Analysis exception processing SPDX file: Missing document namespace

[gk4delltech]

Description

I have used the openSUSE OBS to RPM build the GNU "hello world" example. Using this RPM as my input, I would like to create an SBOM for it. When I go to verify the SBOM, then it says the document namespace is missing. I don't see a scancode command line option to specify it. I do see that document namespace was a bug a couple of years ago and was fixed.

How To Reproduce

wget https://ftp.gnu.org/gnu/hello/hello-2.10.tar.gz
wget https://download.opensuse.org/repositories/home:/geokraft4/15.3/src/hello-2.10-4.2.src.rpm
wget https://download.opensuse.org/repositories/home:/geokraft4/15.3/x86_64/hello-2.10-4.2.x86_64.rpm
scancode -clpeui -n 1 --verbose --json-pp ~/spdxdocs/hello-rpm-spdx.json ~/spdxhello/hello-2.10-4.2.x86_64.rpm
java -jar ~/spdxtools/tools-java-1.0.4-jar-with-dependencies.jar Verify ~/spdxdocs/hello-rpm-spdx.json

System configuration

host: SLES 15 SP3
scancode 30.1.0 installed from git clone.

mkdir ~/source
cd ~/source
git clone https://github.com/nexB/scancode-toolkit.git
cd scancode-toolkit
git checkout develop
./configure
source venv/bin/activate
sudo zypper install -y python3-devel
sudo pip install --upgrade pip setuptools wheel
sudo pip install scancode-toolkit
which scancode

[gk4delltech]

Example hello-rpm-spdx.json file
hello-rpm-spdx.json.txt

[AyanSinhaMahapatra]

The file you generated from scancode is a json file as you've used the --json-pp option.

Refer to https://scancode-toolkit.readthedocs.io/en/latest/cli-reference/output-format.html#all-scan-output-options
where the spdx options are: --spdx-rdf or --spdx-tv.

I could generate a file using the following command:

scancode -clpeui -n 1 --verbose --spdx-rdf hello-rpm-spdx.rdf ./hello-2.10-4.2.x86_64.rpm

hello-rpm-spdx.rdf.txt

Now this is a spdx output.

But still when I run spdx verify with the following command:

java -jar ./tools-java-1.0.4/tools-java-1.0.4-jar-with-dependencies.jar Verify ./hello-rpm-spdx.rdf

I get the following:

WARNING: sun.reflect.Reflection.getCallerClass is not supported. This will impact performance.
ERROR StatusLogger No log4j2 configuration file found. Using default configuration: logging only errors to the console. Set system property 'log4j2.debug' to show Log4j2 internal initialization logging.
21:27:08.021 [main] ERROR org.apache.jena.rdf.model.impl.RDFDefaultErrorHandler - (line 7 column 73): {E211} Base URI is null, but there are relative URIs to resolve.: <SPDX Document created by ScanCode Toolkit>
21:27:08.035 [main] ERROR org.apache.jena.rdf.model.impl.RDFDefaultErrorHandler - (line 42 column 50): {E211} Base URI is null, but there are relative URIs to resolve.: <SPDXRef-001>

This SPDX Document is not valid due to:
        Missing required document name
        Document must have at least one relationship of type DOCUMENT_DESCRIBES

[AyanSinhaMahapatra]

Btw, I ran the verify command for spdx tools java versions:

• 1.0.0
• 1.0.4
• 1.1.0

This not valid statement was present for all the versions.

We need to fix this such that we produce valid spdx documents.

[pombredanne]

The RPM is now at https://download.opensuse.org/repositories/home:/geokraft4/15.3/x86_64/hello-2.10-4.3.x86_64.rpm and the tag value passes the SPDX validation correctly... but IMHO its content is not right. We should reuse the SPDX output module from Scancode.io (or inspire from it at https://github.com/nexB/scancode.io/blob/main/scanpipe/spdx/ )

[pombredanne]

Moving to 32.1 milestone for now.