-
-
Notifications
You must be signed in to change notification settings - Fork 66
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Inappropriate test data in invalid-license-id-count #303
Comments
thanks for bringing this to our attention. your report and solution sound reasonable. 👍 |
maybe use |
jkowalleck
pushed a commit
that referenced
this issue
Sep 12, 2023
closes #303 Signed-off-by: tokcum <tobias.mucke@gmail.com>
jkowalleck
pushed a commit
to jkowalleck/fork_CycloneDX-specification
that referenced
this issue
Sep 12, 2023
closes CycloneDX#303 Signed-off-by: tokcum <tobias.mucke@gmail.com>
jkowalleck
added a commit
to jkowalleck/fork_CycloneDX-specification
that referenced
this issue
Sep 12, 2023
forward-port of CycloneDX#305 fixes CycloneDX#303 in 1.6 Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
jkowalleck
added a commit
that referenced
this issue
Sep 12, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Hi,
working on cyclonedx-rust-cargo, I'm experiencing that
invalid-license-id-count
test data unexpectedly fails validation.The code of cyclonedx-rust-cargo does not yet check for doubly defined
id
inlicense
. However, the corresponding validation test fails.Let me explain by referring to an example in invalid-license-id-count-1.4.xml, see below. From the test data's file name and comment provided in the file, I understand that defining
id
twice is no longer valid. In fact, the test concludes that this BOM is invalid. However, this is not because of the doubly definedid
but because of the invalid license identifier: Apache-2 is not a valid SPDX identifier.This is expected to fail and it fails but due to the wrong reason:
After changing the id to a valid SPDX identifier, the test unexpectedly passes validation. Of course, to make this fail, I've to update cyclonedx-rust-cargo. However, the test data is inappropriate to conduct this test and needs to be refined.
I'll file a PR to fix this. However, I want to check for other occurrences of this issue within test data.
The text was updated successfully, but these errors were encountered: