Validate Custom JSON-LD Context
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 101
- Forks
- 46
- Avg merge
- 9h 43m
- Merged PRs (30d)
- 8
Description
According to the Serialization Information section in the SPDX 3.0.1 spec serializing NamespaceMaps within the @context field for JSON-LD serializations is valid.
When serializing a physical SpdxDocument, any property of the logical element that can be natively represented within the chosen serialization format (e.g.,
@contextprefixes in JSON-LD instead of the namespaceMap) may utilize these native mechanisms. All remaining properties shall be serialized within the SpdxDocument element itself.
[...]
Additional namespace mappings may be defined within a separate object within the context.
The java spdx tools however do not currently support this.
Take for example the following document: sbom-output.spdx.json
export SPDX_TOOLS_VERSION=2.0.2
curl -sLO "https://github.com/spdx/tools-java/releases/download/v${SPDX_TOOLS_VERSION}/tools-java-${SPDX_TOOLS_VERSION}.zip"
unzip -j "tools-java-${SPDX_TOOLS_VERSION}.zip" "tools-java-${SPDX_TOOLS_VERSION}-jar-with-dependencies.jar"
java -jar "tools-java-${SPDX_TOOLS_VERSION}-jar-with-dependencies.jar" Verify "sbom-output.spdx.json"
The java tools fail with
This SPDX Document is not valid due to:
$.@context: must be the constant value 'https://spdx.org/rdf/3.0.1/spdx-context.jsonld'
even though the document should be valid.
An easy way to fix this would be to expand the custom context before processing the SPDX document.
See for example expand-custom-context.sh
./expand-custom-context.sh sbom-output.spdx.json
This small script expands the custom context and outputs expanded-sbom-output.spdx.json which successfully gets validated by the java tools.
java -jar "tools-java-${SPDX_TOOLS_VERSION}-jar-with-dependencies.jar" Verify "expanded-sbom-output.spdx.json"
This SPDX Document is valid.
It would be helpful if this behavior could be supported directly by the java-tools.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Run the Verify command from the issue against sbom-output.spdx.json, then compare it with expanded-sbom-output.spdx.json produced by expand-custom-context.sh. Start at the Verify command's JSON-LD context validation and determine how custom context mappings should be handled; done means the original document validates without requiring the external expansion script.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- cli, tooling
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100