SPDX: Fix package manager label

[puerco]

This commit fixes the package manager label in external references
to make them conform to the SPDX spec.

/cc @imjasonh

Signed-off-by: Adolfo Garcia Veytia (puerco) puerco@chainguard.dev

[codecov-commenter]

Codecov Report

Merging #801 (53f6c72) into main (f9775dc) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##             main     #801   +/-   ##
=======================================
  Coverage   51.40%   51.40%           
=======================================
  Files          44       44           
  Lines        3354     3354           
=======================================
  Hits         1724     1724           
  Misses       1408     1408           
  Partials      222      222           

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

[imjasonh]

Thanks for this! Do you think this is something that warrants a v0.12.1 release?

[puerco]

Mmh no, I think we should instead move to have ko@HEAD generate SPDX 2.3. This uncovered a bug in the SPDX tools, between 2.2.2 and 2.3 the external reference category label in the json schema was changed from using a dash to an underscore:

https://github.com/spdx/spdx-spec/blob/master/schemas/spdx-schema.json#L325

https://github.com/spdx/spdx-spec/blob/development/v2.2.2/schemas/spdx-schema.json#L320

But it seems the spdx tools will use the latest json schema published regardless of the version stated in the doc. So right now, we have an invalid 2.2 document that passes the tests. I'll modify the code to generate SPDX 2.3 documents and file a bug on the SPDX tools project

[puerco]

Ref: spdx/tools-java#74

[imjasonh]

Thanks @puerco! ❤️

[antoineco]

I was looking at the changelog and noticed that the original link is dead, so here is the current version: https://spdx.github.io/spdx-spec/v2.3/package-information/#7211-description