Case-Sensitive IRI as spdxId
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 101
- Forks
- 46
- Avg merge
- 9h 43m
- Merged PRs (30d)
- 8
Description
Hi,
using the tools-java in their 2.0.5 version I got an issue with duplicate spdxIds:
Analysis exception processing SPDX file: Object URI already exists.
Looking at the spdxIds I've notices that they are only identical if they are threaded case-insensitive. By specification the path of an URL should be case-sensitive.
This makes also sense as in fact the file exists twice in the Linux kernel includes the file twice with different content:
Simplified Examples:
https://spdx.example.com/doc-/packages/usr_lib_modules_kernel_net_netfilter_xt_hl_ko_a
https://spdx.example.com/doc-/packages/usr_lib_modules_kernel_net_netfilter_xt_HL_ko_a
In my eyes this is not an error but intended usage.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the duplicate-URI error from the issue using the two example spdxIds, then trace how tools-java handles URI identity and duplicate detection. Done means the differently cased paths are accepted as distinct while genuinely identical spdxIds still produce the expected behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- tooling
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100