Invalid SPDX with empty file: no SHA1

[vargenau]

Description

Generated SPDX is invalid as no SHA1 is provided.

FileName: ./phpwiki/blank.htm
SPDXID: SPDXRef-3
FileChecksum: SHA1:
LicenseConcluded: NOASSERTION
LicenseInfoInFile: NONE
FileCopyrightText: NONE

How To Reproduce

svn checkout https://svn.code.sf.net/p/phpwiki/code/trunk phpwiki

./scancode -c -l -i --license-text --spdx-tv phpwiki.spdx phpwiki

System configuration

./scancode --version
ScanCode version: 32.0.0rc1
ScanCode Output Format version: 3.0.0
SPDX License list version: 3.19

Ubuntu 22.10

[vargenau]

Resulting SPDX file:

phpwiki.spdx.txt

There are 4 empty files that have no SHA1.

[AyanSinhaMahapatra]

Thanks for the report!

This is tracked here: #461

[vargenau]

I have provided a fix: #3279

The SHA1 for an empty file is hard-coded, there is perhaps a better way to do it.

[pombredanne]

Thanks. This works as a fix! In earnest this is a major wart in SPDX. Because of this and a few other, I never saw a package verification code matching when computed by two different tools :]

[Jeeppler]

@vargenau why not just calculating the sha1 sum for an empty file, like for any other file?

I mean I do get the same value as you have hard-coded:

$ sha1sum empty 
da39a3ee5e6b4b0d3255bfef95601890afd80709  empty

However, that means you have to differentiate between empty and non empty files.

[vargenau]

I will let @pombredanne and @AyanSinhaMahapatra comment.
My understanding is that they do not want to store the SHA1 of empty files because that would make all empty files match.
So as the SHA1 is not stored, I have to put it in at the time of SPDX creation (in order to have valid SPDX).