spdx / ntia-conformance-checker

Check SPDX SBOM for NTIA minimum elements
Apache License 2.0
47 stars 18 forks source link

Fix logic error in get_components_without_suppliers #176

Closed jspeed-meyers closed 3 months ago

jspeed-meyers commented 3 months ago

Fix #157

Only the supplier field should be checked to determine if the supplier field is missing a value. Previously the code checked both the supplier and the originator fields, on the mistaken assumption that either field counted as the package supplier. Oops.

THIS IS A BREAKING CHANGE.

I revised the test suite substantially since this was a logic error. Many test SBOM documents needed a minor tweak.