Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Verify accepts SPDX 2.3 documents that violate normative MUST rules (document SPDXID, unique SPDXIDs, documentNamespace URI)

Aperta
  • Qualcosa non va?
#316 1 commento 1 reazione 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
55/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Tranquilla
Stack tecnologico
java
Ambito
cli, testing

Direzione di ricerca

Inizia dal percorso di validazione del comando Verify in tools-java e riproduci i due documenti JSON dell'issue utilizzando la release Java. Confronta i controlli per SPDXRef-DOCUMENT, gli SPDXIDs duplicati e documentNamespace assoluto con i requisiti di SPDX 2.3 e i risultati del validatore Python. Il lavoro è completato quando Verify segnala entrambi i documenti come non validi per le violazioni indicate.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

bug spdx-2.3 validation

Hi @goneall :) Hope you are doing well and having fun on all your adventures!

I came across some validation discrepancies (errors?) when comparing validation output between spdx-tools pyhon, java and the plain text spec. I am seeing the Verify command reports documents as "This SPDX Document is valid." even when they violate several normative MUST requirements of the SPDX 2.3 spec. The equivalent Python spdx-tools validator flags the same documents as invalid, so the two reference implementations disagree.

Specifically, Verify with the latest java release does not seem to enforce:

  • The document's SPDXID MUST be SPDXRef-DOCUMENT (§6.3)
  • Element ID uniqueness (i.e. the document identifier collides with a package identifier and is not reported) (§7.2)
  • documentNamespace MUST be an absolute URI (RFC-3986). (§6.5)

Reproduction 1 — non-URI documentNamespace (§6.5):

{"spdxVersion":"SPDX-2.3","dataLicense":"CC0-1.0","SPDXID":"SPDXRef-DOCUMENT","name":"x","documentNamespace":"not-a-uri","creationInfo":{"creators":["Tool: t"],"created":"1970-01-01T00:00:00Z"},"packages":[{"name":"a","SPDXID":"SPDXRef-a","downloadLocation":"NOASSERTION","filesAnalyzed":false}],"relationships":[{"spdxElementId":"SPDXRef-DOCUMENT","relationshipType":"DESCRIBES","relatedSpdxElement":"SPDXRef-a"}]}
$ java -jar tools-java-2.0.7-jar-with-dependencies.jar Verify b-namespace.spdx.json
This SPDX Document is valid.

Reproduction 2 — document SPDXID is not SPDXRef-DOCUMENT and duplicates a package ID (§6.3 + uniqueness):

{"spdxVersion":"SPDX-2.3","dataLicense":"CC0-1.0","SPDXID":"SPDXRef-a","name":"x","documentNamespace":"https://example.com/C","creationInfo":{"creators":["Tool: t"],"created":"1970-01-01T00:00:00Z"},"packages":[{"name":"a","SPDXID":"SPDXRef-a","downloadLocation":"NOASSERTION","filesAnalyzed":false}],"relationships":[{"spdxElementId":"SPDXRef-a","relationshipType":"DESCRIBES","relatedSpdxElement":"SPDXRef-a"}]}
$ java -jar tools-java-2.0.7-jar-with-dependencies.jar Verify c-dup-doc-pkg.spdx.json
This SPDX Document is valid.

Both documents should be reported as invalid. The 2.3 spec requires:

§6.3 SPDX identifier field — the document SPDXID value MUST be SPDXRef-DOCUMENT: https://spdx.github.io/spdx-spec/v2.3/document-creation-information/#63-spdx-identifier-field
§6.5 SPDX document namespace — MUST be a unique absolute URI with no fragment: https://spdx.github.io/spdx-spec/v2.3/document-creation-information/#65-spdx-document-namespace-field
§7.2 / element identifiers — each SPDXID MUST be unique within the document: https://spdx.github.io/spdx-spec/v2.3/package-information/#72-package-spdx-identifier-field

Running the python tools on the same files seems to yield more expected results:

b-namespace.spdx.json   -> INVALID: document_namespace must be a valid URI specified in RFC-3986 and must contain no fragment (#), but is: not-a-uri
c-dup-doc-pkg.spdx.json -> INVALID: spdx_id must be SPDXRef-DOCUMENT, but is: SPDXRef-a
                                    every spdx_id must be unique within the document, but found duplicates: ['SPDXRef-a']

It's been a while so totally recognize this could be user error but wanted to open this here in case others run into it.

Lingua principale
Java
Stelle
101
Fork
45
Merge medio
15h 57m
PR unite (30g)
10

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di spdx/tools-java

Tutte le issue di spdx/tools-java

Issue simili

Altre issue su Java

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.