SPDX identifiers require the SPDXRef- prefix and DocumentRef identifiers require the DocumentRef- prefix.
See spec details 6.3, 7.2, and 8.2
Currently, if the SPDXRef- prefix isn't present then the SBOM is parsed and the ID is accepted verbatim. Further, on being written out the SBOM will have the SPDXRef- prefix added.
Note, this also means that SPDXRef- is an accepted ID.
For example, the following SBOM:
{
"SPDXID" : "SPDXRef-DOCUMENT",
"spdxVersion" : "SPDX-2.3",
"creationInfo" : {
"created" : "2023-07-18T12:27:48Z",
"creators" : [ "Person: Gary O'Neall", "Tool: spdx-maven-plugin" ],
"licenseListVersion" : "3.21"
},
"name" : "tools-java",
"dataLicense" : "CC0-1.0",
"documentDescribes" : [ "SPDXRef-8" ],
"documentNamespace" : "test",
"packages" : [ {
"SPDXID" : "7",
"name" : "json-schema-validator"
}],
"relationships" : [ {
"spdxElementId" : "7",
"relationshipType" : "TEST_CASE_OF",
"relatedSpdxElement" : "0"
}]
}
is currently successfully parsed and when written has the following output:
{
"spdxVersion":"SPDX-2.3",
"dataLicense":"CC0-1.0",
"SPDXID":"SPDXRef-DOCUMENT",
"name":"tools-java",
"documentNamespace":"test",
"creationInfo":{
"licenseListVersion":"3.21",
"creators":["Person: Gary O'Neall","Tool: spdx-maven-plugin"],
"created":"2023-07-18T12:27:48Z"
},
"packages":[{
"name":"json-schema-validator",
"SPDXID":"SPDXRef-7",
"downloadLocation":"",
"filesAnalyzed":true
}],
"relationships":[{
"spdxElementId":"SPDXRef-7",
"relatedSpdxElement":"SPDXRef-0",
"relationshipType":"TEST_CASE_OF"
},{
"spdxElementId":"SPDXRef-DOCUMENT",
"relatedSpdxElement":"SPDXRef-8",
"relationshipType":"DESCRIBES"
}]
}
#269 is the likely cause of this issue as it adjusted the parsing of IDs to be more tolerant of incorrectly formatted IDs.
Note, this came up as some of the sbom-conformance projects tests started failing as the input was parsed successfully (which was unexpected): google/sbom-conformance#70
SPDX identifiers require the
SPDXRef-prefix and DocumentRef identifiers require theDocumentRef-prefix.See spec details 6.3, 7.2, and 8.2
Currently, if the
SPDXRef-prefix isn't present then the SBOM is parsed and the ID is accepted verbatim. Further, on being written out the SBOM will have theSPDXRef-prefix added.Note, this also means that
SPDXRef-is an accepted ID.For example, the following SBOM:
is currently successfully parsed and when written has the following output:
#269 is the likely cause of this issue as it adjusted the parsing of IDs to be more tolerant of incorrectly formatted IDs.
Note, this came up as some of the sbom-conformance projects tests started failing as the input was parsed successfully (which was unexpected): google/sbom-conformance#70