@cyclonedx/cdxgen 9.9.0 → 9.9.2

package/README.md

@@ -2,7 +2,7 @@
 
 ![cdxgen logo](cdxgen.png)
 
-cdxgen is a cli tool, library, [REPL](./ADVANCED.md), and server to create a valid and compliant [CycloneDX][cyclonedx-homepage] Software Bill of Materials (SBOM) containing an aggregate of all project dependencies for c/c++, node.js, php, python, ruby, rust, java, .Net, dart, haskell, elixir, and Go projects in JSON format. CycloneDX 1.5 is a lightweight SBOM specification that is easily created, human and machine-readable, and simple to parse.
+cdxgen is a CLI tool, library, [REPL](./ADVANCED.md), and server to create a valid and compliant [CycloneDX][cyclonedx-homepage] Software Bill of Materials (SBOM) containing an aggregate of all project dependencies for C/C++, Node.js, PHP, Python, Ruby, Rust, Java, .Net, Dart, Haskell, Elixir, and Go projects in JSON format. CycloneDX 1.5 is a lightweight SBOM specification that is easily created, human and machine-readable, and simple to parse.
 
 When used with plugins, cdxgen could generate an OBOM for Linux docker images and even VMs running Linux or Windows operating systems. cdxgen also includes an evinse tool to generate component evidence and SaaSBOM for some languages.
 
@@ -20,21 +20,21 @@ Most SBOM tools are like barcode scanners. They can scan a few package manifest
 
