Merging upstream version 1.72.1+dfsg1.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

8 files changed, 187 insertions, 45 deletions

diff --git a/vendor/spdx-rs/src/models/checksum.rs b/vendor/spdx-rs/src/models/checksum.rs
index f8e2bc258..d66bd3612 100644
--- a/vendor/spdx-rs/src/models/checksum.rs
+++ b/vendor/spdx-rs/src/models/checksum.rs
@@ -43,4 +43,18 @@ pub enum Algorithm {
     MD4,
     MD5,
     MD6,
+    #[serde(rename = "SHA3-256")]
+    SHA3256,
+    #[serde(rename = "SHA3-384")]
+    SHA3384,
+    #[serde(rename = "SHA3-512")]
+    SHA3512,
+    #[serde(rename = "BLAKE2b-256")]
+    BLAKE2B256,
+    #[serde(rename = "BLAKE2b-384")]
+    BLAKE2B384,
+    #[serde(rename = "BLAKE2b-512")]
+    BLAKE2B512,
+    BLAKE3,
+    ADLER32,
 }
diff --git a/vendor/spdx-rs/src/models/file_information.rs b/vendor/spdx-rs/src/models/file_information.rs
index aba2defe7..a6d03bef4 100644
--- a/vendor/spdx-rs/src/models/file_information.rs
+++ b/vendor/spdx-rs/src/models/file_information.rs
@@ -29,11 +29,19 @@ pub struct FileInformation {
     pub file_checksum: Vec<Checksum>,
 
     /// <https://spdx.github.io/spdx-spec/4-file-information/#45-concluded-license>
-    #[serde(rename = "licenseConcluded")]
-    pub concluded_license: SpdxExpression,
+    #[serde(
+        rename = "licenseConcluded",
+        skip_serializing_if = "Option::is_none",
+        default
+    )]
+    pub concluded_license: Option<SpdxExpression>,
 
     /// <https://spdx.github.io/spdx-spec/4-file-information/#46-license-information-in-file>
-    #[serde(rename = "licenseInfoInFiles")]
+    #[serde(
+        rename = "licenseInfoInFiles",
+        skip_serializing_if = "Vec::is_empty",
+        default
+    )]
     pub license_information_in_file: Vec<SimpleExpression>,
 
     /// <https://spdx.github.io/spdx-spec/4-file-information/#47-comments-on-license>
@@ -45,7 +53,12 @@ pub struct FileInformation {
     pub comments_on_license: Option<String>,
 
     /// <https://spdx.github.io/spdx-spec/4-file-information/#48-copyright-text>
-    pub copyright_text: String,
+    #[serde(
+        rename = "copyrightText",
+        skip_serializing_if = "Option::is_none",
+        default
+    )]
+    pub copyright_text: Option<String>,
 
     /// <https://spdx.github.io/spdx-spec/4-file-information/#412-file-comment>
     #[serde(rename = "comment", skip_serializing_if = "Option::is_none", default)]
@@ -80,10 +93,10 @@ impl Default for FileInformation {
             file_spdx_identifier: "NOASSERTION".to_string(),
             file_type: Vec::new(),
             file_checksum: Vec::new(),
-            concluded_license: SpdxExpression::parse("NOASSERTION").expect("will always succeed"),
+            concluded_license: None,
             license_information_in_file: Vec::new(),
             comments_on_license: None,
-            copyright_text: "NOASSERTION".to_string(),
+            copyright_text: None,
             file_comment: None,
             file_notice: None,
             file_contributor: Vec::new(),
@@ -98,7 +111,7 @@ impl FileInformation {
         *id += 1;
         Self {
             file_name: name.to_string(),
-            file_spdx_identifier: format!("SPDXRef-{}", id),
+            file_spdx_identifier: format!("SPDXRef-{id}"),
             ..Self::default()
         }
     }
@@ -241,7 +254,7 @@ mod test {
         .unwrap();
         assert_eq!(
             spdx.file_information[0].concluded_license,
-            SpdxExpression::parse("Apache-2.0").unwrap()
+            Some(SpdxExpression::parse("Apache-2.0").unwrap())
         );
     }
     #[test]
@@ -273,7 +286,11 @@ mod test {
         )
         .unwrap();
         assert_eq!(
-            spdx.file_information[0].copyright_text,
+            spdx.file_information[0]
+                .copyright_text
+                .as_ref()
+                .unwrap()
+                .clone(),
             "Copyright 2010, 2011 Source Auditor Inc.".to_string()
         );
     }
diff --git a/vendor/spdx-rs/src/models/package_information.rs b/vendor/spdx-rs/src/models/package_information.rs
index c5d73fb3f..dde62f1de 100644
--- a/vendor/spdx-rs/src/models/package_information.rs
+++ b/vendor/spdx-rs/src/models/package_information.rs
@@ -76,8 +76,12 @@ pub struct PackageInformation {
     pub source_information: Option<String>,
 
