-
Notifications
You must be signed in to change notification settings - Fork 72
Open
Description
Reported in Grype, an SPDX Tag-Value results in an error when containing ExternalDocumentRef properties following CreationInfo, e.g.:
SPDXVersion: SPDX-2.3
DataLicense: CC0-1.0
SPDXID: SPDXRef-DOCUMENT
DocumentName: qtdeclarative-6.9.2
DocumentNamespace: https://qt.io/spdxdocs/qtdeclarative-6.9.2
Creator: Organization: TheQtCompany
Creator: Tool: Qt Build System
CreatorComment: <text>This SPDX document was created from CMake 4.2.1, using the qt
build system from https://code.qt.io/cgit/qt/qtbase.git/tree/cmake/QtPublicSbomHelpers.cmake</text>
Created: 2025-12-10T14:36:14Z
ExternalDocumentRef: DocumentRef-qtbase https://qt.io/spdxdocs/qtbase-6.9.2 SHA1: ff0fb8281a7c2c2ce4878e5b353f6cff68c20ae1
ExternalDocumentRef: DocumentRef-qtsvg https://qt.io/spdxdocs/qtsvg-6.9.2 SHA1: acaa8ba43bfe23afb2b4e137044d20a2e1147462
PackageName: GNU
SPDXID: SPDXRef-compiler
PackageVersion: 15.2.1
PackageDownloadLocation: NOASSERTION
PackageLicenseConcluded: NOASSERTION
...
I suspect this is due to not handling it here
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels