Invalid SPDX: missing copyright text

[vargenau]

What happened:

Generated SPDX is invalid, mandatory copyright text is missing

What you expected to happen:

SPDX should be valid

Steps to reproduce the issue:

syft docker:bitnami/mongodb:6.0.6-debian-11-r0 --scope all-layers -o spdx-tag-value@2.2 > mongodb-6.0.6-debian-11-r0.spdx

Anything else we need to know?:

Environment:

• Output of syft version:

Application: syft
Version:    1.14.1
BuildDate:  2024-10-15T12:50:47Z
GitCommit:  Homebrew
GitDescription: [not provided]
Platform:   darwin/arm64
GoVersion:  go1.23.2
Compiler:   gc

• OS (e.g: cat /etc/os-release or similar):
  macOS 14.7

[kzantow]

Hey @vargenau -- would you mind posting the error you are getting? We seem to be having issues running the online validator on this SBOM. Thanks!

[vargenau]

Hello,

It's better to download and install locally the Java tools https://github.com/spdx/tools-java or the Python tools https://github.com/spdx/tools-python than using the online tools for big SPDX files.

This is the generated SBOM:
mongodb-6.0.6-debian-11-r0.spdx.txt

Running

pyspdxtools -i mongodb-6.0.6-debian-11-r0.spdx

gives the following result:
pyspdxtools.txt

Most errors are related to #2093

But for this bug report you have:

copyright_text is mandatory in SPDX-2.2

The Java tools give:
javatools.zip

[kzantow]

Thanks @vargenau. I do see the Copyright Text is a mandatory field in SPDX 2.2. We should default this to NOASSERTION, like we do for other required fields. I've added this to the backlog and always happy to review any pull requests!