 | Language/Platform               | Package format                                                                                                    | Transitive dependencies                                                                           | Evidence |
 | ------------------------------- | ----------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------- | -------- |
-| node.js                         | npm-shrinkwrap.json, package-lock.json, pnpm-lock.yaml, yarn.lock, rush.js, bower.json, .min.js                   | Yes except .min.js                                                                                | Yes      |
-| java                            | maven (pom.xml [1]), gradle (build.gradle, .kts), scala (sbt), bazel                                              | Yes unless pom.xml is manually parsed due to unavailability of maven or errors                    | Yes      |
-| php                             | composer.lock                                                                                                     | Yes                                                                                               |          |
-| python                          | pyproject.toml, setup.py, requirements.txt [2], Pipfile.lock, poetry.lock, pdm.lock, bdist_wheel, .whl, .egg-info | Yes using the automatic pip install/freeze. When disabled, only with Pipfile.lock and poetry.lock | Yes      |
-| go                              | binary, go.mod, go.sum, Gopkg.lock                                                                                | Yes except binary                                                                                 | Yes      |
-| ruby                            | Gemfile.lock, gemspec                                                                                             | Only for Gemfile.lock                                                                             |          |
-| rust                            | binary, Cargo.toml, Cargo.lock                                                                                    | Only for Cargo.lock                                                                               |          |
+| Node.js                         | npm-shrinkwrap.json, package-lock.json, pnpm-lock.yaml, yarn.lock, rush.js, bower.json, .min.js                   | Yes except .min.js                                                                                | Yes      |
+| Java                            | maven (pom.xml [1]), gradle (build.gradle, .kts), scala (sbt), bazel                                              | Yes unless pom.xml is manually parsed due to unavailability of maven or errors                    | Yes      |
+| PHP                             | composer.lock                                                                                                     | Yes                                                                                               |          |
+| Python                          | pyproject.toml, setup.py, requirements.txt [2], Pipfile.lock, poetry.lock, pdm.lock, bdist_wheel, .whl, .egg-info | Yes using the automatic pip install/freeze. When disabled, only with Pipfile.lock and poetry.lock | Yes      |
+| Go                              | binary, go.mod, go.sum, Gopkg.lock                                                                                | Yes except binary                                                                                 | Yes      |
+| Ruby                            | Gemfile.lock, gemspec                                                                                             | Only for Gemfile.lock                                                                             |          |
+| Rust                            | binary, Cargo.toml, Cargo.lock                                                                                    | Only for Cargo.lock                                                                               |          |
 | .Net                            | .csproj, packages.config, project.assets.json [3], packages.lock.json, .nupkg, paket.lock                         | Only for project.assets.json, packages.lock.json, paket.lock                                      |          |
-| dart                            | pubspec.lock, pubspec.yaml                                                                                        | Only for pubspec.lock                                                                             |          |
-| haskell                         | cabal.project.freeze                                                                                              | Yes                                                                                               |          |
-| elixir                          | mix.lock                                                                                                          | Yes                                                                                               |          |
-| c/c++/Objective C/c++11         | conan.lock, conanfile.txt, \*.cmake, CMakeLists.txt, meson.build, codebase without package managers!              | Yes only for conan.lock. Best effort basis for cmake without version numbers.                     | Yes      |
-| clojure                         | Clojure CLI (deps.edn), Leiningen (project.clj)                                                                   | Yes unless the files are parsed manually due to lack of clojure cli or leiningen command          |          |
-| swift                           | Package.resolved, Package.swift (swiftpm)                                                                         | Yes                                                                                               |          |
-| docker / oci image              | All supported languages. Linux OS packages with plugins [4]                                                       | Best effort based on lock files                                                                   | Yes      |
+| Dart                            | pubspec.lock, pubspec.yaml                                                                                        | Only for pubspec.lock                                                                             |          |
+| Haskell                         | cabal.project.freeze                                                                                              | Yes                                                                                               |          |
+| Elixir                          | mix.lock                                                                                                          | Yes                                                                                               |          |
+| C/C++/Objective C/C++11         | conan.lock, conanfile.txt, \*.cmake, CMakeLists.txt, meson.build, codebase without package managers!              | Yes only for conan.lock. Best effort basis for cmake without version numbers.                     | Yes      |
+| Clojure                         | Clojure CLI (deps.edn), Leiningen (project.clj)                                                                   | Yes unless the files are parsed manually due to lack of clojure cli or leiningen command          |          |
+| Swift                           | Package.resolved, Package.swift (swiftpm)                                                                         | Yes                                                                                               |          |
+| Docker / oci image              | All supported languages. Linux OS packages with plugins [4]                                                       | Best effort based on lock files                                                                   | Yes      |
 | GitHub Actions                  | .github/workflows/\*.yml                                                                                          | N/A                                                                                               | Yes      |
 | Linux                           | All supported languages. Linux OS packages with plugins [5]                                                       | Best effort based on lock files                                                                   | Yes      |
 | Windows                         | All supported languages. OS packages with best effort [5]                                                         | Best effort based on lock files                                                                   | Yes      |
@@ -170,10 +170,7 @@ Options:
                                faults to true. Pass --no-validate to disable.
                                                        [boolean] [default: true]
       --evidence               Generate SBOM with evidence for supported languag
-                               es. WIP                [boolean] [default: false]
-      --usages-slices-file     Path for the usages slice file created by atom.
-      --data-flow-slices-file  Path for the data-flow slice file created by atom
-                               .
+                               es.                    [boolean] [default: false]
       --spec-version           CycloneDX Specification version to use. Defaults
                                to 1.5                             [default: 1.5]
       --filter                 Filter components containining this word in purl.
@@ -184,6 +181,10 @@ Options:
       --author                 The person(s) who created the BOM. Set this value
                                 if you're intending the modify the BOM and claim
                                 authorship.[array] [default: "OWASP Foundation"]
+      --profile                BOM profile to use for generation. Default generi
+                               c.
+  [choices: "appsec", "research", "operational", "threat-modeling", "license-com
+                                       pliance", "generic"] [default: "generic"]
       --auto-compositions      Automatically set compositions when the BOM was f
                                iltered. Defaults to true
                                                        [boolean] [default: true]
@@ -376,7 +377,7 @@ cdxgen can retain the dependency tree under the `dependencies` attribute for a s
 | SBOM_SIGN_ALGORITHM          | Signature algorithm. Some valid values are RS256, RS384, RS512, PS256, PS384, PS512, ES256 etc                                       |
 | SBOM_SIGN_PRIVATE_KEY        | Private key to use for signing                                                                                                       |
 | SBOM_SIGN_PUBLIC_KEY         | Optional. Public key to include in the SBOM signature                                                                                |
-| CDX_MAVEN_PLUGIN             | CycloneDX Maven plugin to use. Default "org.cyclonedx:cyclonedx-maven-plugin:2.7.8"                                                  |
+| CDX_MAVEN_PLUGIN             | CycloneDX Maven plugin to use. Default "org.cyclonedx:cyclonedx-maven-plugin:2.7.10"                                                 |
 | CDX_MAVEN_GOAL               | CycloneDX Maven plugin goal to use. Default makeAggregateBom. Other options: makeBom, makePackageBom                                 |
 | CDX_MAVEN_INCLUDE_TEST_SCOPE | Whether test scoped dependencies should be included from Maven projects, Default: true                                               |
 | ASTGEN_IGNORE_DIRS           | Comma separated list of directories to ignore while analyzing using babel. The environment variable is also used by atom and astgen. |
@@ -399,7 +400,7 @@ sudo npm install -g @cyclonedx/cdxgen-plugins-bin
 cdxgen odoo@sha256:4e1e147f0e6714e8f8c5806d2b484075b4076ca50490577cdf9162566086d15e -o /tmp/bom.json
 ```
 
-You can also pass `-t docker` for simple labels. Only the `latest` tag would be pulled if none was specified.
+You can also pass `-t docker` with repository names. Only the `latest` tag would be pulled if none was specified.
 
