Invalid SPDX 3 generated when converting from SPDX 2 to SPDX 3
Open
Nobody has claimed this yet.
spdx-2.x
spdx-3.x
- Dominant language
- Java
- Stars
- 101
- Forks
- 46
- Avg merge
- 9h 43m
- Merged PRs (30d)
- 8
Description
zipp-3.23.1.spdx.json
zipp-3.23.1.spdx3.json
Converting zipp-3.23.1.spdx.json (SPDX 2) to zipp-3.23.1.spdx3.json (SPDX 3) with Java tools 2.0.6
Generated code is invalid according to https://github.com/JPEWdev/spdx3-validate
spdx3-validate --json zipp-3.23.1.spdx3.json
✔ Loading zipp-3.23.1.spdx3.json
✔ Loading SPDX 3.0.1
✔ Validating schema for zipp-3.23.1.spdx3.json
✖ Checking SHACL for zipp-3.23.1.spdx3.json
ERROR: SHACL Validation failed for zipp-3.23.1.spdx3.json:
Violation of type sh:ClassConstraintComponent:
Severity: sh:Violation
Source Shape:
@prefix sh: <http://www.w3.org/ns/shacl#> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
[] sh:class <https://spdx.org/rdf/3.0.1/terms/SimpleLicensing/AnyLicenseInfo> ;
sh:maxCount 1 ;
sh:nodeKind sh:IRI ;
sh:path <https://spdx.org/rdf/3.0.1/terms/Core/dataLicense> .
Focus Node: <https://pypi.org/spdx/zipp-3.23.1-specv3/document0>
Value Node: <http://spdx.org/licenses/CC0-1.0>
Result path: <https://spdx.org/rdf/3.0.1/terms/Core/dataLicense>
Message: Value does not have class <https://spdx.org/rdf/3.0.1/terms/SimpleLicensing/AnyLicenseInfo>
Violation of type sh:ClassConstraintComponent:
Severity: sh:Violation
Source Shape:
@prefix sh: <http://www.w3.org/ns/shacl#> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
[] sh:class <https://spdx.org/rdf/3.0.1/terms/Core/Element> ;
sh:minCount 1 ;
sh:nodeKind sh:IRI ;
sh:path <https://spdx.org/rdf/3.0.1/terms/Core/to> .
Focus Node: <https://pypi.org/spdx/zipp-3.23.1-specv3/SPDXRef-gnrtd6>
Value Node: <http://spdx.org/licenses/MIT>
Result path: <https://spdx.org/rdf/3.0.1/terms/Core/to>
Message: Value does not have class ns1:Element
Violation of type sh:ClassConstraintComponent:
Severity: sh:Violation
Source Shape:
@prefix sh: <http://www.w3.org/ns/shacl#> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
[] sh:class <https://spdx.org/rdf/3.0.1/terms/Core/Element> ;
sh:minCount 1 ;
sh:nodeKind sh:IRI ;
sh:path <https://spdx.org/rdf/3.0.1/terms/Core/to> .
Focus Node: <https://pypi.org/spdx/zipp-3.23.1-specv3/SPDXRef-gnrtd4>
Value Node: <http://spdx.org/licenses/MIT>
Result path: <https://spdx.org/rdf/3.0.1/terms/Core/to>
Message: Value does not have class ns1:Element
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the conversion with the attached zipp-3.23.1.spdx.json using Java tools 2.0.6, then run spdx3-validate --json on the generated SPDX 3 file. Trace the conversion paths responsible for dataLicense and Core/to values. Done means the converted document passes SPDX 3.0.1 schema and SHACL validation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- cli
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 58/100