From daad605967c9c9053a8dddd127f1e244761753c3 Mon Sep 17 00:00:00 2001 From: Arpit Jain Date: Wed, 11 Nov 2026 22:38:57 -0500 Subject: [PATCH] Lowercase file SHA1s in the SpdxFile verification code path generatePackageVerificationCode(SpdxFile[], ...) added each file's SHA1 to the digest input verbatim, while the directory overload in the same class lowercases every checksum it computes. verifyChecksumString accepts A-F, so a document carrying uppercase checksums produced a verification code that neither the sibling overload nor spec clause 7.9 reproduces. Co-Authored-By: Claude Signed-off-by: Arpit Jain --- .../VerificationCodeGenerator.java | 2 +- .../VerificationCodeGeneratorTest.java | 17 +++++++++++++++++ 2 files changed, 18 insertions(+), 1 deletion(-) diff --git a/src/main/java/org/spdx/utility/verificationcode/VerificationCodeGenerator.java b/src/main/java/org/spdx/utility/verificationcode/VerificationCodeGenerator.java index 05120302b..9b599e790 100644 --- a/src/main/java/org/spdx/utility/verificationcode/VerificationCodeGenerator.java +++ b/src/main/java/org/spdx/utility/verificationcode/VerificationCodeGenerator.java @@ -93,7 +93,7 @@ public SpdxPackageVerificationCode generatePackageVerificationCode(SpdxFile[] sp if (spdxFile != null) { Optional name = spdxFile.getName(); if (name.isPresent() && !skippedFilePathSet.contains(name.get())) { - fileChecksums.add(spdxFile.getSha1()); + fileChecksums.add(spdxFile.getSha1().toLowerCase()); } } } diff --git a/src/test/java/org/spdx/utility/verificationcode/VerificationCodeGeneratorTest.java b/src/test/java/org/spdx/utility/verificationcode/VerificationCodeGeneratorTest.java index 46f35ea67..e74b64593 100644 --- a/src/test/java/org/spdx/utility/verificationcode/VerificationCodeGeneratorTest.java +++ b/src/test/java/org/spdx/utility/verificationcode/VerificationCodeGeneratorTest.java @@ -98,6 +98,23 @@ public void testGeneratePackageVerificationCodeFileFileArray() throws NoSuchAlgo compareFileNameArrays(SKIPPED_FILE_NAMES, vc.getExcludedFileNames()); } + public void testGeneratePackageVerificationCodeUppercaseSha1() throws NoSuchAlgorithmException, InvalidSPDXAnalysisException { + SpdxFile[] uppercaseFiles = new SpdxFile[SPDX_FILE_NAMES.length]; + for (int i = 0; i < uppercaseFiles.length; i++) { + uppercaseFiles[i] = new SpdxFile(modelStore, DOCUMENT_URI, modelStore.getNextId(IdType.Anonymous), null, true); + uppercaseFiles[i].setName(SPDX_FILE_NAMES[i]); + uppercaseFiles[i].getFileTypes().add(FileType.SOURCE); + uppercaseFiles[i].getChecksums().add(uppercaseFiles[i].createChecksum(ChecksumAlgorithm.SHA1, + SPDX_FILE_SHA1S[i].toUpperCase())); + uppercaseFiles[i].setLicenseConcluded(new SpdxNoAssertionLicense()); + uppercaseFiles[i].getLicenseInfoFromFiles().add(new SpdxNoAssertionLicense()); + } + VerificationCodeGenerator vg = new VerificationCodeGenerator(new JavaSha1ChecksumGenerator()); + String lowercase = vg.generatePackageVerificationCode(SPDX_FILES, new String[0], modelStore, DOCUMENT_URI).getValue(); + String uppercase = vg.generatePackageVerificationCode(uppercaseFiles, new String[0], modelStore, DOCUMENT_URI).getValue(); + assertEquals(lowercase, uppercase); + } + /** * @param skippedFileNames * @param excludedFileNames