 ```shell
 cdxgen shiftleft/scan-slim -o /tmp/bom.json -t docker

package/bin/cdxgen.js

@@ -10,10 +10,18 @@ import crypto from "node:crypto";
 import { fileURLToPath } from "node:url";
 import globalAgent from "global-agent";
 import process from "node:process";
-import { printTable, printDependencyTree } from "../display.js";
+import {
+  printCallStack,
+  printOccurrences,
+  printServices,
+  printReachables,
+  printTable,
+  printDependencyTree
+} from "../display.js";
 import { findUpSync } from "find-up";
 import { load as _load } from "js-yaml";
 import { postProcess } from "../postgen.js";
+import { ATOM_DB } from "../utils.js";
 
 // Support for config files
 const configPath = findUpSync([
@@ -48,7 +56,14 @@ const args = yargs(hideBin(process.argv))
   .env("CDXGEN")
   .option("output", {
     alias: "o",
-    description: "Output file for bom.xml or bom.json. Default bom.json"
+    description: "Output file for bom.xml or bom.json. Default bom.json",
+    default: "bom.json"
+  })
+  .option("evinse-output", {
+    description:
+      "Create bom with evidence as a separate file. Default bom.json",
+    default: "bom.json",
+    hidden: true
   })
   .option("type", {
     alias: "t",
@@ -90,14 +105,17 @@ const args = yargs(hideBin(process.argv))
   })
   .option("project-version", {
     description: "Dependency track project version",
-    default: ""
+    default: "",
+    type: "string"
   })
   .option("project-id", {
     description:
-      "Dependency track project id. Either provide the id or the project name and version together"
+      "Dependency track project id. Either provide the id or the project name and version together",
+    type: "string"
   })
   .option("parent-project-id", {
-    description: "Dependency track parent project id"
+    description: "Dependency track parent project id",
+    type: "string"
   })
   .option("required-only", {
     type: "boolean",
@@ -143,20 +161,34 @@ const args = yargs(hideBin(process.argv))
       "Validate the generated SBOM using json schema. Defaults to true. Pass --no-validate to disable."
   })
   .option("evidence", {
-    hidden: true,
     type: "boolean",
     default: false,
-    description: "Generate SBOM with evidence for supported languages. WIP"
+    description: "Generate SBOM with evidence for supported languages."
+  })
+  .option("deps-slices-file", {
+    description: "Path for the parsedeps slice file created by atom.",
+    default: "deps.slices.json",
+    hidden: true
   })
   .option("usages-slices-file", {
-    description: "Path for the usages slice file created by atom."
+    description: "Path for the usages slices file created by atom.",
+    default: "usages.slices.json",
+    hidden: true
   })
   .option("data-flow-slices-file", {
-    description: "Path for the data-flow slice file created by atom."
+    description: "Path for the data-flow slices file created by atom.",
+    default: "data-flow.slices.json",
+    hidden: true
+  })
+  .option("reachables-slices-file", {
+    description: "Path for the reachables slices file created by atom.",
+    default: "reachables.slices.json",
+    hidden: true
   })
   .option("spec-version", {
     description: "CycloneDX Specification version to use. Defaults to 1.5",
-    default: 1.5
+    default: 1.5,
+    type: "number"
   })
   .option("filter", {
     description:
@@ -171,6 +203,18 @@ const args = yargs(hideBin(process.argv))
       "The person(s) who created the BOM. Set this value if you're intending the modify the BOM and claim authorship.",
     default: "OWASP Foundation"
   })
+  .option("profile", {
+    description: "BOM profile to use for generation. Default generic.",
+    default: "generic",
+    choices: [
+      "appsec",
+      "research",
+      "operational",
+      "threat-modeling",
+      "license-compliance",
+      "generic"
+    ]
+  })
   .completion("completion", "Generate bash/zsh completion")
   .array("filter")
   .array("only")
@@ -226,6 +270,32 @@ if (process.argv[1].includes("obom") && !args.type) {
   args.type = "os";
 }
 
