Inconsistent warnings for including verification code when files not analyzed while validating SBOM
JohnnyHobbs opened this issue · 2 comments
JohnnyHobbs commented
In the attached, 52 of the 65 packages have filesAnalyzed set to false and have a packageVerificationCode, but only 4 get a warning, while jquery.cookie also has filesAnalyzed set to false and does not have a packageVerificationCode, but does get the warning, " Verification code must not be included when files not analyzed."
Inconsistencies.json
goneall commented
Thanks @JohnnyHobbs for reporting this. It looks like this issue has been fixed in the spdx-java-library which is used by the online tool.
We just need to update to the latest version. I'm hoping to do a release over the next week or so.