From 09f6b3b4b0ecc6826c8521bd1f3ceb29749f0469 Mon Sep 17 00:00:00 2001 From: Frank Viernau Date: Thu, 11 Jun 2026 15:22:57 +0200 Subject: [PATCH] Fix an issues with `SpdxPackage._verify()` The specification for SPDX v2.3 seems to not require that for each `SpdxPackage` all files which in reality correspond to that package have to be included as `SpdxFile` in case files have been analyzed, namely `filesAnalyzed` is set to `true` [1]. This allows the freedom for the creator of on SPDX document to only selectively include certain files. For example, a tool may analyze all files of a package for license texts, but choose to only selectively include certain files containing license texts as `SpdxFile` entry into the SPDX document, for example to reduce the size of the SPDX document a bit, or to omit information which is less relevant in the given context. This implies, that it should also be valid to not include any files for a package at all, even though its files have been analyzed. However, `_verify()` complains if `filesAnalyzed && files.size() == 0` which seems incorrect. Drop that check to align with the spec. [1] https://spdx.github.io/spdx-spec/v2.3/package-information/#78-files-analyzed-field Signed-off-by: Frank Viernau --- src/main/java/org/spdx/library/model/v2/SpdxPackage.java | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/src/main/java/org/spdx/library/model/v2/SpdxPackage.java b/src/main/java/org/spdx/library/model/v2/SpdxPackage.java index 8ed6cdd..f95531d 100644 --- a/src/main/java/org/spdx/library/model/v2/SpdxPackage.java +++ b/src/main/java/org/spdx/library/model/v2/SpdxPackage.java @@ -608,11 +608,7 @@ protected List _verify(Set verifiedIds, String specVersion) { // files depends on if the filesAnalyzed flag try { - if (getFiles().size() == 0) { - if (filesAnalyzed) { - retval.add("Missing required package files for "+pkgName); - } - } else { + if (!getFiles().isEmpty()) { if (!filesAnalyzed) { retval.add("Warning: Found analyzed files for package "+pkgName+" when analyzedFiles is set to false."); }