Skip to content

Commit 3b3d587

Browse files
xnoxgoneall
authored andcommitted
spdx-schema-v2.3.json: fix OPERATING-SYSTEM package intent
For Wolfi container at cgr.dev/chainguard/wolfi-base, trivy for spdx json SBOM generates ```json { "name": "wolfi", "SPDXID": "SPDXRef-OperatingSystem-2bccf727fe0bc7f8", "versionInfo": "20230201", "downloadLocation": "NONE", "filesAnalyzed": false, "primaryPackagePurpose": "OPERATING-SYSTEM", "annotations": [ { "annotator": "Tool: trivy-0.62.1", "annotationDate": "2025-05-28T17:07:25Z", "annotationType": "OTHER", "comment": "Class: os-pkgs" }, { "annotator": "Tool: trivy-0.62.1", "annotationDate": "2025-05-28T17:07:25Z", "annotationType": "OTHER", "comment": "Type: wolfi" } ] } ``` Which fails validating with tools-java because "OPERATING-SYSTEM" value is with a dash, which matches the spec at https://spdx.github.io/spdx-spec/v2.3/package-information/#724-primary-package-purpose-field Given tools in wild follow the spec, imho it is relatively safe to update the schema here. Note we have PACKAGE_MANAGER PACKAGE-MANAGER saga before, so do help me validating any other tools that might be impacted, so far I see this schema file being the only one out of line.
1 parent 3117fa4 commit 3b3d587

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

resources/spdx-schema-v2.3.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -413,7 +413,7 @@
413413
"primaryPackagePurpose" : {
414414
"description" : "This field provides information about the primary purpose of the identified package. Package Purpose is intrinsic to how the package is being used rather than the content of the package.",
415415
"type" : "string",
416-
"enum" : [ "OTHER", "INSTALL", "ARCHIVE", "FIRMWARE", "APPLICATION", "FRAMEWORK", "LIBRARY", "CONTAINER", "SOURCE", "DEVICE", "OPERATING_SYSTEM", "FILE" ]
416+
"enum" : [ "OTHER", "INSTALL", "ARCHIVE", "FIRMWARE", "APPLICATION", "FRAMEWORK", "LIBRARY", "CONTAINER", "SOURCE", "DEVICE", "OPERATING-SYSTEM", "FILE" ]
417417
},
418418
"releaseDate" : {
419419
"description" : "This field provides a place for recording the date the package was released.",

0 commit comments

Comments
 (0)