hesa/spdx-validator

Simple validator of package SBoM

Hi there 👋

📫 How to reach me:

• LinkedIn: henrik-sandklef

spdx-validator's Issues

add flict output

Debug methods need harmony

File not arg in all such methods

Add CI

Validator constructor should default to 2.2

installable via pip

Add git/homepage to all reports

Contradiction in license

On page: https://pypi.org/project/spdx-validator/

You have both:

• Licence : GNU General Public License v3 or later (GPLv3+)
• The program is licensed under GPL-3.0-only

Which one is correct?

Validate spdxDocument in relationship

Validate checksum

Currently checksum is not validated.

Using -sd . without -r crashes the tool

$ spdx-validator -sd . freetype-2.9.spdx.json 
Traceback (most recent call last):
  File "/home/hesa/.local/lib/python3.9/site-packages/spdx_validator/__main__.py", line 131, in main
    data = validator.validate_file(file_name, args.recursive, discard_checksum = args.discard_checksum)
  File "/home/hesa/.local/lib/python3.9/site-packages/spdx_validator/validator.py", line 118, in validate_file
    raise SPDXValidationException("Could not open file: " + str(spdx_file))
spdx_validator.exception.SPDXValidationException: Could not open file: None

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/home/hesa/.local/bin/spdx-validator", line 33, in <module>
    sys.exit(load_entry_point('spdx-validator==0.1', 'console_scripts', 'spdx-validator')())
  File "/home/hesa/.local/lib/python3.9/site-packages/spdx_validator/__main__.py", line 137, in main
    print("Failed validating: " + file_name, file=sys.stderr)
TypeError: can only concatenate str (not "NoneType") to str

Give better details when invalid SPDX found

Recursive validation

Check an SBoM's all Relations for validity (recursively)

Add dir of the SPDX file to check to list of dir

Currently spdx-validator looks for SPDX files in directories as supplied using --spdx-dir.
By default it would make sense to look for files in the same directory as where the SPDX file to validate is located.

So for

spdx-validator release/freettype-2.09.spdx.json

then release/ will be added to directories where to look for related SPDX files.

Option to ignore checksum errors

When writing/updating the SPDX file it is somewhat tiresome to update the checksum (in the file) for every update

Add unit test

Option to provide separate schema

Add compatibility meta data to policy report

The policy report does not mention, include, meta data about the compat report. Think it should

Add flict format to output when converting

$ spdx-validator --convert --format flict example-data/freetype-2.9.spdx.json  -pp -r -sd example-data/ 
...
no implementation for flict

Would be nice to have spdx-validator spit out flict format. Then we can also validate licenses.

Add convert

convert from one format (e.g. JSON) to another (e.g. YAML)