spdx / tools-golang

86%

main: 86%

LAST BUILD ON BRANCH fix/validate-noassertion-relationships

branch: fix/validate-noassertion-relationships

CHANGE BRANCH

x

Reset

• fix/validate-noassertion-relationships
• 0.1.1
• 0.3.0-rc1-readme
• 0.3.0-rc1-release-notes
• addJsonEnums
• colon_space_fix
• dependabot/github_actions/actions/checkout-5
• dependabot/github_actions/actions/checkout-6
• dependabot/github_actions/actions/setup-go-3
• dependabot/github_actions/actions/setup-go-4
• dependabot/github_actions/actions/setup-go-5
• dependabot/github_actions/actions/setup-go-6
• dependabot/go_modules/github.com/anchore/go-struct-converter-0.1.0
• dependabot/go_modules/github.com/google/go-cmp-0.5.9
• dependabot/go_modules/github.com/google/go-cmp-0.6.0
• dependabot/go_modules/github.com/google/go-cmp-0.7.0
• dependabot/go_modules/github.com/stretchr/testify-1.10.0
• dependabot/go_modules/github.com/stretchr/testify-1.11.0
• dependabot/go_modules/github.com/stretchr/testify-1.11.1
• dependabot/go_modules/github.com/stretchr/testify-1.8.2
• dependabot/go_modules/github.com/stretchr/testify-1.8.3
• dependabot/go_modules/github.com/stretchr/testify-1.8.4
• dependabot/go_modules/github.com/stretchr/testify-1.9.0
• dependabot/go_modules/sigs.k8s.io/yaml-1.4.0
• dependabot/go_modules/sigs.k8s.io/yaml-1.5.0
• dependabot/go_modules/sigs.k8s.io/yaml-1.6.0
• ext-doc-ref
• feat/spdx-3-prototype
• fix-getallfilepath
• fix-license-filenames-ref
• fix-markdown-header
• fix-prefixdocumentid
• fix-shorthand-dupls
• fix-shorthand-dups-again
• fix/convert-licenses
• fix/external-document-ref-in-creation-info
• gordf
• id-parsing
• issue-35-link
• json
• main
• master
• optional-params
• patch-1
• rdfreader
• refs/tags/v0.1.0
• refs/tags/v0.2.0
• refs/tags/v0.3.0
• refs/tags/v0.3.0-rc1
• refs/tags/v0.4.0
• refs/tags/v0.5.0
• refs/tags/v0.5.0-rc1
• refs/tags/v0.5.1
• refs/tags/v0.5.2
• refs/tags/v0.5.3
• refs/tags/v0.5.4
• refs/tags/v0.5.5
• refs/tags/v0.5.6
• refs/tags/v0.5.7
• refs/tags/v0.6.0-rc1
• refs/tags/v0.6.0-rc2
• revert-54-master
• spdx3
• tagvalue/handle-external-document-ref
• update-release-notes

Build # 26857056894

Build Type

Pull #286

github

Committed by arpitjain099

Commit Message

spdxlib: allow NONE and NOASSERTION on the right side of relationships

ValidateDocument checked every relationship's RefA and RefB against the
set of element identifiers defined in the document. The tag-value parser
correctly accepts the NONE and NOASSERTION keywords on the right-hand
side of a relationship and stores them as a DocElementID with SpecialID
set and an empty ElementRefID. As a result a spec-valid document such as

    Relationship: SPDXRef-Pkg CONTAINS NOASSERTION

parsed successfully but then failed validation with a misleading "used
in relationship but no such package exists" error (with an empty
identifier in the message).

SPDX 2.3 section 11.1 permits both NONE and NOASSERTION on the right
side of a relationship. Skip the element-existence check when RefA or
RefB carries a non-empty SpecialID, since a special value is not a
reference to an element defined in the document.

Fixes #236

Signed-off-by: Arpit Jain <arpitjain099@gmail.com>

Pull Request Pull Request #286: spdxlib: allow NONE and NOASSERTION on the right side of relationships

Coverage Stats

4 of 4 new or added lines in 1 file covered. (100.0%)

7559 of 8743 relevant lines covered (86.46%)

18.69 hits per line