Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SPDX 2.2 JSON documents are validated using the 2.3 schema #74

Closed
puerco opened this issue Aug 26, 2022 · 3 comments
Closed

SPDX 2.2 JSON documents are validated using the 2.3 schema #74

puerco opened this issue Aug 26, 2022 · 3 comments

Comments

@puerco
Copy link

puerco commented Aug 26, 2022

It seems the verification code is using the 2.3 (or maybe just the latest?) json schema to validate documents regardless of the version in them. I noticed this while adjusting changes in the external references when migrating some tools to 2.3.

As an example, a 2.2 document using the 2.3 category label PACKAGE-MANAGER (with the dash instead of the underscore) like this is reported as valid:

      "externalRefs": [
        {
          "referenceCategory": "PACKAGE-MANAGER",
          "referenceLocator": "pkg:oci/index@sha256:8101cc07b2a1b5ca4736130f602b3e03808d18706d931123aee866ad43b1b2d7",
          "referenceType": "purl"
        }
      ]
java -jar tools-java-1.1.0-jar-with-dependencies.jar Verify test.spdx.json 
WARNING: sun.reflect.Reflection.getCallerClass is not supported. This will impact performance.
This SPDX Document is valid.

I'm attaching the example SBOM to reproduce the problem: test.spdx.json.gz

@goneall
Copy link
Member

goneall commented Aug 27, 2022

@puerco - Thanks for pointing this out. You are correct, it is only using the latest schema for validation. Although there is code within the underlying Java library to look for differences between 2.2 and 2.3 when validating, the JSON schema validation is done in a different library - spdx-java-jackson-store.

I'll move this issue over to that repo to use version specific schemas when validating.

@goneall goneall transferred this issue from spdx/tools-java Aug 27, 2022
@goneall
Copy link
Member

goneall commented Oct 2, 2022

Looks like the validation is in the tools-java verify function - moving the issue back ...

@goneall goneall transferred this issue from spdx/spdx-java-jackson-store Oct 2, 2022
goneall added a commit that referenced this issue Oct 2, 2022
Resolves issue #74

Signed-off-by: Gary O'Neall <[email protected]>
@goneall
Copy link
Member

goneall commented Oct 2, 2022

Resolved with #75

@goneall goneall closed this as completed Oct 2, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants