feat: update syft license concept to complex struct

[spiffcs]

Summary

Syft currently represents licenses for packages as part of an individual packages metadata (uncommon type). It also limits the expression of licenses as single string values. This metadata approach combined with the limited expression opportunities afforded by a string representation make it hard for downstream intuition tooling to parse, read, and evaluate license compliance for individual packages. Not every string is guaranteed to be a valid SPDX expression, and not every string at this point is guaranteed to be a valid license.

This PR attempts to make the following changes to update the underlying license model to have more expressive capabilities, while also providing some guarantee's surrounding the license values themselves:

• Licenses are updated from string -> pkg.License struct with the following fields:
  • Value required
    • declared value pulled from the original source of the discovered packages license
    • This will make it easier for us to find where/how junk licenses are being pulled from
  • SPDXExpression optional
    • If it's possible to construct, this field will always contain a valid SPDX expression for downstream consumption
    • Downstream consumers can use this field as the basis for parsing SPDX expressions to grab the individual licenses
  • Type required
    • SPDX concluded vs declared
  • URL optional
    • URL source of declared/concluded license of online query was used
  • Location optional
    • syft's internal location representation showing the evidence of WHERE a license was discovered

Implementation Notes

• Validate SPDX expressions and make licenses immutable on package creation
• Remove Licenses data from individual metadata types and make it a first class field on Package
• Use https://github.com/github/go-spdx for spdx expression/license validation for SPDXExpression field
• Update catalogers to no longer use metadata as a pass through and instead build more complex constructors for individual package catalogers
• Update SPDX && CycloneDX presenters to no longer need to validate/mutate License data (this should be handled at the individual package level)

Schema Diff Notes

62,64d61
<         "license": {
<           "type": "string"
<         },
96d92
<         "license",
139,141d134
<           "type": "string"
<         },
<         "license": {
190d182
<         "license",
607,612d598
<         "licenses": {
<           "items": {
<             "type": "string"
<           },
<           "type": "array"
<         },
753a740,765
>     "License": {
>       "properties": {
>         "value": {
>           "type": "string"
>         },
>         "spdx-expression": {
>           "type": "string"
>         },
>         "type": {
>           "type": "string"
>         },
>         "url": {
>           "type": "string"
>         },
>         "location": {
>           "$ref": "#/$defs/Location"
>         }
>       },
>       "type": "object",
>       "required": [
>         "value",
>         "spdx-expression",
>         "type",
>         "url"
>       ]
>     },
984,989d995
<         "licenses": {
<           "items": {
<             "type": "string"
<           },
<           "type": "array"
<         },
1008d1013
<         "licenses",
1055c1060
<             "type": "string"
---
>             "$ref": "#/$defs/License"
1263a1269,1274
>         },
>         "license": {
>           "items": {
>             "type": "string"
>           },
>           "type": "array"
1272,1277d1282
<           "items": {
<             "type": "string"
<           },
<           "type": "array"
<         },
<         "license": {
1492,1494d1496
<         "license": {
<           "type": "string"
<         },
1527d1528
<         "license",
1625,1627d1625
<         "license": {
<           "type": "string"
<         },
1650d1647
<         "license",

[github-actions]

