Repository navigation
Lowercase file SHA1s in the SpdxFile verification code path - #458
Merged
goneall merged 1 commit intoNov 13, 2026
Merged
Conversation
generatePackageVerificationCode(SpdxFile[], ...) added each file's SHA1 to the digest input verbatim, while the directory overload in the same class lowercases every checksum it computes. verifyChecksumString accepts A-F, so a document carrying uppercase checksums produced a verification code that neither the sibling overload nor spec clause 7.9 reproduces. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
goneall
approved these changes
Nov 13, 2026
goneall
left a comment
goneall
left a comment
Member
There was a problem hiding this comment.
Thanks @arpitjain099 - I don't think we need to have Locale.ROOT, so this looks good as is.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
generatePackageVerificationCode(SpdxFile[], ...)adds each file's SHA1 to the digest verbatim, while the directory overload in the same class lowercases every checksum it computes.SpdxVerificationHelper.verifyChecksumStringacceptsA-F, so a document with uppercase checksums gets a code the sibling overload will not reproduce. Clause 7.9 of the 2.3 spec: SHA1(file) "returns the result in lowercase hexadecimal digits".The test builds the same three files twice, the second time uppercase. It produces 512bdc71 where the spec algorithm gives 06b88323; both agree after the change.
getSha1()returns an empty string rather than null, so the added call cannot NPE. Full suite passes, 370 tests.Please say if you would rather have
Locale.ROOTon both call sites.