+const applyProfile = (options) => {
+  switch (options.profile) {
+    case "appsec":
+      options.deep = true;
+      break;
+    case "research":
+      options.deep = true;
+      options.evidence = true;
+      process.env.CDX_MAVEN_INCLUDE_TEST_SCOPE = true;
+      process.env.ASTGEN_IGNORE_DIRS = "";
+      process.env.ASTGEN_IGNORE_FILE_PATTERN = "";
+      break;
+    case "operational":
+      options.projectType = options.projectType || "os";
+      break;
+    case "threat-modeling": // unused
+      break;
+    case "license-compliance":
+      process.env.FETCH_LICENSE = true;
+      break;
+    default:
+      break;
+  }
+  return options;
+};
+
 /**
  * Command line options
  */
@@ -233,8 +303,10 @@ const options = Object.assign({}, args, {
   projectType: args.type,
   multiProject: args.recurse,
   noBabel: args.noBabel || args.babel === false,
-  project: args.projectId
+  project: args.projectId,
+  deep: args.deep || args.evidence
 });
+applyProfile(options);
 
 /**
  * Check for node >= 20 permissions
@@ -273,7 +345,7 @@ const checkPermissions = (filePath) => {
  */
 (async () => {
   // Start SBOM server
-  if (args.server) {
+  if (options.server) {
     const serverModule = await import("../server.js");
     return serverModule.start(options);
   }
@@ -289,19 +361,16 @@ const checkPermissions = (filePath) => {
   if (options.requiredOnly || options["filter"] || options["only"]) {
     bomNSData = postProcess(bomNSData, options);
   }
-  if (!args.output) {
-    args.output = "bom.json";
-  }
   if (
-    args.output &&
-    (typeof args.output === "string" || args.output instanceof String)
+    options.output &&
+    (typeof options.output === "string" || options.output instanceof String)
   ) {
     if (bomNSData.bomXmlFiles) {
       console.log("BOM files produced:", bomNSData.bomXmlFiles);
     } else {
-      const jsonFile = args.output.replace(".xml", ".json");
+      const jsonFile = options.output.replace(".xml", ".json");
       // Create bom json file
-      if (!args.output.endsWith(".xml") && bomNSData.bomJson) {
+      if (!options.output.endsWith(".xml") && bomNSData.bomJson) {
         let jsonPayload = undefined;
         if (
           typeof bomNSData.bomJson === "string" ||
@@ -315,7 +384,7 @@ const checkPermissions = (filePath) => {
         }
         if (
           jsonPayload &&
-          (args.generateKeyAndSign ||
+          (options.generateKeyAndSign ||
             (process.env.SBOM_SIGN_ALGORITHM &&
               process.env.SBOM_SIGN_ALGORITHM !== "none" &&
               process.env.SBOM_SIGN_PRIVATE_KEY &&
@@ -328,7 +397,7 @@ const checkPermissions = (filePath) => {
           let privateKeyToUse = undefined;
           let jwkPublicKey = undefined;
           let publicKeyFile = undefined;
-          if (args.generateKeyAndSign) {
+          if (options.generateKeyAndSign) {
             const jdirName = dirname(jsonFile);
             publicKeyFile = join(jdirName, "public.key");
             const privateKeyFile = join(jdirName, "private.key");
@@ -438,8 +507,8 @@ const checkPermissions = (filePath) => {
         }
       }
       // Create bom xml file
-      if (args.output.endsWith(".xml") && bomNSData.bomXml) {
-        fs.writeFileSync(args.output, bomNSData.bomXml);
+      if (options.output.endsWith(".xml") && bomNSData.bomXml) {
+        fs.writeFileSync(options.output, bomNSData.bomXml);
       }
       //
       if (bomNSData.nsMapping && Object.keys(bomNSData.nsMapping).length) {
@@ -448,7 +517,7 @@ const checkPermissions = (filePath) => {
         console.log("Namespace mapping file written to", nsFile);
       }
     }
-  } else if (!args.print) {
+  } else if (!options.print) {
     if (bomNSData.bomJson) {
       console.log(JSON.stringify(bomNSData.bomJson, null, 2));
     } else if (bomNSData.bomXml) {
@@ -458,23 +527,58 @@ const checkPermissions = (filePath) => {
       console.log("Try running the command with -t <type> or -r argument");
     }
   }
+  // Evidence generation
+  if (options.evidence) {
+    const evinserModule = await import("../evinser.js");
+    const evinseOptions = {
+      _: args._,
+      input: options.output,
+      output: options.evinseOutput,
+      language: options.projectType || "java",
+      dbPath: process.env.ATOM_DB || ATOM_DB,
+      skipMavenCollector: false,
+      force: false,
+      withReachables: options.deep,
+      usagesSlicesFile: options.usagesSlicesFile,
+      dataFlowSlicesFile: options.dataFlowSlicesFile,
+      reachablesSlicesFile: options.reachablesSlicesFile
+    };
+    const dbObjMap = await evinserModule.prepareDB(evinseOptions);
+    if (dbObjMap) {
+      const sliceArtefacts = await evinserModule.analyzeProject(
+        dbObjMap,
+        evinseOptions
+      );
+      const evinseJson = evinserModule.createEvinseFile(
+        sliceArtefacts,
+        evinseOptions
+      );
+      bomNSData.bomJson = evinseJson;
+      if (options.print && evinseJson) {
+        printOccurrences(evinseJson);
+        printCallStack(evinseJson);
+        printReachables(sliceArtefacts);
+        printServices(evinseJson);
+      }
+    }
+  }
   // Perform automatic validation
-  if (args.validate) {
+  if (options.validate) {
     if (!validateBom(bomNSData.bomJson)) {
       process.exit(1);
     }
   }
   // Automatically submit the bom data
-  if (args.serverUrl && args.serverUrl != true && args.apiKey) {
+  if (options.serverUrl && options.serverUrl != true && options.apiKey) {
     try {
-      const dbody = await submitBom(args, bomNSData.bomJson);
+      const dbody = await submitBom(options, bomNSData.bomJson);
       console.log("Response from server", dbody);
     } catch (err) {
       console.log(err);
     }
   }
 
-  if (args.print && bomNSData.bomJson && bomNSData.bomJson.components) {
+  if (options.print && bomNSData.bomJson && bomNSData.bomJson.components) {
     printDependencyTree(bomNSData.bomJson);
     printTable(bomNSData.bomJson);
   }

package/bin/evinse.js

@@ -3,9 +3,7 @@
 // Evinse (Evinse Verification Is Nearly SBOM Evidence)
 import yargs from "yargs";
 import { hideBin } from "yargs/helpers";
-import { join } from "node:path";
 import fs from "node:fs";
-import { homedir, platform as _platform } from "node:os";
 import process from "node:process";
 import { analyzeProject, createEvinseFile, prepareDB } from "../evinser.js";
 import { validateBom } from "../validator.js";
@@ -15,6 +13,7 @@ import {
   printServices,
   printReachables
 } from "../display.js";
+import { ATOM_DB } from "../utils.js";
 import { findUpSync } from "find-up";
 import { load as _load } from "js-yaml";
 
