Merge branch 'main' into fix-markdown-readme

armintaenzertng · web-flow · commit 9cf1afa673f7 · 2026-01-09T16:12:56.000+01:00
diff --git a/.github/workflows/check_codestyle.yml b/.github/workflows/check_codestyle.yml
@@ -20,13 +20,7 @@ jobs:
     strategy:
       matrix:
         os: [ ubuntu-latest, macos-latest, windows-latest ]
-        python-version: [ "3.7", "3.8", "3.9", "3.10", "3.11" ]
-        exclude: # see https://github.com/actions/runner-images/issues/9770#issuecomment-2085623315
-          - python-version: "3.7"
-            os: macos-latest
-        include:
-          - python-version: "3.7"
-            os: macos-13
+        python-version: [ "3.14" ]
 
     steps:
       - uses: actions/checkout@v3
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
@@ -19,7 +19,7 @@ jobs:
       - name: Setup Python
         uses: actions/setup-python@v4
         with:
-          python-version: '3.11'
+          python-version: '3.14'
       - name: Install dependencies
         run: |
           sudo apt-get install graphviz-dev
@@ -28,7 +28,7 @@ jobs:
       - name: Generate docs
         run: pdoc spdx_tools -o docs/
       - name: Upload docs as artifact
-        uses: actions/upload-pages-artifact@v1
+        uses: actions/upload-pages-artifact@v3
         with:
           path: docs/
 
diff --git a/.github/workflows/install_and_test.yml b/.github/workflows/install_and_test.yml
@@ -17,13 +17,7 @@ jobs:
     strategy:
       matrix:
         os: [ ubuntu-latest, macos-latest, windows-latest ]
-        python-version: [ "3.7", "3.8", "3.9", "3.10", "3.11" ]
-        exclude: # see https://github.com/actions/runner-images/issues/9770#issuecomment-2085623315
-          - python-version: "3.7"
-            os: macos-latest
-        include:
-          - python-version: "3.7"
-            os: macos-13
+        python-version: [ "3.10", "3.11", "3.12", "3.13", "3.14" ]
 
     steps:
       - uses: actions/checkout@v3
diff --git a/.github/workflows/integration_test.yml b/.github/workflows/integration_test.yml
@@ -13,10 +13,10 @@ jobs:
 
     steps:
       - uses: actions/checkout@v3
-      - name: Set up Python 3.11
+      - name: Set up Python 3.14
         uses: actions/setup-python@v4
         with:
-          python-version: 3.11
+          python-version: 3.14
       - name: Installation
         run: |
           python -m pip install --upgrade pip
diff --git a/.github/workflows/prepare_release.yml b/.github/workflows/prepare_release.yml
@@ -19,7 +19,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v4
         with:
-          python-version: '3.7'
+          python-version: '3.14'
       - name: Set up dependencies
         run: |
           python -m pip install --upgrade pip
diff --git a/README.md b/README.md
@@ -20,7 +20,10 @@ The main features of v0.8 are:
   stable at this point, as the spec is still evolving. SPDX3-related code is contained in a separate subpackage "spdx3"
   and its use is optional. We do not recommend using it in production code yet.
 
-## Information
+Note that v0.8 only supports **writing**, not **reading** SPDX 3.0 documents.
+See [#760](https://github.com/spdx/tools-python/issues/760) for details.
+
+# Information
 
 This library implements SPDX parsers, convertors, validators and handlers in Python.
 
diff --git a/pyproject.toml b/pyproject.toml
@@ -16,22 +16,21 @@ classifiers = [
     "Intended Audience :: Developers",
     "Intended Audience :: System Administrators",
     "License :: OSI Approved :: Apache Software License",
-    "Programming Language :: Python :: 3.7",
     "Programming Language :: Python :: 3.8",
     "Programming Language :: Python :: 3.9",
     "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
 ]
 urls = { Homepage = "https://github.com/spdx/tools-python" }
-requires-python = ">=3.7"
+requires-python = ">=3.8"
 dependencies = ["click", "pyyaml", "xmltodict", "rdflib", "beartype", "uritools", "license_expression", "ply", "semantic_version"]
 dynamic = ["version"]
 
 [project.optional-dependencies]
 test = ["pytest", "pyshacl", "tzdata"]
 code_style = ["isort", "black", "flake8"]
 graph_generation = ["pygraphviz", "networkx"]
-development = ["black", "flake8", "isort", "networkx", "pytest"]
+development = ["black", "flake8", "isort", "networkx", "pytest", "pyshacl"]
 
