Do not attempt to write empty package info to SPDX

[ThorstenHarter]

When you scan a component without any copyright or license info, ScanCode will report an error:
spdx.writers.tagvalue.InvalidDocumentError: [u'Package must have at least one file.']

Adding a check before writing spdx_output will fix this problem, the output file will only contain the string ""# No results for package [name]."

Signed-off-by: Thorsten Harter thorsten.harter@gmx.net

[pombredanne]

@ThorstenHarter Thank you for this PR! This makes sense to me though it may be a tad surprising to have nothing written at all in this case?

In fact we have discussed with SPDX on ways to relax the spec to allow writing documents that would have no files alright.

Do you think you could add a small test for this?
Here is an example using these scanned files (under /scan) and expected files: https://github.com/nexB/scancode-toolkit/tree/fd2e483e346a38ee9634538a0f05ca4dd96fb622/tests/formattedcode/data/spdx/tree

In your case you would expect no file at all so I guess the test would check that the written file does not exist?

Do you mind also adding a line at the end of your commit message with:
Signed-off-by: Your Name <your email>

We use the same sign-off way that's used in the kernel. See also https://github.com/nexB/scancode-toolkit/blob/develop/CONTRIBUTING.rst for extra details
Alternatively you can add this signoff in a PR message

@yash-nisar ping FYI since that's an area of interest.
@sschuberth ping too for review

[pombredanne]

You could also write the simpler form: if package.files:

[pombredanne]

You likely do not need to repeat this test here since this is already True based on your test above.

[codecov]

Codecov Report

Merging #1011 into develop will increase coverage by 0.05%.
The diff coverage is 100%.

@@             Coverage Diff             @@
##           develop    #1011      +/-   ##
===========================================
+ Coverage    79.12%   79.17%   +0.05%     
===========================================
  Files          104      104              
  Lines        12971    12972       +1     
===========================================
+ Hits         10263    10271       +8     
+ Misses        2708     2701       -7

Impacted Files	Coverage Δ
src/formattedcode/output_spdx.py	86.57% <100%> (+0.09%)	⬆️
src/scancode/cli.py	75.23% <0%> (+0.37%)	⬆️
src/scancode/api.py	94.4% <0%> (+0.8%)	⬆️
src/scancode_config.py	67.85% <0%> (+7.14%)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update fd2e483...227b8f9. Read the comment docs.

[ThorstenHarter]

@pombredanne : The output SPDX file is created, because of this code at line 250ff:

    if len(package.files) == 0:
        if as_tagvalue:
            output_file.write("# No results for package '{}'.\n".format(package.name))
        else:
            output_file.write("<!-- No results for package '{}'. -->\n".format(package.name))

For example: # No results for package 'test'.

[pombredanne]

I respun the build on Appveyor that failed for some mysterious reason

[pombredanne]

@ThorstenHarter This is merged with: 71128eb
I ameneded your commits to add the signoff that you added to this PR message : Signed-off-by: Thorsten Harter <thorsten.harter@gmx.net> and pushed some tests too.

I also created a follow up #1016 as we should not produce a mostly empty document IMHO in these cases.

Thank you ++