Skip to content

Handle pre-3.0 specVersions in MultiFormatStore serialize guard.#139

Merged
goneall merged 1 commit intospdx:masterfrom
tiegz:tz/handle-older-spec-versions-in-serialize-guard
Apr 2, 2026
Merged

Handle pre-3.0 specVersions in MultiFormatStore serialize guard.#139
goneall merged 1 commit intospdx:masterfrom
tiegz:tz/handle-older-spec-versions-in-serialize-guard

Conversation

@tiegz
Copy link
Copy Markdown
Contributor

@tiegz tiegz commented Apr 1, 2026

In 42f69e2 a guard was added against the specVersion while serializing. It checks ">= '3.0'", but before 3.0 specVersion values looked like "SPDX-2.3" (correct me if I'm wrong). This adds a regression test and fix for the older versions.

This fixes a failure we ran into after upgrading to 2.0.5 of the library:

abc.def.TransformationException: Unable to serialize SPDX JSON for https://abc.def/spdx/some-project
      at app//abc.def.Spdx23SbomGenerator.serializeSbom(Spdx23SbomGenerator.java:87)

      Caused by:
      org.spdx.core.InvalidSPDXAnalysisException: Attempting to serialize an SPDX Spec version 3 model object
          at app//org.spdx.jacksonstore.MultiFormatStore.serialize(MultiFormatStore.java:186)
          at app//abc.def.Spdx23SbomGenerator.serializeSbom(Spdx23SbomGenerator.java:83)
          ... 2 more

@goneall
Copy link
Copy Markdown
Member

goneall commented Apr 2, 2026

@tiegz - I think you're right on this. I'm not sure how this made it past the unit tests. I'm going to do a bit of investigation on why the unit tests didn't catch this before merging.

@goneall
Copy link
Copy Markdown
Member

goneall commented Apr 2, 2026

Looks like I didn't have this particular method in the test cases

Thanks @tiegz for the PR!

@goneall goneall merged commit f518395 into spdx:master Apr 2, 2026
1 check passed
@tiegz tiegz deleted the tz/handle-older-spec-versions-in-serialize-guard branch April 3, 2026 01:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants