in a project, the build system might decide to align on a single version of that package.
-
-
Field Summary
Fields Modifier and Type Field Description public final static PackageEMPTYprivate final Identifieridprivate final Stringpurlprivate final Stringcpeprivate final Set<String>authorsprivate final Set<String>declaredLicensesprivate final ProcessedDeclaredLicensedeclaredLicensesProcessedprivate final SpdxExpressionconcludedLicenseprivate final Stringdescriptionprivate final StringhomepageUrlprivate final RemoteArtifactbinaryArtifactprivate final RemoteArtifactsourceArtifactprivate final VcsInfovcsprivate final VcsInfovcsProcessedprivate final BooleanisMetadataOnlyprivate final BooleanisModified
-
Constructor Summary
Constructors Constructor Description Package(Identifier id, String purl, String cpe, Set<String> authors, Set<String> declaredLicenses, ProcessedDeclaredLicense declaredLicensesProcessed, SpdxExpression concludedLicense, String description, String homepageUrl, RemoteArtifact binaryArtifact, RemoteArtifact sourceArtifact, VcsInfo vcs, VcsInfo vcsProcessed, Boolean isMetadataOnly, Boolean isModified)
-
Method Summary
Modifier and Type Method Description final IdentifiergetId()The unique identifier of this package. final StringgetPurl()An additional identifier in package URL syntax. final StringgetCpe()An optional additional identifier in CPE syntax. final Set<String>getAuthors()The set of authors declared for this package. final Set<String>getDeclaredLicenses()The set of licenses declared for this package. final ProcessedDeclaredLicensegetDeclaredLicensesProcessed()The declared licenses as SpdxExpression. final SpdxExpressiongetConcludedLicense()The concluded license as an SpdxExpression. final StringgetDescription()The description of the package, as provided by the package manager. final StringgetHomepageUrl()The homepage of the package. final RemoteArtifactgetBinaryArtifact()The remote artifact where the binary package can be downloaded. final RemoteArtifactgetSourceArtifact()The remote artifact where the source package can be downloaded. final VcsInfogetVcs()Original VCS-related information as defined in the package's metadata. final VcsInfogetVcsProcessed()Processed VCS-related information about the package in normalized form. final BooleanisMetadataOnly()Indicates whether the package is just metadata, like e.g. final BooleanisModified()Indicates whether the source code of the package has been modified compared to the original source code, e.g., in case of a fork of an upstream Open Source project. final PackageCurationDatadiff(Package other)Compares this package with other and creates a PackageCurationData containing the values from this package which are different in other. final CuratedPackagetoCuratedPackage()Create a CuratedPackage from this package with an empty list of applied curations. final PackageReferencetoReference(PackageLinkage linkage, Set<PackageReference> dependencies, List<Issue> issues)Return a PackageReference to refer to this Package with optional dependencies and issues. -
-
Constructor Detail
-
Package
Package(Identifier id, String purl, String cpe, Set<String> authors, Set<String> declaredLicenses, ProcessedDeclaredLicense declaredLicensesProcessed, SpdxExpression concludedLicense, String description, String homepageUrl, RemoteArtifact binaryArtifact, RemoteArtifact sourceArtifact, VcsInfo vcs, VcsInfo vcsProcessed, Boolean isMetadataOnly, Boolean isModified)
-
-
Method Detail
-
getId
final Identifier getId()
The unique identifier of this package. The id's type is the name of the package type or protocol (e.g. "Maven" for a file from a Maven repository).
-
getPurl
final String getPurl()
An additional identifier in package URL syntax.
-
getCpe
final String getCpe()
An optional additional identifier in CPE syntax.
-
getAuthors
final Set<String> getAuthors()
The set of authors declared for this package.
-
getDeclaredLicenses
final Set<String> getDeclaredLicenses()
The set of licenses declared for this package. This does not necessarily correspond to the licenses as detected by a scanner. Both need to be taken into account for any conclusions.
-
getDeclaredLicensesProcessed
final ProcessedDeclaredLicense getDeclaredLicensesProcessed()
The declared licenses as SpdxExpression. If declaredLicenses contains multiple licenses they are concatenated with SpdxOperator.AND.
-
getConcludedLicense
final SpdxExpression getConcludedLicense()
The concluded license as an SpdxExpression. It can be used to override the declared / detected licenses of a package.
ORT itself does not set this field, it needs to be set by the user using a PackageCuration.
-
getDescription
final String getDescription()
The description of the package, as provided by the package manager.
-
getHomepageUrl
final String getHomepageUrl()
The homepage of the package.
-
getBinaryArtifact
final RemoteArtifact getBinaryArtifact()
The remote artifact where the binary package can be downloaded.
-
getSourceArtifact
final RemoteArtifact getSourceArtifact()
The remote artifact where the source package can be downloaded.
-
getVcs
final VcsInfo getVcs()
Original VCS-related information as defined in the package's metadata.
-
getVcsProcessed
final VcsInfo getVcsProcessed()
Processed VCS-related information about the package in normalized form. The information is either derived from vcs, guessed from additional data as a fallback, or empty. On top of that PackageCurations may have been applied.
-
isMetadataOnly
final Boolean isMetadataOnly()
Indicates whether the package is just metadata, like e.g. Maven BOM artifacts which only define constraints for dependency versions.
-
isModified
final Boolean isModified()
Indicates whether the source code of the package has been modified compared to the original source code, e.g., in case of a fork of an upstream Open Source project.
-
diff
final PackageCurationData diff(Package other)
Compares this package with other and creates a PackageCurationData containing the values from this package which are different in other. All equal values are set to null. Only the fields present in PackageCurationData are compared.
-
toCuratedPackage
final CuratedPackage toCuratedPackage()
Create a CuratedPackage from this package with an empty list of applied curations.
-
toReference
final PackageReference toReference(PackageLinkage linkage, Set<PackageReference> dependencies, List<Issue> issues)
Return a PackageReference to refer to this Package with optional dependencies and issues.
-
-
-
-