Version 0.3.5 of the validator

tools/openchain_telco_sbom_validator/README.md

@@ -3,6 +3,9 @@
 A script to validate SBOMs against
 the [OpenChain Telco SBOM Guide](https://github.com/OpenChain-Project/Telco-WG/blob/main/OpenChain-Telco-SBOM-Guide_EN.md).
 
+What is new in version 0.3.5:
+* better check in `--strict-purl-check`
+
 What is new in version 0.3.4:
 * require spdx-tools >= 0.8.5
 * require ntia-conformance-checker >= 5.0.0
@@ -59,8 +62,8 @@ options:
   --debug               Prints debug logs.
   --nr-of-errors NR_OF_ERRORS
                         Sets a limit on the number of errors displayed.
-  --strict-purl-check   Runs a strict check on the given purls. The default behaviour is to run a non-strict purl check
-                        meaning that it is not checked if the purl is translating to a downloadable URL.
+  --strict-purl-check   Runs a strict check on the given PURLs. The default behaviour is to run a non-strict PURL check
+                        meaning that it is not checked if the PURL is translating to a downloadable URL.
   --strict-url-check    Runs a strict check on the URLs of the PackageDownloadLocation. Strict check means that the validator
                         checks also if the given URL can be accessed. The default behaviour is to run a non-strict URL
                         check, meaning that it is not checked if the URL points to a valid page. Strict URL check
@@ -100,7 +103,7 @@ def main():
 
     # Do validate
     result, problems = myValidator.validate(filePath,          # path to the SPDX file as a string
-                                            strict_purl_check, # If strict purl check is needed
+                                            strict_purl_check, # If strict PURL check is needed
                                             strict_url_check)  # if strict URL check is needed
 
     # Print results in an uniform way

tools/openchain_telco_sbom_validator/requirements.txt

@@ -4,3 +4,4 @@ prettytable>=3.16.0
 packageurl-python>=0.17.6
 ntia-conformance-checker>=5.0.0
 validators>=0.35.0
+fetchcode>=0.8.2

tools/openchain_telco_sbom_validator/setup.cfg

@@ -1,6 +1,6 @@
 [metadata]
 name = openchain-telco-sbom-validator
-version = 0.3.4
+version = 0.3.5
 author = Gergely Csatari, Marc-Etienne Vargenau
 author_email = gergely.csatari@nokia.com, marc-etienne.vargenau@nokia.com
 description = Validator against versions 1.0 and 1.1 of the OpenChain Telco SBOM Guide
@@ -35,6 +35,7 @@ install_requires =
     packageurl-python>=0.17.6
     ntia-conformance-checker>=5.0.0
     validators>=0.35.0
+    fetchcode>=0.8.2
 [options.entry_points]
 console_scripts =
         openchain-telco-sbom-validator=openchain_telco_sbom_validator.cli:main

tools/openchain_telco_sbom_validator/src/openchain_telco_sbom_validator/cli.py

@@ -114,9 +114,9 @@ def parseArguments(additionalArguments: AdditionalArguments = AdditionalArgument
     parser.add_argument('--nr-of-errors',
                         help='Sets a limit on the number of errors displayed.')
     parser.add_argument('--strict-purl-check', action="store_true",
-                        help='Runs a strict check on the given purls. The default behaviour is to'
-                        ' run a non-strict purl check meaning that it is not checked if the'
-                        ' purl is translating to a downloadable URL.')
+                        help='Runs a strict check on the given PURLs. The default behaviour is to'
+                        ' run a non-strict PURL check meaning that it is not checked if the'
+                        ' PURL is translating to a downloadable URL.')
     parser.add_argument('--strict-url-check', action="store_true",
                         help='Runs a strict check on the URLs of the PackageDowloadLocation. Strict check'
                         ' means that the validator checks also if the given URL can be accessed.'
@@ -162,7 +162,7 @@ def parseArguments(additionalArguments: AdditionalArguments = AdditionalArgument
             logger.error(f"nr-of-errors must be a number and not {args.nr_of_errors}")
             sys.exit(1)
     if args.strict_purl_check:
-        logger.info("Running strict checks for purls, what means that it is tested if the purls can be translated to a downloadable url.")
+        logger.info("Running strict checks for PURLs, what means that it is tested if the PURLs can be translated to a downloadable url.")
     if args.strict_url_check:
         logger.info("Running strict checks for URL, what means that it is tested if the PackageDowloadLocation fields are pointing to real pages.")
 

tools/openchain_telco_sbom_validator/src/openchain_telco_sbom_validator/reporter.py

@@ -45,7 +45,7 @@ def reportCli(result, problems, nr_of_errors, input, guide_version, strict, noas
 
         if strict_purl_check:
             if len(incorrect_purls):
-                print("Fields with purl that cannot be converted to a downloadable URL:")
+                print("Fields with PURL that cannot be converted to a downloadable URL:")
                 printTable(incorrect_purls, problems.print_file)
 
         if strict_url_check:

tools/openchain_telco_sbom_validator/src/openchain_telco_sbom_validator/validator.py

@@ -23,6 +23,7 @@
 from spdx_tools.spdx.model.checksum import ChecksumAlgorithm
 from spdx_tools.spdx import document_utils
 from packageurl.contrib import purl2url
+from fetchcode import fetch
 import ntia_conformance_checker as ntia
 import validators
 import requests
@@ -539,7 +540,20 @@ def validate(self,
                                                 Problem.SEVERITY_INC_PURL,
                                                 file)
                             else:
-                                logger.debug(f"Strict PURL check is happy {url}")
+                                try:
+                                    logger.debug("Checking Package-URL location")
+                                    page = fetch(ref.locator)
+                                    logger.debug(f"Strict PURL check is happy {url}")
+                                except Exception as err:
+                                    logger.debug(f"Exception received ({format(err)})")
+                                    problems.append("Invalid field in Package",
+                                                    package.spdx_id,
+                                                    package.name,
+                                                    f"Package-URL field converts to a nonexisting page ({url})",
+                                                    Problem.SCOPE_OPEN_CHAIN,
+                                                    Problem.SEVERITY_INC_PURL,
+                                                    file)
+
                 if strict and not purlFound:
                     problems.append("Missing mandatory field from Package",
                                     package.spdx_id,