Repository navigation
feat: Implement SPDX Schema Validation - #101
saquibsaifee wants to merge 2 commits into
Conversation
|
@eaglei15 this PR is ready to be reviewed. |
Implements _validate_spdx_schema_version inside CLIController with proper SPDX validation logic via the official spdx-tools package. - Modifies src/controllers/cli_controller.py to import spdx-tools as a hard dependency. - Uses JsonLikeDictParser and validate_full_spdx_document to validate incoming SPDX dicts. - Supports SPDX 2.2 and 2.3 schema versions. - Adds comprehensive unit tests for both success and failure cases. - Updates pyproject.toml with the spdx-tools dependency. Signed-off-by: saquibsaifee <saquibsaifee2@gmail.com>
fdf2769 to
aa46c16
Compare
Signed-off-by: Saquib Saifee <saquibsaifee2@gmail.com>
drk-ram
left a comment
drk-ram
left a comment
There was a problem hiding this comment.
Security peer review of commit f53cdbca8f372b7feac8fe61d92cd0fc8a47e015.
No exploitable security vulnerability found in the changed code. The SPDX parser and full-document validator operate on structured document data; parsing errors, validation findings, and unexpected exceptions return False rather than accepting an invalid document.
Tests at that exact commit: the complete repository suite finished with 184 passed, 0 failed, and 28 passing subtests. The six CLI-controller tests, including the new valid/invalid SPDX cases, also passed in a focused run and are included in the full-suite count, not additional tests. The new dependency was supplied as spdx-tools 0.8.5 in isolated scratch space; existing environments and working files were not changed. Approved for this change's security scope.
🎯 What: The code health issue addressed was a dead, unimplemented method
_validate_spdx_schema_versioninsideCLIController.💡 Why: Implementing the proper SPDX schema validation logic allows a clean structural mapping for downstream operations. Using an official open source tool instead of creating our own makes the codebase better and more maintainable.
✅ Verification: Ran pytest unit tests, verified coverage, evaluated the solution structurally, and it has successfully passed the code review step.
✨ Result: A functioning, robust method in the CLI controller ready to be connected and called whenever SPDX validation is enabled.