Skip to content

Files without an associated Package allowed by spec, but not supported in Document class #181

Closed
FiniteStateInc/tools-python
#2

Description

@njv299

The current SPDX spec allows for Files to be included in a Document with no associated Package.

This is specified at https://spdx.github.io/spdx-spec/4-file-information/ in the following section (see bullet points 1 and 4):
image

Despite this, the current Document class does not allow this. While it does have a deprecated 'files' property, that property setter requires that a Package object is provided (via the package property), and all files are associated to that package instead of just being part of the Document's file set per the spec.

In addition, it does not appear that the writer classes (at least the tag/value writer) support this notion either, as all File objects that are serialized are done so as part of a Package.

Activity

  1. changed the title [-]Files without an associated Package allowed by spec, but not supported in Document[/-] [+]Files without an associated Package allowed by spec, but not supported in Document class[/+] on Jul 17, 2021
  2. bjamesv commented on Jun 8, 2022

    @bjamesv

    @licquia, @kestewart, @pombredanne, et al., PR in-progress for this. Will also add Package rdf:hasFile support to parser, more tests, and utilize the unpackaged files capability to address RDF parser bug where all referencesFile Files get added to the last-listed Package*

    Aiming to have something, middle of next week.

    *e.g.:

    def set_file_name(self, doc, name):
    """
    Raise OrderError if no package defined.
    """
    if self.has_package(doc):
    doc.packages[-1].files.append(file.File(name))
    # A file name marks the start of a new file instance.
    # The builder must be reset
    # FIXME: this state does not make sense
    self.reset_file_stat()
    return True
    else:
    raise OrderError("File::Name")

    via (rdfbuilder extends agvaluebuilders.FileBuilder)
    for s, _p, o in self.graph.triples(
    (None, RDF.type, self.spdx_namespace["Package"])
    ):
    self.parse_package(s)
    for s, _p, o in self.graph.triples(
    (None, RDF.type, self.spdx_namespace["ExternalRef"])
    ):
    self.parse_pkg_ext_ref(s)
    for s, _p, o in self.graph.triples(
    (None, self.spdx_namespace["referencesFile"], None)
    ):
    self.parse_file(o)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions