fix(parser): treat SPDX NOASSERTION/NONE version & supplier as unknown#55
Open
dmchaledev wants to merge 1 commit into
Open
fix(parser): treat SPDX NOASSERTION/NONE version & supplier as unknown#55dmchaledev wants to merge 1 commit into
dmchaledev wants to merge 1 commit into
Conversation
SPDX generators frequently emit the spec sentinels "NOASSERTION" (and
"NONE") for fields they can't determine. parseSPDX stored these verbatim,
so a package with versionInfo "NOASSERTION" in the old SBOM and a real
version in the new one was reported as a spurious upgrade
("NOASSERTION -> 2.0.0"), corrupting the tool's headline output.
Normalize these sentinels (and empty strings) to undefined for the
version and supplier fields, so the diff's "both versions known" guard
correctly skips packages whose prior version was never asserted. License
normalization is intentionally left to PR #32.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvD9bHmeu7mjeUpLNKzovy
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
SPDX SBOM generators (syft, and many others) routinely emit the spec sentinels
NOASSERTIONandNONEfor package fields they can't determine.parseSPDX()stored these strings verbatim inComponent.versionandComponent.supplier, so the sentinel leaked into the diff as if it were real data.The concrete failure is in the tool's headline output — upgrade detection. A package whose version is
NOASSERTIONin the old SBOM and a real version in the new one is reported as a bogus upgrade:Before (real CLI output,
internal-libhasversionInfo: "NOASSERTION"→"2.0.0"):NOASSERTIONmeans "the version was never asserted" — we do not know the old version, so we cannot claim it was upgraded. This is noise that undermines a CI gate / audit report.After: the sentinel collapses to
undefined, anddiff()'s existing "both versions known" guard (aComp.version && bComp.version,src/diff.ts:23) correctly skips it — no spurious upgrade.Changes
src/parser.ts: newnormalizeSPDXValue()helper treatsNOASSERTION,NONE, and empty/whitespace strings as "no value" (undefined). Applied toversionInfoandsupplierinparseSPDX().src/__tests__/parser.test.ts: adds coverage for sentinel normalization and for the no-spurious-upgrade behavior end-to-end throughdiff().Scope / relationship to other work
Intentionally narrow and confined to
parseSPDX(). License normalization forNOASSERTIONis a separate concern already handled by #32, so this PR deliberately leaveslicenseConcludeduntouched to avoid conflict. It also doesn't overlap with the in-flight purl-keying / upgrade-detection PRs — it fixes a distinct data-quality bug at the parse layer.Testing
npx tsc --noEmit— cleannpm run lint— cleannpm test— 40 passed (3 new)Backward compatible: only previously-
NOASSERTION/NONE/empty version and supplier values change (from a meaningless string toundefined); any concrete value is unaffected.🤖 Generated with Claude Code
Generated by Claude Code