Repository navigation
Multiple checksums per entity allowed by spec, but not supported by FIle and Package classes #185
Description
The SPDX spec allows for multiple checksums to be provided for Packages and Files, but the current Package and File classes only allow a single value to be specified.
See the 'Cardinality' section of the following sections of the spec:
Reacted by Anthony D'Andrea and Paul Yim
Activity
swinslow commentedon Sep 16, 2021
Just adding a note here, from the SPDX Docfest on Sept. 16 -- looks like this issue leads to errors for valid SPDX documents if they include a
FileChecksumwith the mandatory SHA1, together with additional optionalFileChecksums such as SHA256.dholth commentedon Nov 16, 2021
#197 can serialize multiple checksums. Parsing them back in is additional work.