guacsec / guac

GUAC aggregates software security metadata into a high fidelity graph database.
https://guac.sh
Apache License 2.0
1.29k stars 176 forks source link

[ingestion/data-quality issue] Ingesting an SPDX SBOM with `LicenseRef-` license fails #2165

Closed mrizzi closed 1 month ago

mrizzi commented 1 month ago

Describe the bug In PR-2164 the test has been changed to expect both Inline and ListVersion but this would cause the Both Inline and ListVersion are provided error during ingestion because of failure in validating license in: https://github.com/guacsec/guac/blob/f13bed16fc13607ced4269e5ff5b1ae13f48c9ec/pkg/assembler/graphql/resolvers/validation.go#L143

To Reproduce Basically the test's expectation is wrong so reverting it to not expect ListVersion: ptrfrom.String("1.2.3") would reproduce the issue.

Expected behavior Not having a value for ListVersion field when Inline has a value

GUAC version Current main branch, i.e. f13bed16fc13607ced4269e5ff5b1ae13f48c9ec

Ingested document(s)

SPDX with custom licenses test

Additional context

pxp928 commented 1 month ago

ah good catch @mrizzi!