Repository navigation
PackageDownloadLocation validation doesn't allow underscores in git URLs #860
Description
This issue is related to spdx/spdx-java-model-2_X#33 and has identical behaviour and an identical fix.
The regex that validates PackageDownloadLocation tags rejects git URLs with underscores in the repository name:
Example of a line from an SBOM that doesn't validate (because of the underscore in the repo name) but should:
PackageDownloadLocation: git+git@github.com:zephyrproject-rtos/CMSIS_6@06d952b6713a2ca41c9224a62075e4059402a151-off
Proposed fix:
- git_pattern = "(git\\+git@[a-zA-Z0-9\\.\\-]+:[a-zA-Z0-9/\\\\.@\\-]+)"
+ git_pattern = "(git\\+git@[a-zA-Z0-9\\.\\-]+:[a-zA-Z0-9/\\\\.@\\-_]+)"
Activity
Xavrir commentedon Mar 18, 2026
Hi! I'd like to work on this. I'm planning a small fix to allow underscores in git-based PackageDownloadLocation values, plus a regression test using the example from this issue.
fix: allow underscores in git PackageDownloadLocation validation