@@ -38,22 +37,6 @@ if (configPath) {
   }
 }
 
-const isWin = _platform() === "win32";
-const isMac = _platform() === "darwin";
-let ATOM_DB = join(homedir(), ".local", "share", ".atomdb");
-if (isWin) {
-  ATOM_DB = join(homedir(), "AppData", "Local", ".atomdb");
-} else if (isMac) {
-  ATOM_DB = join(homedir(), "Library", "Application Support", ".atomdb");
-}
-
-if (!process.env.ATOM_DB && !fs.existsSync(ATOM_DB)) {
-  try {
-    fs.mkdirSync(ATOM_DB, { recursive: true });
-  } catch (e) {
-    // ignore
-  }
-}
 const args = yargs(hideBin(process.argv))
   .env("EVINSE")
   .option("input", {

package/data/frameworks-list.json

@@ -4,8 +4,8 @@
     "System.ServiceModel",
     "System.Data",
     "spring",
-    "flask",
-    "django",
+    "pkg:pypi/flask",
+    "pkg:pypi/django",
     "beego",
     "chi",
     "echo",
@@ -30,15 +30,33 @@
     "express",
     "knex",
     "vue",
-    "aiohttp",
-    "bottle",
-    "cherrypy",
-    "drt",
-    "falcon",
-    "hug",
-    "pyramid",
-    "sanic",
-    "tornado",
+    "pkg:pypi/aiohttp",
+    "pkg:pypi/bottle",
+    "pkg:pypi/cherrypy",
+    "pkg:pypi/drt",
+    "pkg:pypi/falcon",
+    "pkg:pypi/hug",
+    "pkg:pypi/pyramid",
+    "pkg:pypi/sanic",
+    "pkg:pypi/tornado",
+    "pkg:pypi/fastapi",
+    "pkg:pypi/pyqt",
+    "pkg:pypi/tkinter",
+    "pkg:pypi/kivy",
+    "pkg:pypi/pyside",
+    "pkg:pypi/scikit",
+    "pkg:pypi/tensorflow",
+    "pkg:pypi/pytorch",
+    "pkg:pypi/keras",
+    "pkg:pypi/numpy",
+    "pkg:pypi/scipy",
+    "pkg:pypi/pandas",
+    "pkg:pypi/matplotlib",
+    "pkg:pypi/google-api-core",
+    "pkg:pypi/google-cloud",
+    "pkg:pypi/botocore",
+    "pkg:pypi/boto3",
+    "pkg:pypi/azure",
     "vibora",
     "koa",
     "-sdk",

package/data/lic-mapping.json

@@ -2,12 +2,14 @@
   {
     "exp": "Apache-2.0",
     "names": [
+      "Apache2",
       "Apache 2",
       "Apache 2.0",
       "Apache Version 2.0",
       "Apache 2.0 License",
       "Apache Software License, Version 2.0",
       "The Apache Software License, Version 2.0",
+      "Apache License v2.0",
       "Apache License (v2.0)",
       "Apache License 2.0",
       "Apache License Version 2.0",
@@ -20,6 +22,9 @@
       "Apache-2.0 OR MIT",
       "Apache2.0",
       "apache-2-0",
+      "APL2",
+      "the Apache License, ASL Version 2.0",
+      "Apache Publich License 2.0",
       "https://opensource.org/licenses/Apache2.0",
       "https://opensource.org/license/apache-2-0",
       "http://www.apache.org/licenses/LICENSE-2.0.html"
@@ -27,7 +32,14 @@
   },
   {
     "exp": "0BSD",
-    "names": ["Zero-Clause BSD", "BSD", "BSD License", "BSD-like"]
+    "names": [
+      "Zero-Clause BSD",
+      "BSD",
+      "BSD License",
+      "BSD-like",
+      "new BSD License",
+      "new BSD"
+    ]
   },
   {
     "exp": "BSD-2-Clause",
@@ -37,7 +49,8 @@
       "BSD-2-Clause",
       "BSD 2-Clause License",
       "The BSD 2-Clause License",
-      "The 2-Clause BSD License"
+      "The 2-Clause BSD License",
+      "The BSD License"
     ]
   },
   {
@@ -46,6 +59,7 @@
       "BSD 3 Clause",
       "BSD 3-Clause",
       "BSD-3-Clause",
+      "BSD 3-clause",
       "BSD 3-Clause License",
       "The BSD 3-Clause License",
       "BSD 3-Clause \"New\" or \"Revised\" License (BSD-3-Clause)",
@@ -55,7 +69,8 @@
       "Revised BSD",
       "Revised BSD License",
       "The New BSD License",
-      "BSD (3-clause)"
+      "BSD (3-clause)",
+      "3-Clause BSD License"
     ]
   },
   {
@@ -70,6 +85,10 @@
       "BSD (4-clause)"
     ]
   },
+  {
+    "exp": "CC0-1.0",
+    "names": ["CC0"]
+  },
   {
     "exp": "CDDL-1.0",
     "names": [
@@ -151,6 +170,7 @@
       "LGPL v2.1",
       "LGPL-2.1",
       "LGPL2.1",
+      "LGPL, version 2.1",
       "GNU Lesser General Public License",
       "GNU Lesser General Public License Version 2.1",
       "GNU Lesser General Public License Version 2.1, February 1999",
@@ -270,7 +290,13 @@
   },
   {
     "exp": "MPL-2.0",
-    "names": ["MPL 2.0", "Mozilla Public License 2.0"]
+    "names": [
+      "MPL 2.0",
+      "Mozilla Public License 2.0",
+      "Mozilla Public License version 2.0",
+      "Mozilla Public License, version 2.0",
+      "Mozilla Public License 2.0 (MPL 2.0)"
+    ]
   },
   {
     "exp": "NetCDF",
@@ -282,6 +308,19 @@
   },
   {
     "exp": "ISC",
-    "names": ["ISC license"]
+    "names": ["ISC license", "ISC License (ISCL)"]
+  },
+  {
+    "exp": "ICU",
+    "names": ["Unicode/ICU License"]
+  },
+  {
+    "exp": "PSF-2.0",
+    "names": [
+      "Python Software Foundation License",
+      "Python Software Foundation License (PSFL)",
+      "Python Software Foundation License 2.0",
+      "PSFL"
+    ]
   }
 ]

package/data/pypi-pkg-aliases.json

@@ -553,6 +553,7 @@
   "creole": "python-creole",
   "creoleparser": "creoleparser",
   "crispy-forms": "django-crispy-forms",
+  "crum": "django-crum",
   "cronlog": "python-crontab",
   "crontab": "python-crontab",
   "crypto": "pycryptodome",
@@ -589,6 +590,7 @@
   "djcelery": "django-celery",
   "djkombu": "django-kombu",
   "djorm-pgarray": "djorm-ext-pgarray",
+  "django-filters": "filters-django",
   "dns": "dnspython",
   "docgen": "ansible-docgenerator",
   "docker": "docker-py",
@@ -631,6 +633,7 @@
   "fdpexpect": "pexpect",
   "fedora": "python-fedora",
   "fias": "ailove-django-fias",
+  "fieldsignals": "django-fieldsignals",
   "fiftyone-degrees": "51degrees-mobile-detector",
   "fiftyonedegrees": "51degrees-mobile-detector-v3-wrapper",
   "five": "five.customerize",
@@ -709,6 +712,7 @@
   "igraph": "python-igraph",
   "imdb": "imdbpy",
   "impala": "impyla",
+  "imagekit": "django-imagekit",
   "impersonate": "django-impersonate",
   "inmemorystorage": "ambition-inmemorystorage",
   "ipaddress": "backport-ipaddress",
@@ -845,6 +849,7 @@
   "path": "path.py",
   "patricia": "patricia-trie",
   "paver": "paver",
+  "packageurl": "packageurl-python",
   "peak": "proxytypes",
   "picasso": "anderson.picasso",
   "picklefield": "django-picklefield",
@@ -1057,6 +1062,7 @@
   "slugify": "unicode-slugify",
   "smarkets": "smk-python-sdk",
   "snappy": "ctypes-snappy",
+  "social-core": "social-auth-core",
   "social-django": "social-auth-app-django",
   "socketio": "python-socketio",
   "socketserver": "pies2overrides",