[issue-403] change spdx version handling during validation

Signed-off-by: Armin Tänzer <[email protected]>

Author: armintaenzertng

src/validation/creation_info_validator.py

@@ -19,7 +19,7 @@
 from src.validation.validation_message import ValidationMessage, ValidationContext, SpdxElementType
 
 
-def validate_creation_info(creation_info: CreationInfo) -> List[ValidationMessage]:
+def validate_creation_info(creation_info: CreationInfo, spdx_version: str) -> List[ValidationMessage]:
     validation_messages: List[ValidationMessage] = []
 
     context = ValidationContext(spdx_id=creation_info.spdx_id, element_type=SpdxElementType.DOCUMENT)
@@ -31,6 +31,11 @@ def validate_creation_info(creation_info: CreationInfo) -> List[ValidationMessag
                 context
             )
         )
+    elif spdx_version != creation_info.spdx_version:
+        validation_messages.append(
+            ValidationMessage(f"provided SPDX version {spdx_version} does not match "
+                              f"the document's SPDX version {creation_info.spdx_version}", context)
+        )
 
     if creation_info.spdx_id != "SPDXRef-DOCUMENT":
         validation_messages.append(

src/validation/document_validator.py

@@ -24,10 +24,13 @@
 from src.validation.validation_message import ValidationMessage, ValidationContext, SpdxElementType
 
 
-def validate_full_spdx_document(document: Document, spdx_version: str) -> List[ValidationMessage]:
+def validate_full_spdx_document(document: Document, spdx_version: str = None) -> List[ValidationMessage]:
     validation_messages: List[ValidationMessage] = []
 
-    validation_messages.extend(validate_creation_info(document.creation_info))
+    if not spdx_version:
+        spdx_version = document.creation_info.spdx_version
+
+    validation_messages.extend(validate_creation_info(document.creation_info, spdx_version))
     validation_messages.extend(validate_packages(document.packages, document))
     validation_messages.extend(validate_files(document.files, document))
     validation_messages.extend(validate_snippets(document.snippets, document))

src/validation/relationship_validator.py

@@ -43,9 +43,9 @@ def validate_relationship(relationship: Relationship, document: Document, spdx_v
         for message in messages:
             validation_messages.append(ValidationMessage(message, context))
 
-    if spdx_version != "2.3":
+    if spdx_version != "SPDX-2.3":
         if relationship_type == RelationshipType.SPECIFICATION_FOR or relationship_type == RelationshipType.REQUIREMENT_DESCRIPTION_FOR:
             validation_messages.append(
-                ValidationMessage(f"{relationship_type} is not supported for SPDX versions below 2.3", context))
+                ValidationMessage(f"{relationship_type} is not supported for SPDX versions below SPDX-2.3", context))
 
     return validation_messages

src/writer/json/json_writer.py

@@ -24,8 +24,7 @@ def write_document(document: Document, file_name: str, validate: bool = True, co
     a new one is created.
     """
     if validate:
-        validation_messages: List[ValidationMessage] = validate_full_spdx_document(document,
-                                                                                   document.creation_info.spdx_version)
+        validation_messages: List[ValidationMessage] = validate_full_spdx_document(document)
         if validation_messages:
             raise ValueError(f"Document is not valid. The following errors were detected: {validation_messages}")
     if converter is None:

tests/validation/test_creation_info_validator.py

@@ -26,7 +26,7 @@ def test_valid_creation_info():
                                  [get_actor(), get_actor()], datetime(2022, 1, 1), "creator_comment",
                                  "CC0-1.0", [get_external_document_ref(), get_external_document_ref()], Version(6, 3),
                                  "doc_comment")
-    validation_messages: List[ValidationMessage] = validate_creation_info(creation_info)
+    validation_messages: List[ValidationMessage] = validate_creation_info(creation_info, "SPDX-2.3")
 
     assert validation_messages == []
 
