Validate Custom JSON-LD Context

[augelu-tng]

According to the Serialization Information section in the SPDX 3.0.1 spec serializing NamespaceMaps within the @context field for JSON-LD serializations is valid.

When serializing a physical SpdxDocument, any property of the logical element that can be natively represented within the chosen serialization format (e.g., @context prefixes in JSON-LD instead of the namespaceMap) may utilize these native mechanisms. All remaining properties shall be serialized within the SpdxDocument element itself.
[...]
Additional namespace mappings may be defined within a separate object within the context.

The java spdx tools however do not currently support this.
Take for example the following document: sbom-output.spdx.json

export SPDX_TOOLS_VERSION=2.0.2
curl -sLO "https://github.com/spdx/tools-java/releases/download/v${SPDX_TOOLS_VERSION}/tools-java-${SPDX_TOOLS_VERSION}.zip"
unzip -j "tools-java-${SPDX_TOOLS_VERSION}.zip" "tools-java-${SPDX_TOOLS_VERSION}-jar-with-dependencies.jar"
java -jar "tools-java-${SPDX_TOOLS_VERSION}-jar-with-dependencies.jar" Verify "sbom-output.spdx.json"

The java tools fail with

This SPDX Document is not valid due to:
        $.@context: must be the constant value 'https://spdx.org/rdf/3.0.1/spdx-context.jsonld'

even though the document should be valid.

An easy way to fix this would be to expand the custom context before processing the SPDX document.
See for example expand-custom-context.sh

./expand-custom-context.sh sbom-output.spdx.json

This small script expands the custom context and outputs expanded-sbom-output.spdx.json which successfully gets validated by the java tools.

java -jar "tools-java-${SPDX_TOOLS_VERSION}-jar-with-dependencies.jar" Verify "expanded-sbom-output.spdx.json"
This SPDX Document is valid.

It would be helpful if this behavior could be supported directly by the java-tools.

[goneall]

@augelu-tng thanks for submitting the issue - I agree this is something the Java tools should support. We'll need a way to expand the custom context within the Java code. There is very likely a way to do this, but I won't have time to research before the start of the new year. Feel free to research, add a comment, or (even better) a pull request, I'll work on it after clearing out my "day job" backlog.

[bact]

@kzantow I guess you may have an interest in this NameSpace topic too, along with the spdxId recommended URI schema https://spdx.github.io/spdx-spec/v2.3/document-creation-information/#65-spdx-document-namespace-field (see 6.5.2)