Skip to content

Commit b291d70

Browse files
fviernaugoneall
authored andcommitted
Fix an issues with SpdxPackage._verify()
The specification for SPDX v2.3 seems to not require that for each `SpdxPackage` all files which in reality correspond to that package have to be included as `SpdxFile` in case files have been analyzed, namely `filesAnalyzed` is set to `true` [1]. This allows the freedom for the creator of on SPDX document to only selectively include certain files. For example, a tool may analyze all files of a package for license texts, but choose to only selectively include certain files containing license texts as `SpdxFile` entry into the SPDX document, for example to reduce the size of the SPDX document a bit, or to omit information which is less relevant in the given context. This implies, that it should also be valid to not include any files for a package at all, even though its files have been analyzed. However, `_verify()` complains if `filesAnalyzed && files.size() == 0` which seems incorrect. Drop that check to align with the spec. [1] https://spdx.github.io/spdx-spec/v2.3/package-information/#78-files-analyzed-field Signed-off-by: Frank Viernau <frank.viernau@gmail.com>
1 parent efbb006 commit b291d70

1 file changed

Lines changed: 1 addition & 5 deletions

File tree

src/main/java/org/spdx/library/model/v2/SpdxPackage.java

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -608,11 +608,7 @@ protected List<String> _verify(Set<String> verifiedIds, String specVersion) {
608608

609609
// files depends on if the filesAnalyzed flag
610610
try {
611-
if (getFiles().size() == 0) {
612-
if (filesAnalyzed) {
613-
retval.add("Missing required package files for "+pkgName);
614-
}
615-
} else {
611+
if (!getFiles().isEmpty()) {
616612
if (!filesAnalyzed) {
617613
retval.add("Warning: Found analyzed files for package "+pkgName+" when analyzedFiles is set to false.");
618614
}

0 commit comments

Comments
 (0)