     /// <https://spdx.github.io/spdx-spec/3-package-information/#313-concluded-license>
-    #[serde(rename = "licenseConcluded")]
-    pub concluded_license: SpdxExpression,
+    #[serde(
+        rename = "licenseConcluded",
+        skip_serializing_if = "Option::is_none",
+        default
+    )]
+    pub concluded_license: Option<SpdxExpression>,
 
     /// <https://spdx.github.io/spdx-spec/3-package-information/#314-all-licenses-information-from-files>
     #[serde(
@@ -88,8 +92,12 @@ pub struct PackageInformation {
     pub all_licenses_information_from_files: Vec<String>,
 
     /// <https://spdx.github.io/spdx-spec/3-package-information/#315-declared-license>
-    #[serde(rename = "licenseDeclared")]
-    pub declared_license: SpdxExpression,
+    #[serde(
+        rename = "licenseDeclared",
+        skip_serializing_if = "Option::is_none",
+        default
+    )]
+    pub declared_license: Option<SpdxExpression>,
 
     /// <https://spdx.github.io/spdx-spec/3-package-information/#316-comments-on-license>
     #[serde(
@@ -100,7 +108,12 @@ pub struct PackageInformation {
     pub comments_on_license: Option<String>,
 
     /// <https://spdx.github.io/spdx-spec/3-package-information/#317-copyright-text>
-    pub copyright_text: String,
+    #[serde(
+        rename = "copyrightText",
+        skip_serializing_if = "Option::is_none",
+        default
+    )]
+    pub copyright_text: Option<String>,
 
     /// <https://spdx.github.io/spdx-spec/3-package-information/#318-package-summary-description>
     #[serde(rename = "summary", skip_serializing_if = "Option::is_none", default)]
@@ -142,6 +155,30 @@ pub struct PackageInformation {
 
     #[serde(skip_serializing_if = "Vec::is_empty", default)]
     pub annotations: Vec<Annotation>,
+
+    #[serde(rename = "builtDate", skip_serializing_if = "Option::is_none", default)]
+    pub built_date: Option<String>,
+
+    #[serde(
+        rename = "releaseDate",
+        skip_serializing_if = "Option::is_none",
+        default
+    )]
+    pub release_date: Option<String>,
+
+    #[serde(
+        rename = "validUntilDate",
+        skip_serializing_if = "Option::is_none",
+        default
+    )]
+    pub valid_until_date: Option<String>,
+
+    #[serde(
+        rename = "primaryPackagePurpose",
+        skip_serializing_if = "Option::is_none",
+        default
+    )]
+    pub primary_package_purpose: Option<PrimaryPackagePurpose>,
 }
 
 impl Default for PackageInformation {
@@ -159,11 +196,11 @@ impl Default for PackageInformation {
             package_checksum: Vec::new(),
             package_home_page: None,
             source_information: None,
-            concluded_license: SpdxExpression::parse("NONE").expect("will always succeed"),
+            concluded_license: None,
             all_licenses_information_from_files: Vec::new(),
-            declared_license: SpdxExpression::parse("NONE").expect("will always succeed"),
+            declared_license: None,
             comments_on_license: None,
-            copyright_text: "NOASSERTION".to_string(),
+            copyright_text: None,
             package_summary_description: None,
             package_detailed_description: None,
             package_comment: None,
@@ -171,6 +208,10 @@ impl Default for PackageInformation {
             package_attribution_text: Vec::new(),
             files: Vec::new(),
             annotations: Vec::new(),
+            built_date: None,
+            release_date: None,
+            valid_until_date: None,
+            primary_package_purpose: None,
         }
     }
 }
@@ -181,7 +222,7 @@ impl PackageInformation {
         *id += 1;
         Self {
             package_name: name.to_string(),
-            package_spdx_identifier: format!("SPDXRef-{}", id),
+            package_spdx_identifier: format!("SPDXRef-{id}"),
             ..Self::default()
         }
     }
@@ -263,6 +304,23 @@ pub enum ExternalPackageReferenceCategory {
     Other,
 }
 
+#[derive(Debug, Serialize, Deserialize, Clone, PartialEq, Eq, Copy)]
+#[serde(rename_all = "SCREAMING-KEBAB-CASE")]
+pub enum PrimaryPackagePurpose {
+    Application,
+    Framework,
+    Library,
+    Container,
+    OperatingSystem,
+    Device,
+    Firmware,
+    Source,
+    Archive,
+    File,
+    Install,
+    Other,
+}
+
 #[cfg(test)]
 mod test {
     use std::fs::read_to_string;
@@ -432,7 +490,11 @@ mod test {
         )
         .unwrap();
         assert_eq!(
-            spdx.package_information[0].concluded_license,
+            spdx.package_information[0]
+                .concluded_license
+                .as_ref()
+                .unwrap()
+                .clone(),
             SpdxExpression::parse("(LGPL-2.0-only OR LicenseRef-3)").unwrap()
         );
     }
@@ -459,7 +521,11 @@ mod test {
         )
         .unwrap();
         assert_eq!(
-            spdx.package_information[0].declared_license,
+            spdx.package_information[0]
+                .declared_license
+                .as_ref()
+                .unwrap()
+                .clone(),
             SpdxExpression::parse("(LGPL-2.0-only AND LicenseRef-3)").unwrap()
         );
     }
@@ -481,7 +547,11 @@ mod test {
         )
         .unwrap();
         assert_eq!(
-            spdx.package_information[0].copyright_text,
+            spdx.package_information[0]
+                .copyright_text
+                .as_ref()
+                .unwrap()
+                .clone(),
             "Copyright 2008-2010 John Smith".to_string()
         );
     }
diff --git a/vendor/spdx-rs/src/models/relationship.rs b/vendor/spdx-rs/src/models/relationship.rs
index 6430a796f..7d074eaab 100644
--- a/vendor/spdx-rs/src/models/relationship.rs
+++ b/vendor/spdx-rs/src/models/relationship.rs
@@ -87,6 +87,8 @@ pub enum RelationshipType {
     Amends,
     PrerequisiteFor,
     HasPrerequisite,
+    RequirementDescriptionFor,
+    SpecificationFor,
     Other,
 }
 
diff --git a/vendor/spdx-rs/src/models/snippet.rs b/vendor/spdx-rs/src/models/snippet.rs
index 7585a0087..1de31f94b 100644
--- a/vendor/spdx-rs/src/models/snippet.rs
+++ b/vendor/spdx-rs/src/models/snippet.rs
@@ -20,8 +20,12 @@ pub struct Snippet {
     pub ranges: Vec<Range>,
 
     /// <https://spdx.github.io/spdx-spec/5-snippet-information/#55-snippet-concluded-license>
-    #[serde(rename = "licenseConcluded")]
-    pub snippet_concluded_license: SpdxExpression,
+    #[serde(
+        rename = "licenseConcluded",
+        skip_serializing_if = "Option::is_none",
+        default
+    )]
+    pub snippet_concluded_license: Option<SpdxExpression>,
 
     /// <https://spdx.github.io/spdx-spec/5-snippet-information/#56-license-information-in-snippet>
     #[serde(
@@ -40,8 +44,12 @@ pub struct Snippet {
     pub snippet_comments_on_license: Option<String>,
 
     /// <https://spdx.github.io/spdx-spec/5-snippet-information/#58-snippet-copyright-text>
-    #[serde(rename = "copyrightText")]
-    pub snippet_copyright_text: String,
+    #[serde(
+        rename = "copyrightText",
+        skip_serializing_if = "Option::is_none",
+        default
+    )]
+    pub snippet_copyright_text: Option<String>,
 
     /// <https://spdx.github.io/spdx-spec/5-snippet-information/#59-snippet-comment>
     #[serde(rename = "comment", skip_serializing_if = "Option::is_none", default)]
@@ -175,7 +183,11 @@ mod test {
         )
         .unwrap();
         assert_eq!(
-            spdx.snippet_information[0].snippet_concluded_license,
+            spdx.snippet_information[0]
+                .snippet_concluded_license
+                .as_ref()
+                .unwrap()
+                .clone(),
             SpdxExpression::parse("GPL-2.0-only").unwrap()
         );
     }
@@ -208,7 +220,11 @@ mod test {
         )
         .unwrap();
         assert_eq!(
-            spdx.snippet_information[0].snippet_copyright_text,
+            spdx.snippet_information[0]
+                .snippet_copyright_text
+                .as_ref()
+                .unwrap()
+                .clone(),
             "Copyright 2008-2010 John Smith".to_string()
         );
     }
diff --git a/vendor/spdx-rs/src/models/spdx_document.rs b/vendor/spdx-rs/src/models/spdx_document.rs
index df619e5dc..385685086 100644
--- a/vendor/spdx-rs/src/models/spdx_document.rs
+++ b/vendor/spdx-rs/src/models/spdx_document.rs
@@ -155,9 +155,11 @@ impl SPDX {
         let mut license_ids = HashSet::new();
 
         for file in &self.file_information {
-            for license in &file.concluded_license.identifiers() {
-                if license != "NOASSERTION" && license != "NONE" {
-                    license_ids.insert(license.clone());
+            if let Some(concluded_license) = &file.concluded_license {
+                for license in concluded_license.identifiers() {
+                    if license != "NOASSERTION" && license != "NONE" {
+                        license_ids.insert(license.clone());
+                    }
                 }
             }
         }
@@ -228,7 +230,7 @@ mod test {
 
         assert_eq!(
             file.0.concluded_license,
-            SpdxExpression::parse("LicenseRef-1").unwrap()
+            Some(SpdxExpression::parse("LicenseRef-1").unwrap())
         );
     }
 
