Add SBOM license enrichment for AppImage variants

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
2026-07-20 17:10:32 +01:00 · 2026-07-20 17:10:32 +01:00 · b0ba9db6a4
parent 298f19ce31
commit b0ba9db6a4
8 changed files with 200 additions and 16 deletions
--- a/.github/workflows/appimage10.yml
+++ b/.github/workflows/appimage10.yml
@ -408,9 +408,50 @@ jobs:
        with:
          path: ${{ github.workspace }}/appimage/10/squashfs-root
          format: spdx-json
-          artifact-name: sbom-${{env.MAGIC_APPIMAGE_OUTPUT_FILENAME}}.spdx.json
-          upload-artifact: true
-          upload-release-assets: ${{ env.MY_GITHUB_TAG != '' }}
+          output-file: ${{ github.workspace }}/appimage/10/sbom-${{env.MAGIC_APPIMAGE_OUTPUT_FILENAME}}.spdx.json
+          upload-artifact: false
+          upload-release-assets: false
+
+      - name: Apply SBOM license metadata
+        run: |
+          cd appimage/10
+          sbom_file="sbom-${MAGIC_APPIMAGE_OUTPUT_FILENAME}.spdx.json"
+          jq '
+            def is_tcltk:
+              (.name | test("(^|/)(tclsh|wish)[0-9.]*$|(^|/)libtcl[^/]*\\.so(\\.[0-9.]+)*$|(^|/)libtk[^/]*\\.so(\\.[0-9.]+)*$"));
+            def is_magic_linked:
+              (.name | test("(^|/)(magicexec|magicdnull|tclmagic\\.so)$"));
+            .packages |= map(
+              if is_magic_linked then
+                . + {
+                  licenseConcluded: "HPND-UC-export-US AND TCL",
+                  licenseDeclared: "HPND-UC-export-US AND TCL"
+                }
+              elif is_tcltk then
+                . + {
+                  licenseConcluded: "TCL",
+                  licenseDeclared: "TCL"
+                }
+              else
+                .
+              end
+            )
+          ' "$sbom_file" > "$sbom_file.tmp"
+          mv "$sbom_file.tmp" "$sbom_file"
+
+      - name: Upload SBOM Release Asset
+        if: ${{ env.MY_GITHUB_TAG != '' }}
+        uses: softprops/action-gh-release@v3
+        with:
+          files: |
+            ${{ github.workspace }}/appimage/10/sbom-${{env.MAGIC_APPIMAGE_OUTPUT_FILENAME}}.spdx.json
+
+      - name: Upload SBOM Artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: sbom-${{env.MAGIC_APPIMAGE_OUTPUT_FILENAME}}.spdx.json
+          path: |
+            ${{ github.workspace }}/appimage/10/sbom-${{env.MAGIC_APPIMAGE_OUTPUT_FILENAME}}.spdx.json

      - name: Upload Artifact
        #if: ${{ env.MY_GITHUB_TAG == '' }} # commented out to always upload
--- a/.github/workflows/appimage7.yml
+++ b/.github/workflows/appimage7.yml
@ -408,9 +408,50 @@ jobs:
        with:
          path: ${{ github.workspace }}/appimage/7/squashfs-root
          format: spdx-json
-          artifact-name: sbom-${{env.MAGIC_APPIMAGE_OUTPUT_FILENAME}}.spdx.json
-          upload-artifact: true
-          upload-release-assets: ${{ env.MY_GITHUB_TAG != '' }}
+          output-file: ${{ github.workspace }}/appimage/7/sbom-${{env.MAGIC_APPIMAGE_OUTPUT_FILENAME}}.spdx.json
+          upload-artifact: false
+          upload-release-assets: false
+
+      - name: Apply SBOM license metadata
+        run: |
+          cd appimage/7
+          sbom_file="sbom-${MAGIC_APPIMAGE_OUTPUT_FILENAME}.spdx.json"
+          jq '
+            def is_tcltk:
+              (.name | test("(^|/)(tclsh|wish)[0-9.]*$|(^|/)libtcl[^/]*\\.so(\\.[0-9.]+)*$|(^|/)libtk[^/]*\\.so(\\.[0-9.]+)*$"));
+            def is_magic_linked:
+              (.name | test("(^|/)(magicexec|magicdnull|tclmagic\\.so)$"));
+            .packages |= map(
+              if is_magic_linked then
+                . + {
+                  licenseConcluded: "HPND-UC-export-US AND TCL",
+                  licenseDeclared: "HPND-UC-export-US AND TCL"
+                }
+              elif is_tcltk then
+                . + {
+                  licenseConcluded: "TCL",
+                  licenseDeclared: "TCL"
+                }
+              else
+                .
+              end
+            )
+          ' "$sbom_file" > "$sbom_file.tmp"
+          mv "$sbom_file.tmp" "$sbom_file"
+
+      - name: Upload SBOM Release Asset
+        if: ${{ env.MY_GITHUB_TAG != '' }}
+        uses: softprops/action-gh-release@v3
+        with:
+          files: |
+            ${{ github.workspace }}/appimage/7/sbom-${{env.MAGIC_APPIMAGE_OUTPUT_FILENAME}}.spdx.json
+
+      - name: Upload SBOM Artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: sbom-${{env.MAGIC_APPIMAGE_OUTPUT_FILENAME}}.spdx.json
+          path: |
+            ${{ github.workspace }}/appimage/7/sbom-${{env.MAGIC_APPIMAGE_OUTPUT_FILENAME}}.spdx.json

