-
Notifications
You must be signed in to change notification settings - Fork 38
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
SPDX 2.2 JSON documents are validated using the 2.3 schema #74
Comments
@puerco - Thanks for pointing this out. You are correct, it is only using the latest schema for validation. Although there is code within the underlying Java library to look for differences between 2.2 and 2.3 when validating, the JSON schema validation is done in a different library - spdx-java-jackson-store. I'll move this issue over to that repo to use version specific schemas when validating. |
Looks like the validation is in the tools-java verify function - moving the issue back ... |
Resolves issue #74 Signed-off-by: Gary O'Neall <[email protected]>
Resolved with #75 |
It seems the verification code is using the 2.3 (or maybe just the latest?) json schema to validate documents regardless of the version in them. I noticed this while adjusting changes in the external references when migrating some tools to 2.3.
As an example, a 2.2 document using the 2.3 category label
PACKAGE-MANAGER
(with the dash instead of the underscore) like this is reported as valid:I'm attaching the example SBOM to reproduce the problem: test.spdx.json.gz
The text was updated successfully, but these errors were encountered: