search

spdx / Spdx-Java-Library

Java library which implements the Java object model for SPDX and provides useful helper functions
Apache License 2.0
37 stars 36 forks source link

Unexpected behavior comparing SPDX documents with no local LicenseRef text #65

Open goneall opened 3 years ago

goneall commented 3 years ago

When comparing 2 SPDX documents with a LicenseRef containing no text, the comparison of those LicenseRef's is false, but no explanation is given.

We probably do not want them to match since we don't have the text to compare, but we could list them in the Extracted Licenses tab as EMPTY.

goneall commented 3 years ago

This is related to https://github.com/spdx/tools/issues/267

goneall commented 3 years ago

Attaching a test file with an empty license text and the resultant compare xlsx spreadsheet when comparing to itself. SPDXTagExample-v2.2-no-text1.spdx.txt result.xlsx

goneall commented 3 years ago

I'm going to leave this open for now - not sure if we should match empty text or not.

Note that the Verification tab does show that there is missing required license text.

goneall commented 3 years ago

Moving this issue to the Spdx-Java-Library since the fix (if we decide this is a bug) would be in the license compare code in the library.

goneall commented 3 years ago

Labeling this as "won't fix" - Since license text is required per spec and the tool, the behavior in matching an invalid SPDX document doesn't need to be defined.