tools
tools copied to clipboard
Ambiguity in SPDX documentation in relation b/w files and filesAnalyzed fields
As per the below code snippet, if filesAnalyzed is true, files array must contain any files related to the package. No clear correlation between the files and the filesAnalyzed field has been mentioned in the SPDX document.
@Moullisha - We are switching over to a new version of the utility https://github.com/spdx/tools-java and the library https://github.com/spdx/spdx-java-library
Could you check and see if the same issue is in the new version? It's unlikely this utility will be updated except for critical security issues.