search

oss-review-toolkit / ort

A suite of tools to automate software compliance checks.
https://oss-review-toolkit.org
Apache License 2.0
1.58k stars 308 forks source link

Error for invalid SPDX character is not reported as issue #7238

Open hanna-modica opened 1 year ago

hanna-modica commented 1 year ago

The following commit [1] will produce an error in the analyzer logs, if there is an spdx id that contains a forbidden character. However, it will not create an issue, therefore, the analyzer we run inside docker finishes with exit code 0 and in the scan report web app there is also no issue for this error. However, the dependency tree will be incomplete, but for a regular user it is hard to find out why. If possible, please make this error appear correctly in the scan report web app.

[1] https://github.com/oss-review-toolkit/ort/pull/7066/commits/015382f5645dedd55cd3c94d10ff175d4fa5198f

sschuberth commented 1 year ago

However, it will not create an issue

Are you certain about that? This is what I tried for testing:

issues:
- timestamp: "2023-07-04T09:07:53.008578087Z"
  source: "SpdxDocumentFile"
  message: "SpdxDocumentFile failed to resolve dependencies for path 'src/funTest/assets/projects/synthetic/inline-packages/project-xyz.spdx.yml':\
    \ ValueInstantiationException: Cannot construct instance of `org.ossreviewtoolkit.utils.spdx.model.SpdxPackage`,\
    \ problem: The SPDX ID 'SPDXRef-Package-xyz!' is only allowed to contain letters,\
    \ numbers, '.', and '-'.
 at [Source: (File); line: 26, column: 1] (through reference\
    \ chain: org.ossreviewtoolkit.utils.spdx.model.SpdxDocument[\"packages\"]->java.util.ArrayList[0])
\
    Caused by: IllegalArgumentException: The SPDX ID 'SPDXRef-Package-xyz!' is only\
    \ allowed to contain letters, numbers, '.', and '-'."
  severity: "ERROR"
hanna-modica commented 1 year ago

Hi @sschuberth, unfortunately, yes. The analyzer-result.yml does not contain an issue for that error message in our run. I am not sure, what I can provide to you without disclosing company information.

sschuberth commented 1 year ago

Ok, thanks for the feedback, but as I'm not able to reproduce the issue then I'll mark this as help wanted and someone who can reproduce this needs to look into it.

sschuberth commented 3 months ago

I am not sure, what I can provide to you without disclosing company information.

@mnonnenmacher can you help here maybe?