      - name: Upload Artifact
        #if: ${{ env.MY_GITHUB_TAG == '' }} # commented out to always upload
--- a/.github/workflows/appimage8.yml
+++ b/.github/workflows/appimage8.yml
@ -408,9 +408,50 @@ jobs:
        with:
          path: ${{ github.workspace }}/appimage/8/squashfs-root
          format: spdx-json
-          artifact-name: sbom-${{env.MAGIC_APPIMAGE_OUTPUT_FILENAME}}.spdx.json
-          upload-artifact: true
-          upload-release-assets: ${{ env.MY_GITHUB_TAG != '' }}
+          output-file: ${{ github.workspace }}/appimage/8/sbom-${{env.MAGIC_APPIMAGE_OUTPUT_FILENAME}}.spdx.json
+          upload-artifact: false
+          upload-release-assets: false
+
+      - name: Apply SBOM license metadata
+        run: |
+          cd appimage/8
+          sbom_file="sbom-${MAGIC_APPIMAGE_OUTPUT_FILENAME}.spdx.json"
+          jq '
+            def is_tcltk:
+              (.name | test("(^|/)(tclsh|wish)[0-9.]*$|(^|/)libtcl[^/]*\\.so(\\.[0-9.]+)*$|(^|/)libtk[^/]*\\.so(\\.[0-9.]+)*$"));
+            def is_magic_linked:
+              (.name | test("(^|/)(magicexec|magicdnull|tclmagic\\.so)$"));
+            .packages |= map(
+              if is_magic_linked then
+                . + {
+                  licenseConcluded: "HPND-UC-export-US AND TCL",
+                  licenseDeclared: "HPND-UC-export-US AND TCL"
+                }
+              elif is_tcltk then
+                . + {
+                  licenseConcluded: "TCL",
+                  licenseDeclared: "TCL"
+                }
+              else
+                .
+              end
+            )
+          ' "$sbom_file" > "$sbom_file.tmp"
+          mv "$sbom_file.tmp" "$sbom_file"
+
+      - name: Upload SBOM Release Asset
+        if: ${{ env.MY_GITHUB_TAG != '' }}
+        uses: softprops/action-gh-release@v3
+        with:
+          files: |
+            ${{ github.workspace }}/appimage/8/sbom-${{env.MAGIC_APPIMAGE_OUTPUT_FILENAME}}.spdx.json
+
+      - name: Upload SBOM Artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: sbom-${{env.MAGIC_APPIMAGE_OUTPUT_FILENAME}}.spdx.json
+          path: |
+            ${{ github.workspace }}/appimage/8/sbom-${{env.MAGIC_APPIMAGE_OUTPUT_FILENAME}}.spdx.json

      - name: Upload Artifact
        #if: ${{ env.MY_GITHUB_TAG == '' }} # commented out to always upload
--- a/.github/workflows/appimage9.yml
+++ b/.github/workflows/appimage9.yml
@ -408,9 +408,50 @@ jobs:
        with:
          path: ${{ github.workspace }}/appimage/9/squashfs-root
          format: spdx-json
-          artifact-name: sbom-${{env.MAGIC_APPIMAGE_OUTPUT_FILENAME}}.spdx.json
-          upload-artifact: true
-          upload-release-assets: ${{ env.MY_GITHUB_TAG != '' }}
+          output-file: ${{ github.workspace }}/appimage/9/sbom-${{env.MAGIC_APPIMAGE_OUTPUT_FILENAME}}.spdx.json
+          upload-artifact: false
+          upload-release-assets: false
+
+      - name: Apply SBOM license metadata
+        run: |
+          cd appimage/9
+          sbom_file="sbom-${MAGIC_APPIMAGE_OUTPUT_FILENAME}.spdx.json"
+          jq '
+            def is_tcltk:
+              (.name | test("(^|/)(tclsh|wish)[0-9.]*$|(^|/)libtcl[^/]*\\.so(\\.[0-9.]+)*$|(^|/)libtk[^/]*\\.so(\\.[0-9.]+)*$"));
+            def is_magic_linked:
+              (.name | test("(^|/)(magicexec|magicdnull|tclmagic\\.so)$"));
+            .packages |= map(
+              if is_magic_linked then
+                . + {
+                  licenseConcluded: "HPND-UC-export-US AND TCL",
+                  licenseDeclared: "HPND-UC-export-US AND TCL"
+                }
+              elif is_tcltk then
+                . + {
+                  licenseConcluded: "TCL",
+                  licenseDeclared: "TCL"
+                }
+              else
+                .
+              end
+            )
+          ' "$sbom_file" > "$sbom_file.tmp"
+          mv "$sbom_file.tmp" "$sbom_file"
+
+      - name: Upload SBOM Release Asset
+        if: ${{ env.MY_GITHUB_TAG != '' }}
+        uses: softprops/action-gh-release@v3
+        with:
+          files: |
+            ${{ github.workspace }}/appimage/9/sbom-${{env.MAGIC_APPIMAGE_OUTPUT_FILENAME}}.spdx.json
+
+      - name: Upload SBOM Artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: sbom-${{env.MAGIC_APPIMAGE_OUTPUT_FILENAME}}.spdx.json
+          path: |
+            ${{ github.workspace }}/appimage/9/sbom-${{env.MAGIC_APPIMAGE_OUTPUT_FILENAME}}.spdx.json

      - name: Upload Artifact
        #if: ${{ env.MY_GITHUB_TAG == '' }} # commented out to always upload
--- a/appimage/10/Dockerfile
+++ b/appimage/10/Dockerfile
@ -60,6 +60,9 @@ RUN set -eux; \
    ./configure --prefix=/prefix --with-tcl=/prefix/lib; \
    make; \
    make install install-libraries
+RUN install -d /prefix/share/licenses/tcl /prefix/share/licenses/tk \
+    && install -m 0644 /tcl/license.terms /prefix/share/licenses/tcl/license.terms \
+    && install -m 0644 /tk/license.terms /prefix/share/licenses/tk/license.terms

 WORKDIR /prefix/bin
 RUN cp ./wish9.0 ./wish
@ -76,7 +79,9 @@ RUN ./configure \
    && make clean \
    && make database/database.h \
    && make -j$(nproc) \
-    && make install
+    && make install \
+    && install -d /prefix/share/licenses/magic \
+    && install -m 0644 /magic/LICENSE /prefix/share/licenses/magic/LICENSE

 # Produce summary of what was created and confirm their DSOs
 RUN echo "### filesystem:" \
--- a/appimage/7/Dockerfile
+++ b/appimage/7/Dockerfile
@ -70,6 +70,9 @@ RUN set -eux; \
    ./configure --prefix=/prefix --with-tcl=/prefix/lib; \
    make; \
    make install
+RUN install -d /prefix/share/licenses/tcl /prefix/share/licenses/tk \
+    && install -m 0644 /tcl/license.terms /prefix/share/licenses/tcl/license.terms \
+    && install -m 0644 /tk/license.terms /prefix/share/licenses/tk/license.terms

 WORKDIR /prefix/bin
 RUN cp ./wish8.6 ./wish
@ -87,7 +90,9 @@ RUN ./configure \
    && make clean \
    && make database/database.h \
    && make -j$(nproc) \
-    && make install
+    && make install \
+    && install -d /prefix/share/licenses/magic \
+    && install -m 0644 /magic/LICENSE /prefix/share/licenses/magic/LICENSE

 # Produce summary of what was created and confirm their DSOs
 RUN echo "### filesystem:" \
--- a/appimage/8/Dockerfile
+++ b/appimage/8/Dockerfile
@ -59,6 +59,9 @@ RUN set -eux; \
    ./configure --prefix=/prefix --with-tcl=/prefix/lib; \
    make; \
    make install
+RUN install -d /prefix/share/licenses/tcl /prefix/share/licenses/tk \
+    && install -m 0644 /tcl/license.terms /prefix/share/licenses/tcl/license.terms \
+    && install -m 0644 /tk/license.terms /prefix/share/licenses/tk/license.terms

 WORKDIR /prefix/bin
 RUN cp ./wish8.6 ./wish
@ -75,7 +78,9 @@ RUN ./configure \
    && make clean \
    && make database/database.h \
    && make -j$(nproc) \
-    && make install
+    && make install \
+    && install -d /prefix/share/licenses/magic \
+    && install -m 0644 /magic/LICENSE /prefix/share/licenses/magic/LICENSE

 # Produce summary of what was created and confirm their DSOs
 RUN echo "### filesystem:" \
--- a/appimage/9/Dockerfile
+++ b/appimage/9/Dockerfile
@ -60,6 +60,9 @@ RUN set -eux; \
    ./configure --prefix=/prefix --with-tcl=/prefix/lib; \
    make; \
    make install install-libraries
+RUN install -d /prefix/share/licenses/tcl /prefix/share/licenses/tk \
+    && install -m 0644 /tcl/license.terms /prefix/share/licenses/tcl/license.terms \
+    && install -m 0644 /tk/license.terms /prefix/share/licenses/tk/license.terms

 WORKDIR /prefix/bin
 RUN cp ./wish9.0 ./wish
@ -76,7 +79,9 @@ RUN ./configure \
    && make clean \
    && make database/database.h \
    && make -j$(nproc) \
-    && make install
+    && make install \
+    && install -d /prefix/share/licenses/magic \
+    && install -m 0644 /magic/LICENSE /prefix/share/licenses/magic/LICENSE

 # Produce summary of what was created and confirm their DSOs
 RUN echo "### filesystem:" \