-
Notifications
You must be signed in to change notification settings - Fork 44
Description
Hello, I tried the new version of the library (2.0.0-RC2) and the examples from the file https://github.com/spdx/Spdx-Java-Library/blob/master/GETTING-STARTED.md. I found that this code does not compile due to errors.
1 Such class does not exist in this library SpdxModelClassFactory. There is a class SpdxModelClassFactoryV3, was it supposed to be used?
CreationInfo creationInfo = SpdxModelClassFactory.createCreationInfo(
modelStore, prefix + "Agent/Gary01123", "Gary O'Neall",
copyManager);
2 There is an error here too - this method returns an object of the ModelObjectV3 class, not Sbom. To get Sbom, you need to cast it.
Sbom sbom = SpdxModelClassFactory.getModelObject(modelStore,
prefix + "sbom/mysbom", SpdxConstantsV3.SOFTWARE_SBOM,
copyManager, true, prefix);
Sbom sbom = (Sbom) SpdxModelClassFactoryV3.getModelObject(
3 In the SPDX 2 standard version, the SPDX document(SpdxDocument class) was filled in, in the new example there is no mention of this entity, but how is it supposed to serialize the sbom into text?
P.S.
It would be great to see examples of java code with a full cycle of creating a spdx sbom document, filling it with data (components, licenses, vulnerabilities, files) and serializing it (to text/json), this would greatly facilitate the work with your library for third-party programmers. Thank you for your work.