diff --git a/vendor/spdx-rs/src/parsers/mod.rs b/vendor/spdx-rs/src/parsers/mod.rs
index 48c863fca..543a7872f 100644
--- a/vendor/spdx-rs/src/parsers/mod.rs
+++ b/vendor/spdx-rs/src/parsers/mod.rs
@@ -350,7 +350,7 @@ fn process_atom_for_packages(
         }
         Atom::PackageLicenseConcluded(value) => {
             if let Some(package) = &mut package_in_progress {
-                package.concluded_license = SpdxExpression::parse(value).unwrap();
+                package.concluded_license = Some(SpdxExpression::parse(value).unwrap());
             }
         }
         Atom::PackageLicenseInfoFromFiles(value) => {
@@ -362,7 +362,7 @@ fn process_atom_for_packages(
         }
         Atom::PackageLicenseDeclared(value) => {
             if let Some(package) = &mut package_in_progress {
-                package.declared_license = SpdxExpression::parse(value).unwrap();
+                package.declared_license = Some(SpdxExpression::parse(value).unwrap());
             }
         }
         Atom::PackageLicenseComments(value) => {
@@ -372,7 +372,7 @@ fn process_atom_for_packages(
         }
         Atom::PackageCopyrightText(value) => {
             if let Some(package) = &mut package_in_progress {
-                package.copyright_text = value.clone();
+                package.copyright_text = Some(value.clone());
             }
         }
         Atom::PackageSummary(value) => {
@@ -461,7 +461,7 @@ fn process_atom_for_files(
         }
         Atom::LicenseConcluded(value) => {
             if let Some(file) = &mut file_in_progress {
-                file.concluded_license = SpdxExpression::parse(value).unwrap();
+                file.concluded_license = Some(SpdxExpression::parse(value).unwrap());
             }
         }
         Atom::LicenseInfoInFile(value) => {
@@ -477,7 +477,7 @@ fn process_atom_for_files(
         }
         Atom::FileCopyrightText(value) => {
             if let Some(file) = &mut file_in_progress {
-                file.copyright_text = value.clone();
+                file.copyright_text = Some(value.clone());
             }
         }
         Atom::FileNotice(value) => {
@@ -533,7 +533,7 @@ fn process_atom_for_snippets(
         }
         Atom::SnippetLicenseConcluded(value) => {
             if let Some(snippet) = &mut snippet_in_progress {
-                snippet.snippet_concluded_license = SpdxExpression::parse(value).unwrap();
+                snippet.snippet_concluded_license = Some(SpdxExpression::parse(value).unwrap());
             }
         }
         Atom::LicenseInfoInSnippet(value) => {
@@ -550,7 +550,7 @@ fn process_atom_for_snippets(
         }
         Atom::SnippetCopyrightText(value) => {
             if let Some(snippet) = &mut snippet_in_progress {
-                snippet.snippet_copyright_text = value.to_string();
+                snippet.snippet_copyright_text = Some(value.to_string());
             }
         }
         Atom::SnippetComment(value) => {
@@ -850,7 +850,7 @@ compatible system run time libraries."
             Some("uses glibc-2_11-branch from git://sourceware.org/git/glibc.git.".to_string())
         );
         assert_eq!(
-            glibc.concluded_license.identifiers(),
+            glibc.concluded_license.as_ref().unwrap().identifiers(),
             HashSet::from_iter(["LGPL-2.0-only".to_string(), "LicenseRef-3".to_string()])
         );
         assert_eq!(
@@ -858,11 +858,14 @@ compatible system run time libraries."
             vec!["GPL-2.0-only", "LicenseRef-2", "LicenseRef-1"]
         );
         assert_eq!(
-            glibc.declared_license.identifiers(),
+            glibc.declared_license.as_ref().unwrap().identifiers(),
             HashSet::from_iter(["LGPL-2.0-only".to_string(), "LicenseRef-3".to_string()])
         );
         assert_eq!(glibc.comments_on_license, Some("The license for this project changed with the release of version x.y.  The version of the project included here post-dates the license change.".to_string()));
-        assert_eq!(glibc.copyright_text, "Copyright 2008-2010 John Smith");
+        assert_eq!(
+            glibc.copyright_text.as_ref().unwrap().clone(),
+            "Copyright 2008-2010 John Smith"
+        );
         assert_eq!(
             glibc.package_summary_description,
             Some("GNU C library.".to_string())
@@ -925,7 +928,7 @@ This information was found in the COPYING.txt file in the xyz directory.".to_str
             ]
         );
         assert_eq!(
-            fooc.concluded_license.identifiers(),
+            fooc.concluded_license.as_ref().unwrap().identifiers(),
             HashSet::from_iter(["LGPL-2.0-only".to_string(), "LicenseRef-2".to_string(),])
         );
         assert_eq!(
@@ -937,7 +940,7 @@ This information was found in the COPYING.txt file in the xyz directory.".to_str
         );
         assert_eq!(fooc.comments_on_license, Some("The concluded license was taken from the package level that the file was included in.".to_string()));
         assert_eq!(
-            fooc.copyright_text,
+            fooc.copyright_text.as_ref().unwrap().clone(),
             "Copyright 2008-2010 John Smith".to_string()
         );
         assert_eq!(
@@ -997,13 +1000,13 @@ THE SOFTWARE IS PROVIDED �AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMP
             .iter()
             .any(|snip| snip.end_pointer == Pointer::new_line(None, 23)));
         assert_eq!(
-            snippet.snippet_concluded_license,
+            snippet.snippet_concluded_license.unwrap(),
             SpdxExpression::parse("GPL-2.0-only").unwrap()
         );
         assert_eq!(snippet.license_information_in_snippet, vec!["GPL-2.0-only"]);
         assert_eq!(snippet.snippet_comments_on_license, Some("The concluded license was taken from package xyz, from which the snippet was copied into the current file. The concluded license information was found in the COPYING.txt file in package xyz.".to_string()));
         assert_eq!(
-            snippet.snippet_copyright_text,
+            snippet.snippet_copyright_text.as_ref().unwrap().clone(),
             "Copyright 2008-2010 John Smith"
         );
         assert_eq!(snippet.snippet_comment, Some("This snippet was identified as significant and highlighted in this Apache-2.0 file, when a commercial scanner identified it as being derived from file foo.c in package xyz which is licensed under GPL-2.0.".to_string()));
diff --git a/vendor/spdx-rs/src/parsers/tag_value.rs b/vendor/spdx-rs/src/parsers/tag_value.rs
index 765348d2f..16859a2dc 100644
--- a/vendor/spdx-rs/src/parsers/tag_value.rs
+++ b/vendor/spdx-rs/src/parsers/tag_value.rs
@@ -60,6 +60,10 @@ pub(super) enum Atom {
     ExternalRef(ExternalPackageReference),
     ExternalRefComment(String),
     PackageAttributionText(String),
+    PrimaryPackagePurpose(String),
+    BuiltDate(String),
+    ReleaseDate(String),
+    ValidUntilDate(String),
 
