Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Checksums not generated #162

Open
sgammon opened this issue Mar 9, 2024 · 2 comments
Open

Checksums not generated #162

sgammon opened this issue Mar 9, 2024 · 2 comments

Comments

@sgammon
Copy link

sgammon commented Mar 9, 2024

I have a project where I am using this plugin. I specified my configuration like this:
pom.xml (root)

  <pluginManagement>
    <plugin>
      <groupId>org.spdx</groupId>
      <artifactId>spdx-maven-plugin</artifactId>
      <version>0.7.3</version>
    </plugin>
  </pluginManagement>

pom.xml (project)

      <plugin>
        <groupId>org.spdx</groupId>
        <artifactId>spdx-maven-plugin</artifactId>
        <executions>
          <execution>
            <id>build-spdx</id>
            <phase>install</phase>
            <goals>
              <goal>createSPDX</goal>
            </goals>
          </execution>
        </executions>
        <configuration>
          <!-- lots of config... -->
          <checksumAlgorithms>
            <checksumAlgorithm>SHA256</checksumAlgorithm>
          </checksumAlgorithms>
        </configuration>
      </plugin>

But, when the SPDX file is generated:

# lots of stuff omitted
[
  {}, {
    "SPDXID" : "SPDXRef-gnrtd20",
    "checksums" : [ {
      "algorithm" : "SHA1",
      "checksumValue" : "8e0d0d6a6e82a8b532f68ba246cf314c550d3642"
    } ],
]

I don't see SHA256 mentioned anywhere in the file. Is it supposed to show up?

@goneall
Copy link
Member

goneall commented Mar 10, 2024

I don't see SHA256 mentioned anywhere in the file. Is it supposed to show up?

Currently, only SHA1 is written since the SPDX requires SHA1 and SHA256 is optional.

We could add additional checksum algorithms - a pull request would be welcome.

@sgammon
Copy link
Author

sgammon commented Mar 10, 2024

@goneall Okay. No worries. I'll see what I can do.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants