Skip to content

How to convert from SPDX 2 to SPDX 3 #170

New issue
New issue
Closed
Closed
How to convert from SPDX 2 to SPDX 3#170
Labels
questionFurther information is requested

Description

@vargenau
vargenau
opened on Sep 26, 2024

@goneall
The Java tools version 2 have the capability to convert from SPDX 2 to SPDX 3.
This is documented at: https://spdx.github.io/Spdx-Java-Library/org/spdx/library/conversion/Spdx2to3Converter.html

But I would like to do it in the command line, not in a Java program.

I used to do something like:

java -jar tools-java-1.1.8-jar-with-dependencies.jar Convert hello.spdx hello.spdx.json

convert from SPDX 2 tag:value to SPDX 2 JSON.

I would have expected that

java -jar tools-java-2.0.0-Alpha-jar-with-dependencies.jar Convert hello.spdx hello.spdx.json

would convert my SPDX 2 tag:value to SPDX 3, but that still converts to SPDX 2 JSON.

Is there a way to convert SPDX 2 to SPDX 3 on the command line?

Activity

  1. goneall commented on Sep 27, 2024

    @goneall
    goneall
    on Sep 27, 2024
    Member

    @vargenau - you can use the file extension .jsonld.json or jsonld and it will convert it to 3.0. Alternatively, you can add the options for the from and to file types:

    java -jar tools-java-2.0.0-Alpha-jar-with-dependencies.jar Convert hello.spdx hello.spdx.json TAG JSONLD

  2. vargenau commented on Sep 30, 2024

    @vargenau
    vargenau
    on Sep 30, 2024
    ContributorAuthor

    Thank you very much @goneall for your answer.

    I have created a pull request #171 to add it to the README file.

  3. vargenau commented on Sep 30, 2024

    @vargenau
    vargenau
    on Sep 30, 2024
    ContributorAuthor

    The conversion works, but I have many warnings.

    [main] WARN org.spdx.library.model.v2.SpdxElement - No creation info for document Optional[hello]
[main] WARN org.spdx.storage.listedlicense.SpdxListedLicenseModelStore - SPDX listed license URL was used instead of the required namespace ('https:' rather than 'http:'
[main] WARN org.spdx.storage.listedlicense.SpdxListedLicenseModelStore - SPDX listed license URL was used instead of the required namespace ('https:' rather than 'http:'
[main] WARN org.spdx.storage.listedlicense.SpdxListedLicenseModelStore - SPDX listed license URL was used instead of the required namespace ('https:' rather than 'http:'
[main] WARN org.spdx.storage.listedlicense.SpdxListedLicenseModelStore - SPDX listed license URL was used instead of the required namespace ('https:' rather than 'http:'
[main] WARN org.spdx.storage.listedlicense.SpdxListedLicenseModelStore - SPDX listed license URL was used instead of the required namespace ('https:' rather than 'http:'
[main] WARN org.spdx.storage.listedlicense.SpdxListedLicenseModelStore - SPDX listed license URL was used instead of the required namespace ('https:' rather than 'http:'
[main] WARN org.spdx.storage.listedlicense.SpdxListedLicenseModelStore - SPDX listed license URL was used instead of the required namespace ('https:' rather than 'http:'
[main] WARN org.spdx.storage.listedlicense.SpdxListedLicenseModelStore - SPDX listed license URL was used instead of the required namespace ('https:' rather than 'http:'
[main] WARN org.spdx.storage.listedlicense.SpdxListedLicenseModelStore - SPDX listed license URL was used instead of the required namespace ('https:' rather than 'http:'
[main] WARN org.spdx.storage.listedlicense.SpdxListedLicenseModelStore - SPDX listed license URL was used instead of the required namespace ('https:' rather than 'http:'
[main] WARN org.spdx.storage.listedlicense.SpdxListedLicenseModelStore - SPDX listed license URL was used instead of the required namespace ('https:' rather than 'http:'
[main] WARN org.spdx.storage.listedlicense.SpdxListedLicenseModelStore - SPDX listed license URL was used instead of the required namespace ('https:' rather than 'http:'
[main] WARN org.spdx.storage.listedlicense.SpdxListedLicenseModelStore - SPDX listed license URL was used instead of the required namespace ('https:' rather than 'http:'
[main] WARN org.spdx.storage.listedlicense.SpdxListedLicenseModelStore - SPDX listed license URL was used instead of the required namespace ('https:' rather than 'http:'
[main] WARN org.spdx.storage.listedlicense.SpdxListedLicenseModelStore - SPDX listed license URL was used instead of the required namespace ('https:' rather than 'http:'
sept. 30, 2024 4:11:43 PM net.jimblackler.jsonschemafriend.Schema <init>
AVERTISSEMENT: No match for #/$defs/ElementCollection
sept. 30, 2024 4:11:43 PM net.jimblackler.jsonschemafriend.Schema <init>
AVERTISSEMENT: No match for #/$defs/security_VexVulnAssessmentRelationship
sept. 30, 2024 4:11:43 PM net.jimblackler.jsonschemafriend.Schema <init>
AVERTISSEMENT: No match for #/$defs/security_VulnAssessmentRelationship
sept. 30, 2024 4:11:43 PM net.jimblackler.jsonschemafriend.Schema <init>
AVERTISSEMENT: No match for #/$defs/software_SoftwareArtifact

  4. goneall commented on Oct 12, 2024

    @goneall
    goneall
    on Oct 12, 2024
    Member

    @vargenau - I took a look at the code and the warnings above.

