Relationship field in tag/value parser rejects valid values

[matthewkmayer]

Thanks for making this Go library! Having the ability to use SPDX files in Go is excellent.

I think I've found a bug in how the tag/value parser handles Relationship fields: SPDX 2.2 specifies this example is valid:

Relationship: SPDXRef-BobBrowser CONTAINS NOASSERTION

However, with a file containing

Relationship: SPDXRef-ion-tester CONTAINS NOASSERTION

the tvloader.Load2_2(r) call returns an error stating missing SPDXRef- prefix for element identifier.

The same file successfully passes with the Java validator:

$ java -jar /tmp/tools-java-0.0.6-jar-with-dependencies.jar Verify ./spdx-test-1.spdx TAG

This SPDX Document is valid.

I've made a reproduction repository at https://github.com/matthewkmayer/spdx-go-repro . It can be cloned then run with go run . to see the error.

I tried to find tests for this scenario in this repo but didn't find any. Perhaps guidance on how to find the relevant tests could help us solve this. 👍

[swinslow]

Thanks Matt! This is a great catch. You're right, currently the parser for Relationships is probably assuming that both parts of the Relationship will be valid SPDX identifiers -- but yes, as of 2.2 it should catch NOASSERTION (and also NONE) as valid options here.

Thanks for filing this -- I will try to take a look at addressing this soon. I am trying to carve out some time to address a handful of other issues and PRs that folks have filed recently, so hopefully will be able to un-stick things soon :)