@@ -35,6 +35,8 @@ def test_valid_creation_info():
         ("creation_info_input, spdx_id, expected_message",
          [(get_creation_info(spdx_version="version-2.3"), "SPDXRef-DOCUMENT",
            'spdx_version must be of the form "SPDX-[major].[minor]" but is: version-2.3'),
+          (get_creation_info(spdx_version="SPDX-2.2"), "SPDXRef-DOCUMENT",
+           f"provided SPDX version SPDX-2.3 does not match the document's SPDX version SPDX-2.2"),
           (get_creation_info(spdx_id="SPDXRef-doc"), "SPDXRef-doc",
            'spdx_id must be "SPDXRef-DOCUMENT", but is: SPDXRef-doc'),
           (get_creation_info(data_license="MIT"), "SPDXRef-DOCUMENT",
@@ -43,7 +45,7 @@ def test_valid_creation_info():
            "document_namespace must be a valid URI specified in RFC-3986, but is: some_namespace"),
           ])
 def test_invalid_creation_info(creation_info_input, expected_message, spdx_id):
-    validation_messages: List[ValidationMessage] = validate_creation_info(creation_info_input)
+    validation_messages: List[ValidationMessage] = validate_creation_info(creation_info_input, "SPDX-2.3")
 
     expected = ValidationMessage(expected_message, ValidationContext(spdx_id, None, SpdxElementType.DOCUMENT))
 

tests/validation/test_document_validator.py

@@ -23,7 +23,7 @@ def test_valid_document():
                         [get_snippet(), get_snippet()], [get_annotation(), get_annotation()],
                         [get_relationship(), get_relationship()],
                         [get_extracted_licensing_info(), get_extracted_licensing_info()])
-    validation_messages: List[ValidationMessage] = validate_full_spdx_document(document, "2.3")
+    validation_messages: List[ValidationMessage] = validate_full_spdx_document(document)
 
     assert validation_messages == []
 

tests/validation/test_relationship_validator.py

@@ -43,7 +43,7 @@ def test_unknown_spdx_id(spdx_element_id, related_spdx_element_id, expected_mess
     relationship: Relationship = get_relationship(spdx_element_id=spdx_element_id,
                                                   related_spdx_element_id=related_spdx_element_id)
     document: Document = get_document(files=[get_file(spdx_id="SPDXRef-File")])
-    validation_messages: List[ValidationMessage] = validate_relationship(relationship, document, "2.3")
+    validation_messages: List[ValidationMessage] = validate_relationship(relationship, document, "SPDX-2.3")
 
     expected = ValidationMessage(expected_message,
                                  ValidationContext(element_type=SpdxElementType.RELATIONSHIP,
@@ -54,14 +54,14 @@ def test_unknown_spdx_id(spdx_element_id, related_spdx_element_id, expected_mess
 
 @pytest.mark.parametrize("relationship, expected_message",
                          [(Relationship("SPDXRef-DOCUMENT", RelationshipType.SPECIFICATION_FOR, "SPDXRef-Package"),
-                           "RelationshipType.SPECIFICATION_FOR is not supported for SPDX versions below 2.3"),
+                           "RelationshipType.SPECIFICATION_FOR is not supported for SPDX versions below SPDX-2.3"),
                           (Relationship("SPDXRef-DOCUMENT", RelationshipType.REQUIREMENT_DESCRIPTION_FOR,
                                         "SPDXRef-Package"),
-                           "RelationshipType.REQUIREMENT_DESCRIPTION_FOR is not supported for SPDX versions below 2.3")])
+                           "RelationshipType.REQUIREMENT_DESCRIPTION_FOR is not supported for SPDX versions below SPDX-2.3")])
 def test_v2_3_only_types(relationship, expected_message):
     document: Document = get_document(packages=[get_package(spdx_id="SPDXRef-Package")])
 
-    validation_message: List[ValidationMessage] = validate_relationship(relationship, document, "2.2")
+    validation_message: List[ValidationMessage] = validate_relationship(relationship, document, "SPDX-2.2")
 
     expected = [ValidationMessage(expected_message,
                                   ValidationContext(element_type=SpdxElementType.RELATIONSHIP,