    The schema related warnings are due to issues with the SPDX spec generated schema file which has been resolved with 3.0.1 - as soon as I update the tools, these should go away.

    I wasn't able to duplicate the other warnings - if you can attach the SPDX V2.3 file you used as input, I can take a look.

  5. vargenau commented on Oct 13, 2024

    @vargenau
    vargenau
    on Oct 13, 2024
    ContributorAuthor

    Hi @goneall
    Thank you for having a look at my warnings.
    Input file is here:
    https://github.com/OpenChain-Project/Telco-WG/blob/main/tools/openchain_telco_sbom_validator/open-source-compliance-artifacts/openchain-telco-sbom-validator-0.1.6.spdx

  6. goneall commented on Oct 13, 2024

    @goneall
    goneall
    on Oct 13, 2024
    Member

    @vargenau - I was able to duplicate the warnings on the 2.0.0-Alpha version. It looks like all of these are fixed with the released 3.0.1 schema and a few related fixes. Hope to get a new release out soon after we finalize the 3.0.1 spec release.

  7. vargenau commented on Oct 13, 2024

    @vargenau
    vargenau
    on Oct 13, 2024
    ContributorAuthor

    Thank you @goneall

  8. bact
    added
    questionFurther information is requested
    on Dec 21, 2024

  9. goneall commented on Jan 5, 2025

    @goneall
    goneall
    on Jan 5, 2025
    Member

    @vargenau - can you check with the latest? I think these have been fixed.

  10. vargenau commented on Jan 6, 2025

    @vargenau
    vargenau
    on Jan 6, 2025
    ContributorAuthor

    Hi @goneall

    Best wishes for the new year!

    I still have some warnings:

    janv. 06, 2025 10:42:53 AM net.jimblackler.jsonschemafriend.Schema <init>
AVERTISSEMENT: No match for #/$defs/ElementCollection
janv. 06, 2025 10:42:53 AM net.jimblackler.jsonschemafriend.Schema <init>
AVERTISSEMENT: No match for #/$defs/security_VexVulnAssessmentRelationship
janv. 06, 2025 10:42:53 AM net.jimblackler.jsonschemafriend.Schema <init>
AVERTISSEMENT: No match for #/$defs/security_VulnAssessmentRelationship
janv. 06, 2025 10:42:53 AM net.jimblackler.jsonschemafriend.Schema <init>
AVERTISSEMENT: No match for #/$defs/software_SoftwareArtifact

    When running the Validator on the SPDX 3 resulting of the conversion, I have:

    AVERTISSEMENT: No match for #/$defs/ElementCollection
janv. 06, 2025 10:43:39 AM net.jimblackler.jsonschemafriend.Schema <init>
AVERTISSEMENT: No match for #/$defs/security_VexVulnAssessmentRelationship
janv. 06, 2025 10:43:39 AM net.jimblackler.jsonschemafriend.Schema <init>
AVERTISSEMENT: No match for #/$defs/security_VulnAssessmentRelationship
janv. 06, 2025 10:43:39 AM net.jimblackler.jsonschemafriend.Schema <init>
AVERTISSEMENT: No match for #/$defs/software_SoftwareArtifact
[main] WARN org.spdx.library.ModelCopyManager - https://spdx.org/licenses/creatoragent/3_26_0 already exists - possibly overwriting properties due to a copy from a different model store.
[main] WARN org.spdx.v3jsonldstore.JsonLDStore - Non element in the serialized graph - __anon__gnrtd0 will not be included in the SPDX document elements
[main] WARN org.spdx.v3jsonldstore.JsonLDStore - Non element in the serialized graph - __anon__gnrtd1 will not be included in the SPDX document elements
[main] WARN org.spdx.v3jsonldstore.JsonLDStore - Non element in the serialized graph - __anon__gnrtd2 will not be included in the SPDX document elements
This SPDX Document is valid.

  11. goneall commented on Jan 6, 2025

    @goneall
    goneall
    on Jan 6, 2025
    Member

    @vargenau I was able to duplicate the warnings.

    The first few warnings "No match for ..." have already been fixed and will be included in the next release candidate.

    I'll need to look into the cause of the other warnings.

  12. goneall commented on Jan 6, 2025

    @goneall
    goneall
    on Jan 6, 2025
    Member

    I added 2 PR's to remove the remaining warnings - fixes should show up in the next release candidate.

  13. vargenau commented on Jan 7, 2025

    @vargenau
    vargenau
    on Jan 7, 2025
    ContributorAuthor

    Thank you @goneall
    I will check in the next release.

  14. goneall commented on Feb 2, 2025

    @goneall
    goneall
    on Feb 2, 2025
    Member

    @vargenau - I just released 2.0.0-RC2 and updated the online tools which should resolve the issues noted above.

    I'll go ahead and close this issue, but if you run into any similar problems please open a new issue.

  15. goneall
    closed this as completedon Feb 2, 2025

  16. vargenau commented on Feb 24, 2025

    @vargenau
    vargenau
    on Feb 24, 2025
    ContributorAuthor

    Hi @goneall
    Thank you for the fixes.
    I confirm that it now works for this SBOM.
    However, I created a new issue: #188

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    questionFurther information is requested

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions