Repository navigation
Reject SPDX exports when file checksums are missing - #5414
Open
Shrashti1234 wants to merge 1 commit into
Open
Shrashti1234 wants to merge 1 commit into
Shrashti1234 wants to merge 1 commit into
Conversation
Stop substituting the empty-file SHA1 for files whose checksum is unknown. Raise a clear error directing users to collect checksums with --info, while preserving known checksums and the empty-file special case. Add writer and CLI regressions for both SPDX formats, document the requirement, and give the Unicode scan fixture the checksum of its included synthetic SVG. The full SPDX suite passes: 38 tests on Windows/Python 3.14.2. Fixes aboutcode-org#3453 Signed-off-by: Shrashti1234 <sharishhtia@gmail.com>
Shrashti1234
force-pushed
the
reject-missing-spdx-file-checksums
branch
from
November 5, 2026 04:22
035fdb3 to
c5e84a4
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #3453.
A file without a SHA1 currently receives the SHA1 of an empty file in SPDX output. This misrepresents the file and produces an incorrect package verification code. Reject that export with a clear error naming the file and explaining that a scan with
--infois needed to collect checksums.Known SHA1 values remain unchanged. Files identified as empty retain their correct empty-file hash, and directories do not require checksums. This applies to both Tag/Value and RDF output.
Changes and validation
--info.python -m pytest tests/formattedcode/test_output_spdx.py --test-suite=all -q --tb=short --disable-warningsgit diff --checkpassed. Commits include DCO sign-off.The repository-wide suite was not run locally. Known base-branch FSL metadata and parallel test-runner CI issues are covered separately by #5408. Hosted checks for this PR are pending.