Benchmark Test Results

Benchmark results from the latest changes vs base branch

goos: linux%0Agoarch: amd64%0Apkg: github.com/anchore/syft/test/integration%0Acpu: Intel(R) Xeon(R) Platinum 8370C CPU @ 2.80GHz%0A                                                          │ ./.tmp/benchmark-b0a90fb.txt │%0A                                                          │            sec/op            │%0AImagePackageCatalogers/alpmdb-cataloger-2                                   11.90m ±  1%25%0AImagePackageCatalogers/apkdb-cataloger-2                                    634.4µ ±  1%25%0AImagePackageCatalogers/binary-cataloger-2                                   215.4µ ±  1%25%0AImagePackageCatalogers/dpkgdb-cataloger-2                                   546.0µ ±  1%25%0AImagePackageCatalogers/dotnet-deps-cataloger-2                              1.215m ±  3%25%0AImagePackageCatalogers/go-module-binary-cataloger-2                         92.21µ ±  0%25%0AImagePackageCatalogers/java-cataloger-2                                     12.91m ± 19%25%0AImagePackageCatalogers/graalvm-native-image-cataloger-2                     91.64µ ±  0%25%0AImagePackageCatalogers/javascript-package-cataloger-2                       369.4µ ±  1%25%0AImagePackageCatalogers/nix-store-cataloger-2                                256.5µ ±  3%25%0AImagePackageCatalogers/php-composer-installed-cataloger-2                   734.0µ ±  1%25%0AImagePackageCatalogers/portage-cataloger-2                                  412.4µ ±  1%25%0AImagePackageCatalogers/python-package-cataloger-2                           3.143m ±  1%25%0AImagePackageCatalogers/r-package-cataloger-2                                178.2µ ±  1%25%0AImagePackageCatalogers/rpm-db-cataloger-2                                   469.3µ ±  2%25%0AImagePackageCatalogers/ruby-gemspec-cataloger-2                             847.6µ ±  0%25%0AImagePackageCatalogers/sbom-cataloger-2                                     118.0µ ±  1%25%0Ageomean                                                                     577.6µ%0A%0A                                                          │ ./.tmp/benchmark-b0a90fb.txt │%0A                                                          │             B/op             │%0AImagePackageCatalogers/alpmdb-cataloger-2                                   5.129Mi ± 0%25%0AImagePackageCatalogers/apkdb-cataloger-2                                    175.3Ki ± 0%25%0AImagePackageCatalogers/binary-cataloger-2                                   32.08Ki ± 0%25%0AImagePackageCatalogers/dpkgdb-cataloger-2                                   169.1Ki ± 0%25%0AImagePackageCatalogers/dotnet-deps-cataloger-2                              404.2Ki ± 0%25%0AImagePackageCatalogers/go-module-binary-cataloger-2                         10.06Ki ± 0%25%0AImagePackageCatalogers/java-cataloger-2                                     2.829Mi ± 0%25%0AImagePackageCatalogers/graalvm-native-image-cataloger-2                     8.750Ki ± 0%25%0AImagePackageCatalogers/javascript-package-cataloger-2                       101.1Ki ± 0%25%0AImagePackageCatalogers/nix-store-cataloger-2                                49.15Ki ± 0%25%0AImagePackageCatalogers/php-composer-installed-cataloger-2                   186.5Ki ± 0%25%0AImagePackageCatalogers/portage-cataloger-2                                  120.0Ki ± 0%25%0AImagePackageCatalogers/python-package-cataloger-2                           1.005Mi ± 0%25%0AImagePackageCatalogers/r-package-cataloger-2                                53.38Ki ± 0%25%0AImagePackageCatalogers/rpm-db-cataloger-2                                   181.2Ki ± 0%25%0AImagePackageCatalogers/ruby-gemspec-cataloger-2                             144.4Ki ± 0%25%0AImagePackageCatalogers/sbom-cataloger-2                                     14.21Ki ± 0%25%0Ageomean                                                                     132.3Ki%0A%0A                                                          │ ./.tmp/benchmark-b0a90fb.txt │%0A                                                          │          allocs/op           │%0AImagePackageCatalogers/alpmdb-cataloger-2                                    87.75k ± 0%25%0AImagePackageCatalogers/apkdb-cataloger-2                                     4.087k ± 0%25%0AImagePackageCatalogers/binary-cataloger-2                                     896.0 ± 0%25%0AImagePackageCatalogers/dpkgdb-cataloger-2                                    3.000k ± 0%25%0AImagePackageCatalogers/dotnet-deps-cataloger-2                               6.338k ± 0%25%0AImagePackageCatalogers/go-module-binary-cataloger-2                           281.0 ± 0%25%0AImagePackageCatalogers/java-cataloger-2                                      39.81k ± 0%25%0AImagePackageCatalogers/graalvm-native-image-cataloger-2                       228.0 ± 0%25%0AImagePackageCatalogers/javascript-package-cataloger-2                        1.405k ± 0%25%0AImagePackageCatalogers/nix-store-cataloger-2                                  895.0 ± 0%25%0AImagePackageCatalogers/php-composer-installed-cataloger-2                    4.079k ± 0%25%0AImagePackageCatalogers/portage-cataloger-2                                   2.267k ± 0%25%0AImagePackageCatalogers/python-package-cataloger-2                            16.43k ± 0%25%0AImagePackageCatalogers/r-package-cataloger-2                                  928.0 ± 0%25%0AImagePackageCatalogers/rpm-db-cataloger-2                                    3.989k ± 0%25%0AImagePackageCatalogers/ruby-gemspec-cataloger-2                              2.447k ± 0%25%0AImagePackageCatalogers/sbom-cataloger-2                                       394.0 ± 0%25%0Ageomean                                                                      2.590k

[wagoodman]

fantastic addition! 🙌