fix: provide better validation messages

src/main/java/com/redhat/exhort/integration/backend/sbom/spdx/SpdxParser.java

@@ -57,8 +57,11 @@ protected DependencyTree buildTree(InputStream input) {
       var deps = buildDeps(wrapper);
       var tree = new DependencyTree(deps);
       return tree;
+    } catch (SpdxValidationException e) {
+      LOGGER.info("Invalid SPDX SBOM received", e.getMessage());
+      throw new ClientErrorException(e.getMessage(), Response.Status.BAD_REQUEST);
     } catch (SpdxProcessingException | InvalidSPDXAnalysisException | IOException e) {
-      LOGGER.error("Unable to parse the SPDX SBOM file", e);
+      LOGGER.warn("Unable to parse the SPDX SBOM file", e);
       throw new ClientErrorException(
           "Unable to parse received SPDX SBOM file: " + e.getMessage(),
           Response.Status.BAD_REQUEST);

src/main/java/com/redhat/exhort/integration/backend/sbom/spdx/SpdxValidationException.java

@@ -0,0 +1,35 @@
+/*
+ * Copyright 2023 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.redhat.exhort.integration.backend.sbom.spdx;
+
+import java.util.List;
+
+public class SpdxValidationException extends SpdxProcessingException {
+
+  private final List<String> errors;
+
+  public SpdxValidationException(String expectedVersion, List<String> errors) {
+    super(expectedVersion + " Validation error. " + errors.toString());
+    this.errors = errors;
+  }
+
+  public List<String> getErrors() {
+    return errors;
+  }
+}

src/main/java/com/redhat/exhort/integration/backend/sbom/spdx/SpdxWrapper.java

@@ -53,7 +53,7 @@ public SpdxWrapper(MultiFormatStore inputStore, InputStream input)
     this.doc = new SpdxDocument(inputStore, uri, null, false);
     var verify = doc.verify(SUPPORTED_VERSION);
     if (!verify.isEmpty()) {
-      throw new SpdxProcessingException("Invalid " + SUPPORTED_VERSION + " document received");
+      throw new SpdxValidationException(SUPPORTED_VERSION, verify);
     }
     this.packages = parsePackages();
   }