     // File Information
     FileName(String),
@@ -168,6 +172,10 @@ fn tag_value_to_atom(i: &str) -> IResult<&str, Atom, VerboseError<&str>> {
         )),
         "ExternalRefComment" => Ok((i, Atom::ExternalRefComment(key_value.1.to_string()))),
         "PackageAttributionText" => Ok((i, Atom::PackageAttributionText(key_value.1.to_string()))),
+        "PrimaryPackagePurpose" => Ok((i, Atom::PrimaryPackagePurpose(key_value.1.to_string()))),
+        "BuiltDate" => Ok((i, Atom::BuiltDate(key_value.1.to_string()))),
+        "ReleaseDate" => Ok((i, Atom::ReleaseDate(key_value.1.to_string()))),
+        "ValidUntilDate" => Ok((i, Atom::ValidUntilDate(key_value.1.to_string()))),
 
         // File Information
         "FileName" => Ok((i, Atom::FileName(key_value.1.to_string()))),
@@ -329,6 +337,8 @@ fn relationship(i: &str) -> IResult<&str, Relationship, VerboseError<&str>> {
                 "AMENDS" => RelationshipType::Amends,
                 "PREREQUISITE_FOR" => RelationshipType::PrerequisiteFor,
                 "HAS_PREREQUISITE" => RelationshipType::HasPrerequisite,
+                "SPECIFICATION_FOR" => RelationshipType::SpecificationFor,
+                "REQUIREMENT_DESCRIPTION_FOR" => RelationshipType::RequirementDescriptionFor,
                 "OTHER" => RelationshipType::Other,
                 // TODO: Proper error.
                 _ => {
@@ -413,6 +423,14 @@ fn checksum(i: &str) -> IResult<&str, Checksum, VerboseError<&str>> {
                 "MD4" => Algorithm::MD4,
                 "MD5" => Algorithm::MD5,
                 "MD6" => Algorithm::MD6,
+                "SHA3-256" => Algorithm::SHA3256,
+                "SHA3-384" => Algorithm::SHA3384,
+                "SHA3-512" => Algorithm::SHA3512,
+                "BLAKE2b-256" => Algorithm::BLAKE2B256,
+                "BLAKE2b-384" => Algorithm::BLAKE2B384,
+                "BLAKE2b-512" => Algorithm::BLAKE2B512,
+                "BLAKE3" => Algorithm::BLAKE3,
+                "ADLER32" => Algorithm::ADLER32,
                 // TODO: Use proper error.
                 _ => todo!(),
             };