fix: add support for license detection

Currently, we are not adding license information into files under a
package.

Also add detection for debian packages.

Signed-off-by: Ramkumar Chinchani <rchincha@cisco.com>

pkg/distro/apk/apk.go

@@ -246,7 +246,7 @@ func InstalledPackage(doc *spdx.Document, pkg *IndexEntry, files []string) error
 			Msg("file entry detected")
 
 		sfile := spdx.NewFile()
-		sfile.LicenseInfoInFile = "unknown"
+		sfile.LicenseInfoInFile = pkg.PackageLicense
 		sfile.SetEntity(
 			&spdx.Entity{
 				Name: file,

pkg/distro/deb/deb.go

@@ -21,6 +21,8 @@ import (
 	"stackerbuild.io/stacker-bom/pkg/buildgen"
 )
 
+const unknownLicense = "unknown"
+
 // ParsePackage given a deb pkg emits a sbom.
 func ParsePackage(input, output, author, organization, license string) error {
 	debfile, _, err := deb.LoadFile(input)
@@ -273,6 +275,8 @@ func InstalledPackages(doc *spdx.Document) error {
 }
 
 func InstalledPackage(doc *spdx.Document, pkg Package, path string) error {
+	license := unknownLicense
+
 	spkg := &spdx.Package{
 		Entity: spdx.Entity{
 			Name: pkg.Package,
@@ -285,7 +289,7 @@ func InstalledPackage(doc *spdx.Document, pkg Package, path string) error {
 			Person: pkg.Maintainer,
 		},
 		FilesAnalyzed:   true,
-		LicenseDeclared: "unknown",
+		LicenseDeclared: license,
 	}
 
 	fhandle, err := os.Open(path)
@@ -338,7 +342,7 @@ func InstalledPackage(doc *spdx.Document, pkg Package, path string) error {
 			Msg("file entry detected")
 
 		sfile := spdx.NewFile()
-		sfile.LicenseInfoInFile = "unknown"
+		sfile.LicenseInfoInFile = unknownLicense
 		sfile.SetEntity(
 			&spdx.Entity{
 				Name: line,
@@ -366,9 +370,16 @@ func InstalledPackage(doc *spdx.Document, pkg Package, path string) error {
 			}
 
 			spkg.CopyrightText = string(buf)
+			license = getSpdxLicense(string(buf))
 		}
 	}
 
+	spkg.LicenseDeclared = license
+
+	for _, file := range spkg.Files() {
+		file.LicenseInfoInFile = license
+	}
+
 	if err := doc.AddPackage(spkg); err != nil {
 		log.Error().Err(err).Msg("unable to add package to doc")