 [project.scripts]
 pyspdxtools = "spdx_tools.spdx.clitools.pyspdxtools:main"
diff --git a/src/spdx_tools/common/typing/dataclass_with_properties.py b/src/spdx_tools/common/typing/dataclass_with_properties.py
@@ -4,7 +4,7 @@
 from dataclasses import dataclass
 
 from beartype import beartype
-from beartype.roar import BeartypeCallHintException
+from beartype.roar import BeartypeCallHintParamViolation
 
 
 def dataclass_with_properties(cls):
@@ -30,7 +30,7 @@ def set_field(self, value: field_type):
     def set_field_with_error_conversion(self, value: field_type):
         try:
             set_field(self, value)
-        except BeartypeCallHintException as err:
+        except BeartypeCallHintParamViolation as err:
             error_message: str = f"SetterError {self.__class__.__name__}: {err}"
 
             # As setters are created dynamically, their argument name is always "value". We replace it by the
diff --git a/src/spdx_tools/spdx/parser/json/json_parser.py b/src/spdx_tools/spdx/parser/json/json_parser.py
@@ -3,14 +3,33 @@
 # SPDX-License-Identifier: Apache-2.0
 import json
 
-from beartype.typing import Dict
+from beartype.typing import Any, Dict
 
 from spdx_tools.spdx.model import Document
 from spdx_tools.spdx.parser.jsonlikedict.json_like_dict_parser import JsonLikeDictParser
 
+# chars we don't want to see in SBOMs
+CONTROL_CHARS_MAP = {
+    8: None,  # ASCII/UTF-8: backspace
+    12: None,  # ASCII/UTF-8: formfeed
+}
+
+
+def remove_control_chars_from_value(value: Any) -> Any:
+    if isinstance(value, str):
+        return value.translate(CONTROL_CHARS_MAP)
+    elif isinstance(value, list):
+        for i in range(len(value)):
+            value[i] = remove_control_chars_from_value(value[i])
+    return value
+
+
+def remove_json_control_chars_hook(pairs: list) -> dict:
+    return {k: remove_control_chars_from_value(v) for k, v in pairs}
+
 
 def parse_from_file(file_name: str, encoding: str = "utf-8") -> Document:
     with open(file_name, encoding=encoding) as file:
-        input_doc_as_dict: Dict = json.load(file)
+        input_doc_as_dict: Dict = json.load(file, object_pairs_hook=remove_json_control_chars_hook)
 
     return JsonLikeDictParser().parse(input_doc_as_dict)
diff --git a/src/spdx_tools/spdx/parser/jsonlikedict/snippet_parser.py b/src/spdx_tools/spdx/parser/jsonlikedict/snippet_parser.py
@@ -127,7 +127,7 @@ def validate_pointer_and_get_type(pointer: Dict) -> RangeType:
 
     @staticmethod
     def convert_range_from_str(
-        _range: Tuple[Union[int, str], Union[int, str]]
+        _range: Tuple[Union[int, str], Union[int, str]],
     ) -> Tuple[Union[int, str], Union[int, str]]:
         # XML does not support integers, so we have to convert from string (if possible)
         if not _range:
diff --git a/src/spdx_tools/spdx/parser/parse_anything.py b/src/spdx_tools/spdx/parser/parse_anything.py
@@ -12,14 +12,15 @@
 import logging
 
 from spdx_tools.spdx.formats import FileFormat, file_name_to_format
+from spdx_tools.spdx.model import Document
 from spdx_tools.spdx.parser.json import json_parser
 from spdx_tools.spdx.parser.rdf import rdf_parser
 from spdx_tools.spdx.parser.tagvalue import tagvalue_parser
 from spdx_tools.spdx.parser.xml import xml_parser
 from spdx_tools.spdx.parser.yaml import yaml_parser
 
 
-def parse_file(file_name: str, encoding: str = "utf-8"):
+def parse_file(file_name: str, encoding: str = "utf-8") -> Document:
     if encoding != "utf-8":
         logging.warning(
             "It's recommended to use the UTF-8 encoding for any SPDX file. Consider changing the encoding of the file."
diff --git a/src/spdx_tools/spdx/validation/uri_validators.py b/src/spdx_tools/spdx/validation/uri_validators.py
@@ -12,23 +12,26 @@
     "\\/\\/|ftp:\\/\\/)?([\\w\\-.!~*'()%;:&=+$,]+@)?[a-z0-9]+([\\-\\.]{1}[a-z0-9]+){0,100}\\.[a-z]{2,5}"
     "(:[0-9]{1,5})?(\\/.*)?"
 )
+url_pattern_ignore_case = re.compile(url_pattern, re.IGNORECASE)
+
 supported_download_repos: str = "(git|hg|svn|bzr)"
 git_pattern = "(git\\+git@[a-zA-Z0-9\\.\\-]+:[a-zA-Z0-9/\\\\.@\\-]+)"
 bazaar_pattern = "(bzr\\+lp:[a-zA-Z0-9\\.\\-]+)"
 download_location_pattern = (
     "^(((" + supported_download_repos + "\\+)?" + url_pattern + ")|" + git_pattern + "|" + bazaar_pattern + ")$"
 )
+compiled_pattern = re.compile(download_location_pattern, re.IGNORECASE)
 
 
 def validate_url(url: str) -> List[str]:
-    if not re.match(url_pattern, url):
+    if not url_pattern_ignore_case.match(url):
         return [f"must be a valid URL, but is: {url}"]
 
     return []
 
 
 def validate_download_location(location: str) -> List[str]:
-    if not (validate_url(location) == [] or re.match(download_location_pattern, location)):
+    if not (validate_url(location) == [] or compiled_pattern.match(location)):
         return [f"must be a valid URL or download location according to the specification, but is: {location}"]
 
     return []
diff --git a/src/spdx_tools/spdx3/bump_from_spdx2/relationship.py b/src/spdx_tools/spdx3/bump_from_spdx2/relationship.py
@@ -218,7 +218,7 @@ def bump_relationship(
 
 
 def determine_completeness_and_to(
-    related_spdx_element_id: Union[str, SpdxNone, SpdxNoAssertion]
+    related_spdx_element_id: Union[str, SpdxNone, SpdxNoAssertion],
 ) -> Tuple[Optional[RelationshipCompleteness], List[str]]:
     if isinstance(related_spdx_element_id, SpdxNoAssertion):
         completeness = RelationshipCompleteness.NOASSERTION
diff --git a/src/spdx_tools/spdx3/writer/console/__init__.py b/src/spdx_tools/spdx3/writer/console/__init__.py
@@ -1,5 +1,5 @@
 # SPDX-FileCopyrightText: 2023 spdx contributors
 #
 # SPDX-License-Identifier: Apache-2.0
-""" This is a temporary package to write the implemented model of spdx_tools.spdx3.0 to console. As soon as
-    serialization formats are properly defined this package can be deleted."""
+"""This is a temporary package to write the implemented model of spdx_tools.spdx3.0 to console. As soon as
+serialization formats are properly defined this package can be deleted."""
diff --git a/src/spdx_tools/spdx3/writer/console/relationship_writer.py b/src/spdx_tools/spdx3/writer/console/relationship_writer.py
@@ -12,5 +12,5 @@ def write_relationship(relationship: Relationship, text_output: TextIO, heading:
     if heading:
         text_output.write("## Relationship\n")
     write_element_properties(relationship, text_output)
-    for property_name in relationship.__annotations__.keys():
+    for property_name in Relationship.__annotations__.keys():
         write_value(property_name, getattr(relationship, property_name), text_output)
diff --git a/src/spdx_tools/spdx3/writer/json_ld/json_ld_writer.py b/src/spdx_tools/spdx3/writer/json_ld/json_ld_writer.py
@@ -2,20 +2,24 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 import json
-import os
+from importlib import resources
 
 from spdx_tools.spdx3.payload import Payload
-from spdx_tools.spdx3.writer.json_ld.json_ld_converter import convert_payload_to_json_ld_list_of_elements
+from spdx_tools.spdx3.writer.json_ld.json_ld_converter import (
+    convert_payload_to_json_ld_list_of_elements,
+)
 
 
 def write_payload(payload: Payload, file_name: str):
     element_list = convert_payload_to_json_ld_list_of_elements(payload)
 
     # this will be obsolete as soon as the context is publicly available under some URI
-    with open(os.path.join(os.path.dirname(__file__), "context.json"), "r") as infile:
+    # Note: 3.0.1 context is now available at
+    # https://spdx.org/rdf/3.0.1/spdx-context.jsonld
+    with resources.files("spdx_tools.spdx3.writer.json_ld").joinpath("context.json").open("r") as infile:
         context = json.load(infile)
 
     complete_dict = {"@context": context, "@graph": element_list}
 
-    with open(file_name + ".jsonld", "w") as out:
+    with open(file_name + ".jsonld", "w", encoding="utf-8") as out:
         json.dump(complete_dict, out, indent=2)
diff --git a/src/spdx_tools/spdx3/writer/json_ld/owl_to_context.py b/src/spdx_tools/spdx3/writer/json_ld/owl_to_context.py
@@ -2,7 +2,7 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 import json
-import os.path
+from importlib import resources
 
 # current workflow: markdown files + spec_parser -> model.ttl -> convert to json_ld: SPDX_OWL.json ->
 # use the function below to generate context.json
@@ -108,8 +108,11 @@ def convert_spdx_owl_to_jsonld_context(spdx_owl: str = "SPDX_OWL.json"):
         else:
             print(f"unknown node_type: {node_type}")
 
-    with open(os.path.join(os.path.dirname(__file__), "context.json"), "w") as infile:
-        json.dump(context_dict, infile)
+    with resources.as_file(
+        resources.files("spdx_tools.spdx3.writer.json_ld").joinpath("context.json")
+    ) as context_path:
+        with open(context_path, "w", encoding="utf-8") as outfile:
+            json.dump(context_dict, outfile)
 
 
 if __name__ == "__main__":
diff --git a/tests/spdx/data/ControlCharacters.spdx.json b/tests/spdx/data/ControlCharacters.spdx.json
@@ -0,0 +1,46 @@
+{
+    "spdxVersion": "SPDX-2.2",
+    "dataLicense": "CC0-1.0",
+    "SPDXID": "SPDXRef-DOCUMENT",
+    "creationInfo": {
+        "created": "2020-11-24T01:12:27Z",
+        "creators": ["Person: Nisha \b\f K (nishak@vmware.com)"]
+    },
+    "name": "golang-dist",
+    "documentNamespace": "https://swinslow.net/spdx-examples/example7/golang-dist-492dfde4-318b-49f7-b48c-934bfafbde48",
+    "documentDescribes": ["SPDXRef-golang-dist"],
+    "packages": [
+        {
+            "name": "go1.16.4.linux-amd64",
+            "SPDXID": "SPDXRef-golang-dist",
+            "downloadLocation": "https://golang.org/dl/go1.16.4.linux-amd64.tar.gz",
+            "versionInfo": "1.16.4",
+            "filesAnalyzed": false,
+            "checksums": [
+                {
+                    "algorithm": "SHA256",
+                    "checksumValue": "7154e88f5a8047aad4b80ebace58a059e36e7e2e4eb3b383127a28c711b4ff59"
+                }
+            ],
+            "licenseConcluded": "NOASSERTION",
+            "licenseDeclared": "LicenseRef-Golang-BSD-plus-Patents",
+            "copyrightText": "Copyright (c) 2009 The Go Authors. \b All rights reserved."
+        },
+        {
+            "name": "go",
+            "SPDXID": "SPDXRef-go-compiler",
+            "downloadLocation": "https://golang.org/dl/go1.16.4.linux-amd64.tar.gz",
+            "versionInfo": "1.16.4",
+            "filesAnalyzed": false,
+            "licenseConcluded": "NOASSERTION",
+            "licenseDeclared": "NOASSERTION",
+            "copyrightText": "NOASSERTION"
+        }
+    ],
+    "hasExtractedLicensingInfos": [
+        {
+            "licenseId": "LicenseRef-Golang-BSD-plus-Patents",
+            "extractedText": "Golang BSD plus Patents \"\\\/\b\f\n\r\t"
+        }
+    ]
+}
diff --git a/tests/spdx/parser/jsonlikedict/test_json_parser.py b/tests/spdx/parser/jsonlikedict/test_json_parser.py
@@ -0,0 +1,11 @@
+import os
+
+from spdx_tools.spdx.parser.json import json_parser
+
+
+def test_parse_control_characters():
+    doc = json_parser.parse_from_file(
+        os.path.join(os.path.dirname(__file__), "../../data/ControlCharacters.spdx.json")
+    )
+    assert doc.creation_info.creators[0].name == "Nisha  K"
+    assert doc.extracted_licensing_info[0].extracted_text == 'Golang BSD plus Patents "\\/\n\r\t'
diff --git a/tests/spdx/test_cli.py b/tests/spdx/test_cli.py
diff --git a/tests/spdx/validation/test_uri_validators.py b/tests/spdx/validation/test_uri_validators.py
diff --git a/tests/spdx3/writer/json_ld/test_json_ld_writer.py b/tests/spdx3/writer/json_ld/test_json_ld_writer.py
