Invalid SPDX 3 generated when converting from SPDX 2 to SPDX 3

[vargenau]

zipp-3.23.1.spdx.json
zipp-3.23.1.spdx3.json

Converting zipp-3.23.1.spdx.json (SPDX 2) to zipp-3.23.1.spdx3.json (SPDX 3) with Java tools 2.0.6

Generated code is invalid according to https://github.com/JPEWdev/spdx3-validate

spdx3-validate --json zipp-3.23.1.spdx3.json 
✔ Loading zipp-3.23.1.spdx3.json
✔ Loading SPDX 3.0.1
✔ Validating schema for zipp-3.23.1.spdx3.json
✖ Checking SHACL for zipp-3.23.1.spdx3.json
ERROR: SHACL Validation failed for zipp-3.23.1.spdx3.json:
Violation of type sh:ClassConstraintComponent:
	Severity: sh:Violation
	Source Shape:
		@prefix sh: <http://www.w3.org/ns/shacl#> .
		@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .

		[] sh:class <https://spdx.org/rdf/3.0.1/terms/SimpleLicensing/AnyLicenseInfo> ;
		    sh:maxCount 1 ;
		    sh:nodeKind sh:IRI ;
		    sh:path <https://spdx.org/rdf/3.0.1/terms/Core/dataLicense> .
	Focus Node: <https://pypi.org/spdx/zipp-3.23.1-specv3/document0>
	Value Node: <http://spdx.org/licenses/CC0-1.0>
	Result path: <https://spdx.org/rdf/3.0.1/terms/Core/dataLicense>
	Message: Value does not have class <https://spdx.org/rdf/3.0.1/terms/SimpleLicensing/AnyLicenseInfo>

Violation of type sh:ClassConstraintComponent:
	Severity: sh:Violation
	Source Shape:
		@prefix sh: <http://www.w3.org/ns/shacl#> .
		@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .

		[] sh:class <https://spdx.org/rdf/3.0.1/terms/Core/Element> ;
		    sh:minCount 1 ;
		    sh:nodeKind sh:IRI ;
		    sh:path <https://spdx.org/rdf/3.0.1/terms/Core/to> .
	Focus Node: <https://pypi.org/spdx/zipp-3.23.1-specv3/SPDXRef-gnrtd6>
	Value Node: <http://spdx.org/licenses/MIT>
	Result path: <https://spdx.org/rdf/3.0.1/terms/Core/to>
	Message: Value does not have class ns1:Element

Violation of type sh:ClassConstraintComponent:
	Severity: sh:Violation
	Source Shape:
		@prefix sh: <http://www.w3.org/ns/shacl#> .
		@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .

		[] sh:class <https://spdx.org/rdf/3.0.1/terms/Core/Element> ;
		    sh:minCount 1 ;
		    sh:nodeKind sh:IRI ;
		    sh:path <https://spdx.org/rdf/3.0.1/terms/Core/to> .
	Focus Node: <https://pypi.org/spdx/zipp-3.23.1-specv3/SPDXRef-gnrtd4>
	Value Node: <http://spdx.org/licenses/MIT>
	Result path: <https://spdx.org/rdf/3.0.1/terms/Core/to>
	Message: Value does not have class ns1:Element

[vargenau]

And the document is considered valid by Java tools.

[bact]

I think this is about the different assumption of the existence of an SPDX Listed License -- as a valid SPDX 3 object.

The URL here http://spdx.org/licenses/CC0-1.0 is resolvable, but what the URL returns is a HTML page -- not a Listed License.

spdx3-validate is looking at actual declaration, and since there's no import of the license, it is invalid.

While tools-java may take the design intention that anything under "https://spdx.org/licenses/" is very likely a listed license and treated it as valid.

In any case, we may like all of the implementations interpret this the same way.