spdx
FileName: question about expected behavior
The 2.3 spec for File Information clearly asks for following format:
A relative filename with the root of the package archive or directory.
In general, every filename is preceded with a ./, see http://www.ietf.org/rfc/rfc3986.txt for syntax.
However, some tools (including trivy) produce absolute paths for containers. e.g.
FileName: /usr/lib/x86_64-linux-gnu/perl-base/unicore/lib/Age/V60.pl
Would this be considered an invalid value for the Filename?
Would this be considered an invalid value for the Filename?
Yes.
This is a very common issue. We have "Docfests" somewhat regularly where tools builders compare SPDX output for the same target. We find inconsistencies in the the filename is relatively common. I would suggest reporting the issue to the tool provider and reference the spec. and this issue.
Perfect. That's what I was guessing as well. Thanks for confirming @goneall !