spdx / spdx/tools-java

Invalid SPDX 3 generated when converting from SPDX 2 to SPDX 3

Open
#290 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

spdx-2.x spdx-3.x
Dominant language
Java
Stars
101
Forks
46
Avg merge
9h 43m
Merged PRs (30d)
8

Description

zipp-3.23.1.spdx.json
zipp-3.23.1.spdx3.json

Converting zipp-3.23.1.spdx.json (SPDX 2) to zipp-3.23.1.spdx3.json (SPDX 3) with Java tools 2.0.6

Generated code is invalid according to https://github.com/JPEWdev/spdx3-validate

spdx3-validate --json zipp-3.23.1.spdx3.json 
✔ Loading zipp-3.23.1.spdx3.json
✔ Loading SPDX 3.0.1
✔ Validating schema for zipp-3.23.1.spdx3.json
✖ Checking SHACL for zipp-3.23.1.spdx3.json
ERROR: SHACL Validation failed for zipp-3.23.1.spdx3.json:
Violation of type sh:ClassConstraintComponent:
	Severity: sh:Violation
	Source Shape:
		@prefix sh: <http://www.w3.org/ns/shacl#> .
		@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .

		[] sh:class <https://spdx.org/rdf/3.0.1/terms/SimpleLicensing/AnyLicenseInfo> ;
		    sh:maxCount 1 ;
		    sh:nodeKind sh:IRI ;
		    sh:path <https://spdx.org/rdf/3.0.1/terms/Core/dataLicense> .
	Focus Node: <https://pypi.org/spdx/zipp-3.23.1-specv3/document0>
	Value Node: <http://spdx.org/licenses/CC0-1.0>
	Result path: <https://spdx.org/rdf/3.0.1/terms/Core/dataLicense>
	Message: Value does not have class <https://spdx.org/rdf/3.0.1/terms/SimpleLicensing/AnyLicenseInfo>

Violation of type sh:ClassConstraintComponent:
	Severity: sh:Violation
	Source Shape:
		@prefix sh: <http://www.w3.org/ns/shacl#> .
		@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .

		[] sh:class <https://spdx.org/rdf/3.0.1/terms/Core/Element> ;
		    sh:minCount 1 ;
		    sh:nodeKind sh:IRI ;
		    sh:path <https://spdx.org/rdf/3.0.1/terms/Core/to> .
	Focus Node: <https://pypi.org/spdx/zipp-3.23.1-specv3/SPDXRef-gnrtd6>
	Value Node: <http://spdx.org/licenses/MIT>
	Result path: <https://spdx.org/rdf/3.0.1/terms/Core/to>
	Message: Value does not have class ns1:Element

Violation of type sh:ClassConstraintComponent:
	Severity: sh:Violation
	Source Shape:
		@prefix sh: <http://www.w3.org/ns/shacl#> .
		@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .

		[] sh:class <https://spdx.org/rdf/3.0.1/terms/Core/Element> ;
		    sh:minCount 1 ;
		    sh:nodeKind sh:IRI ;
		    sh:path <https://spdx.org/rdf/3.0.1/terms/Core/to> .
	Focus Node: <https://pypi.org/spdx/zipp-3.23.1-specv3/SPDXRef-gnrtd4>
	Value Node: <http://spdx.org/licenses/MIT>
	Result path: <https://spdx.org/rdf/3.0.1/terms/Core/to>
	Message: Value does not have class ns1:Element

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the conversion with the attached zipp-3.23.1.spdx.json using Java tools 2.0.6, then run spdx3-validate --json on the generated SPDX 3 file. Trace the conversion paths responsible for dataLicense and Core/to values. Done means the converted document passes SPDX 3.0.1 schema and SHACL validation.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
cli
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.