Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Revise the implementation of check_dependency_relationships #182

Merged
merged 1 commit into from
Apr 14, 2024
Merged

Revise the implementation of check_dependency_relationships #182

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 14 additions & 4 deletions ntia_conformance_checker/sbom_checker.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@
import os
import sys

from spdx_tools.spdx.model import RelationshipType
from spdx_tools.spdx.parser import parse_anything
from spdx_tools.spdx.model.spdx_no_assertion import SpdxNoAssertion
from spdx_tools.spdx.parser.error import SPDXParsingError
Expand Down Expand Up @@ -61,10 +62,19 @@ def check_doc_version(self):
return True

def check_dependency_relationships(self):
"""Check for existence of any relationships."""
if len(self.doc.relationships) == 0:
return False
return True
"""Check that the document DESCRIBES at least one package."""
describes_relationships = [
rel
for rel in self.doc.relationships
if rel.relationship_type == RelationshipType.DESCRIBES
]

# Check if any of the "DESCRIBES" relationships describe a Package
describes_package = any(
"Package" in rel.related_spdx_element_id for rel in describes_relationships
)

return describes_package

def get_components_without_names(self):
"""Retrieve SPDX ID of components without names."""
Expand Down
Loading