Repository navigation
Conversation
When filesAnalyzed is False, several sections should be omitted when writing rather than being presented as empty sets or "None". SPDX 2.2, sec: 3.8.3 - files analyzed specification 3.9.3 - verification code 3.14.3 - licenses from files Without doing this, invalid SPDX documents are written and cannot be parse by the parser. Signed-off-by: Lon Hohberger <lhh@redhat.com>
xmltodict is used to generate a Python dictionary from XML tags. Unfortunately, it does not transmogrify CDATA "true" or "false" to their Python bool representation, so we must do it ourselves. Add this to the XML example for testing purposes. Signed-off-by: Lon Hohberger <lhh@redhat.com>
Reading in SPDX BOMs with multiple packages produces a list of dictionaries, which cannot be sorted (throws a TypeError) Signed-off-by: Lon Hohberger <lhh@redhat.com>
When multiple packages are present, some may have filesAnalyzed set to True, others set to False. Make sure we test both cases. Signed-off-by: Lon Hohberger <lhh@redhat.com>
The SPDX specification holds that the package verification code is mandatory whenever files_analyzed is True or none (omitted), however, for the purposes of this library, we make it optional here. Signed-off-by: Lon Hohberger <lhh@redhat.com>
…ication. Signed-off-by: Jason Shepherd <jason@jasonshepherd.net>
|
@jasinner Thanks a lot for the contribution! ... in case I'm completely wrong about the overlap, please feel free to point it out 😅 |
nicoweidner
added
the
blocked
|
I think getting PR #197 in before this one is necessary. The flatten/un-flatten approach allows for better backward compatiability then the changes I'm proposing here. PR #200 seem to have a bigger focus on XML parser/writing which is complimentary to that PR. I think perhaps mine won't be necessary once those 2 PRs are merged, you are correct. Sorry I didn't look closer at them earlier. We'll need to get PR #195 in too I think. |
|
@jasinner In case you remember, would you mind listing which issues this PR addresses (in units as small as possible)? The linked issue is a bit vague and encompasses different issues. With all the concurrent PRs that had piled up, things got a bit chaotic. I suspect that a lot of things (or even all?) are already fixed on |
|
@jasinner Now that the general chaos subsided, I believe this PR has become redundant, unfortunately. I will leave this up for a while before closing it - please ping if you see some changes that should still make it into |
|
I think this is now redundant. If anyone disagrees, please ping me. |
Attempt to address #196
TODO:
I took the SPDX Example files from here and tried to update the existing tests to work with them.
This PR includes the commits from #195
I think all the parser issues are fixed now, at least for XML, YAML, and JSON. TagValue, and RDF are harder for me because I'm not familiar with the syntax of those.
There are failing tests in test_conversion.py and test_write_anything.py. I'm almost ready to give up trying to fix the TagValue and RDF writers, because I can't figure out how to fix them, help appreciated!
I haven't look at test_conversion.py yet, but I'm thinking it will be similar. Possible for XML, YAML, and JSON, but harder for TagValue and RDF.