search

spdx / tools-golang

Collection of Go packages to work with SPDX files
Other
116 stars 54 forks source link

ValidateDocument() should allow NOASSERTION and NONE #236

Open wallrat opened 2 months ago

wallrat commented 2 months ago

According to the Spec 11.1.1

In cases where there are "known unknowns", the use of the keyword NOASSERTION can be used on the right hand side of a relationship to indicate that the author is not asserting whether there are other SPDX elements (package/file/snippet) that are connected by relationships or not. That is, there could be some, but the author is not asserting one way or another.

Similarly, the use of the keyword NONE can be used to indicate that an SPDX element (package/file/snippet) has no other elements connected by some relationship to it.

Currently the the ValidateDocument func returns an error when RHS is one of the above.

Note: as described #231 ValidateDocument also fails when right hand side is an external reference. Both of these cases we see in the wild.