spdx / spdx/spdx-java-jackson-store
Multiple DESCRIBES relationships are not validated consistently
Nobody has claimed this yet.
- #45 by @goneall — closed without merging
- Dominant language
- Java
- Stars
- 7
- Forks
- 9
- Avg merge
- 16h 42m
- Merged PRs (30d)
- 9
Description
Not sure whether this is a tools-java or spdx-java-library issue. I generate a document using the following method:
public static void buildDocument() throws InvalidSPDXAnalysisException, IOException {
var modelStore = new MultiFormatStore(new InMemSpdxStore(), MultiFormatStore.Format.XML, MultiFormatStore.Verbose.COMPACT);
var documentUri = "https://some.namespace";
var copyManager = new ModelCopyManager();
var document = SpdxModelFactory.createSpdxDocument(modelStore, documentUri, copyManager);
document.setName("document name");
var sha1Checksum = Checksum.create(modelStore, documentUri, ChecksumAlgorithm.SHA1, "d6a770ba38583ed4bb4525bd96e50461655d2758");
var fileA = document.createSpdxFile("SPDXRef-fileA", "./fileA.c", null,
List.of(), null, sha1Checksum)
.build();
document.getDocumentDescribes().add(fileA);
document.addRelationship(
document.createRelationship(
fileA, RelationshipType.DESCRIBES, null
)
);
assert document.verify().isEmpty();
modelStore.serialize(documentUri, new FileOutputStream("temp.xml"));
}
Note the assert statement that indicates that the generated document is valid.
The above yields the following output in temp.xml:
<?xml version='1.0' encoding='UTF-8'?>
<Document>
<SPDXID>SPDXRef-DOCUMENT</SPDXID>
<spdxVersion>SPDX-2.3</spdxVersion>
<creationInfo>
<created>2022-10-13T12:37:44Z</created>
<creators>Tool: SPDX Tools</creators>
<licenseListVersion>3.18</licenseListVersion>
</creationInfo>
<name>document name</name>
<dataLicense>CC0-1.0</dataLicense>
<documentDescribes>SPDXRef-fileA</documentDescribes>
<documentNamespace>https://some.namespace</documentNamespace>
<files>
<SPDXID>SPDXRef-fileA</SPDXID>
<checksums>
<algorithm>SHA1</algorithm>
<checksumValue>d6a770ba38583ed4bb4525bd96e50461655d2758</checksumValue>
</checksums>
<fileName>./fileA.c</fileName>
</files>
<relationships>
<spdxElementId>SPDXRef-DOCUMENT</spdxElementId>
<relationshipType>DESCRIBES</relationshipType>
<relatedSpdxElement>SPDXRef-fileA</relatedSpdxElement>
</relationships>
</Document>
But now, when I call
java -jar tools-java-1.1.1-jar-with-dependencies.jar Verify temp.xml
I get the following error:
Analysis exception processing SPDX file: Relationships are expected to be in an array for type Relationship
Thus, the tools-java and spdx-java-library Verify methods seem to contradict each other.
This also raises the question of the value of a DESCRIBES relationship when the tag documentDescribes already exists.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the example with tools-java's Verify command and the spdx-java-library document.verify() call, using the generated temp.xml. Compare how each path validates the DESCRIBES relationship and documentDescribes entry; done means the validation behavior is consistent and the intended role of both representations is clarified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100