spdx / spdx/spdx-java-tagvalue-store
Is this valid SPDX?
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 3
- Forks
- 1
- Avg merge
- 4d 6h
- Merged PRs (30d)
- 3
Description
The attached file is adapted from SPDX in tag:value format generated by BlackDuck.
The Python tools tells that this is invalid SPDX.
pyspdxtools -i blackduck.spdx
ERROR:root:There have been issues while parsing the provided document:
Element Package is not the current element in scope, probably the expected tag to start the element (PackageName) is missing. Line: 26
I tend to agree with that, as the FilesAnalyzed clause does not follow the package.
But the Java tools say that the file is valid SPDX.
And the BlackDuck people claim that they cannot find something in the standard explaining why this is illegal.
So who is right?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the attached blackduck.spdx.txt and reproduce the pyspdxtools error at line 26, then compare its tag:value structure with the SPDX standard and the Java tools' parsing behavior. Done means determining whether FilesAnalyzed may precede the required package fields and documenting or correcting the conflicting validation result.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100