Skip to content

Missing PackageVerificationCode should be flagged as invalid #845

Open
#893
Open
Missing PackageVerificationCode should be flagged as invalid#845
#893

Description

@vargenau
vargenau
opened on Mar 5, 2025

MEV.spdx.txt

pyspdxtools -i MEV.spdx

gives no error, so the SPDX SBOM is valid.

However, as there is no FilesAnalyzed, it defaults to true so PackageVerificationCode is mandatory.

So the SBOM should be flagged as invalid.

See also: spdx/tools-java#188

Activity

  1. vargenau
    changed the title [-]Missing PackageVerificationCode should be flaaged as invalid[/-] [+]Missing PackageVerificationCode should be flagged as invalid[/+] on Jul 3, 2025
  2. jesseporter
    added a commit that references this issue on Jun 7, 2026

    Enforce packageVerificationCode when filesAnalyzed is true

    731f204

  3. jesseporter commented on Jun 7, 2026

    @jesseporter
    jesseporter
    on Jun 7, 2026

    I would like to contribute a fix for this issue.

  4. jesseporter
    added 2 commits that reference this issue on Jun 7, 2026

    Enforce packageVerificationCode when filesAnalyzed is true

    4281b56

    Enforce packageVerificationCode when filesAnalyzed is true

    e02fde5
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions