search

tern-tools / tern

Tern is a software composition analysis tool and Python library that generates a Software Bill of Materials for container images and Dockerfiles. The SBOM that Tern generates will give you a layer-by-layer view of what's inside your container in a variety of formats including human-readable, JSON, HTML, SPDX and more.
BSD 2-Clause "Simplified" License
960 stars 188 forks source link

FilesAnalyzed: False has a wrong case for "False" #1170

Closed vargenau closed 2 years ago

vargenau commented 2 years ago

Describe the bug Tern sometimes generates FilesAnalyzed: False instead of FilesAnalyzed: false

To Reproduce Steps to reproduce the behavior:

tern report -f spdxtagvalue -i mariadb:latest -o mariadb.spdx

Expected behavior In SPDX 2.2, section 1.7.7, it is stated: "Tags and format properties are case sensitive".

So boolean false should be in lower case like in the examples.

Environment you are running Tern on

Tern version 2.10.0
   python version = 3.10.4 (main, Apr  2 2022, 09:04:19)

Please attach files if they exist

rnjudge commented 2 years ago

Hi @vargenau -- Good catch! You may also want to file an issue with the SPDX tools repo as the document seems to validate for me even with the False value.

(ternenv) rjudge:tern$ tern --version
Tern at commit 43fd06fd0bae58b02d632be7f833613a7de06b16
   python version = 3.8.10 (default, Nov 26 2021, 20:14:08)

(ternenv) rjudge:tern$ tern report -f spdxtagvalue -i mariadb:latest -o mariadb.spdx

(ternenv) rjudge:tern$ cat mariadb.spdx | grep False
FilesAnalyzed: False

(ternenv) rjudge:tern$ java -jar /home/rjudge/spdx-tools-2.2.7-jar-with-dependencies.jar Verify mariadb.spdx
This SPDX Document is valid.
vargenau commented 2 years ago

Hi @rnjudge

Here it is: https://github.com/spdx/spdx-online-tools/issues/374

vargenau commented 2 years ago

In fact, it is https://github.com/spdx/spdx-online-tools/issues/372

Since it was moved to https://github.com/spdx/spdx-java-tagvalue-store/issues/22, I did not find it the list and thought I had not created it.