spdx / spdx/spdx-java-tagvalue-store
tools-python and tools-java behave differently
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 3
- Forks
- 1
- Avg merge
- 4d 6h
- Merged PRs (30d)
- 3
Description
Greetings, I used the attached tag:value SBOM and found that VALIDATE was NG in tools-python and VALIDATE was OK in tools-java.
Which VALIDATE is correct?
What is unique about this SBOM is the presence of “FilesAnalyzed: false” on line 28 in the Relationships block.
> java -jar tools-java-2.0.0-RC1-jar-with-dependencies.jar Verify test-sbom.spdx
This SPDX Document is valid.
> pip install spdx-tools==0.8.3
> pyspdxtools -i test-sbom.spdx
Generating LALR tables
ERROR:root:There have been issues while parsing the provided document:
Element Package is not the current element in scope, probably the expected tag to start the element (PackageName) is missing. Line: 28
Sincerely,
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the attached test-sbom.spdx.txt, especially line 28 in the Relationships block, and reproduce the discrepancy using the Java Verify command and the Python pyspdxtools command shown. Compare both results with the SPDX tag/value rules for FilesAnalyzed: false, then determine which validation behavior is correct and record the expected outcome for the affected tool.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, python
- Domain
- devtools, testing-qa
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100