spdx / tools-golang / 26857056894

86%

main: 86%

Pull #286

github

spdxlib: allow NONE and NOASSERTION on the right side of relationships

ValidateDocument checked every relationship's RefA and RefB against the
set of element identifiers defined in the document. The tag-value parser
correctly accepts the NONE and NOASSERTION keywords on the right-hand
side of a relationship and stores them as a DocElementID with SpecialID
set and an empty ElementRefID. As a result a spec-valid document such as

    Relationship: SPDXRef-Pkg CONTAINS NOASSERTION

parsed successfully but then failed validation with a misleading "used
in relationship but no such package exists" error (with an empty
identifier in the message).

SPDX 2.3 section 11.1 permits both NONE and NOASSERTION on the right
side of a relationship. Skip the element-existence check when RefA or
RefB carries a non-empty SpecialID, since a special value is not a
reference to an element defined in the document.

Fixes #236

Signed-off-by: Arpit Jain <arpitjain099@gmail.com>

4 of 4 new or added lines in 1 file covered. (100.0%)

7559 of 8743 relevant lines covered (86.46%)

18.69 hits per line