Repository: eBay/sbom-scorecard (language: go)

Issue:
BUG: Dividing Integers by Integers Leads to Incorrect Score Calculation
In issue #22, it was pointed out that: 

> Package version score does not correspond to the % of package versions found? Am I misunderstanding what the correlation should be? If 97% have versions then shouldn't the package version score be higher? 

After some testing, the bug seems to be here:

https://github.com/eBay/sbom-scorecard/blob/c3d4dd80a6bacca380be7f73be257ebff66895bd/pkg/spdx/spdx_report.go#L74-L84

Line 82 should be:

```go
Ratio: float32(r.hasPackVer)  / float32(r.totalPackages),
```

Dividing an integer by an integer leads to zero, which is not the intended behavior, IIUC.

Here is a small snippet of Go code (in the Go Playground) explaining this bug: https://go.dev/play/p/gybFsSduxZa

Proposal: Fix all `Ratio:` lines to use the proper division in which both numbers are converted to a `float32`. This fix will encompass more than just the "package version" logic. I'm glad to put in a PR. Just LMK.


Discussion / hints:
PR welcome, @jspeed-meyers. Thanks for the debugging.

Fix patch:
diff --git a/examples/photon.spdx.json b/examples/photon.spdx.json
new file mode 100644
index 0000000..57f0ffe
--- /dev/null
+++ b/examples/photon.spdx.json
@@ -0,0 +1,1 @@
+{"SPDXID": "SPDXRef-DOCUMENT", "spdxVersion": "SPDX-2.2", "creationInfo": {"created": "2023-01-12T22:06:03Z", "creators": ["Tool: tern-b8e13d1780cd3a02204226bba3d0772d95da24a0"], "licenseListVersion": "3.19"}, "name": "Tern report for photon", "dataLicense": "CC0-1.0", "comment": "This document was generated by the Tern Project: https://github.com/tern-tools/tern", "documentNamespace": "https://spdx.org/spdxdocs/tern-report-b8e13d1780cd3a02204226bba3d0772d95da24a0-photon-21d2cd0a-064e-4198-8bf9-99882f2897aa", "documentDescribes": ["SPDXRef-photon-3.0"], "packages": [{"name": "photon", "SPDXID": "SPDXRef-photon-3.0", "versionInfo": "3.0", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "NOASSERTION", "copyrightText": "NOASSERTION"}, {"name": "ad1f1c6f4fef6e6208ebc53e701bf9937f4e05dce5f601b20c35d8a0ad7fdeff", "SPDXID": "SPDXRef-c8a2baeeb2", "packageFileName": "ad1f1c6f4fef6e6208ebc53e701bf9937f4e05dce5f601b20c35d8a0ad7fdeff", "downloadLocation": "NONE", "filesAnalyzed": false, "checksums": [{"algorithm": "SHA256", "checksumValue": "c8a2baeeb2639816d78c44738c72246632d712195c634ce53e80fb5cbc0a50c8"}], "licenseConcluded": "NOASSERTION", "licenseDeclared": "NOASSERTION", "copyrightText": "NOASSERTION", "comment": "Layer 1:\n\tinfo: Layer created by commands: /bin/sh -c #(nop) ADD file:03f8ed1169e4d338a7b5f3f94b3e25379a063f3718bb062533efa2ce61a21d35 in / \n\tinfo: Found 'VMware Photon OS/Linux' in /etc/os-release.\n\tinfo: Retrieved package metadata using tdnf default method. \n\n"}, {"name": "bash", "SPDXID": "SPDXRef-bash-4.4.18-4.ph3", "versionInfo": "4.4.18-4.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-92fe666", "copyrightText": "NONE", "comment": "bash:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "bzip2-libs", "SPDXID": "SPDXRef-bzip2-libs-1.0.8-2.ph3", "versionInfo": "1.0.8-2.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-f266d93", "copyrightText": "NONE", "comment": "bzip2-libs:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "ca-certificates", "SPDXID": "SPDXRef-ca-certificates-20190521-3.ph3", "versionInfo": "20190521-3.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-e06627e", "copyrightText": "NONE", "comment": "ca-certificates:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "ca-certificates-pki", "SPDXID": "SPDXRef-ca-certificates-pki-20190521-3.ph3", "versionInfo": "20190521-3.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-e06627e", "copyrightText": "NONE", "comment": "ca-certificates-pki:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "curl", "SPDXID": "SPDXRef-curl-7.86.0-3.ph3", "versionInfo": "7.86.0-3.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "MIT", "copyrightText": "NONE", "comment": "curl:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "curl-libs", "SPDXID": "SPDXRef-curl-libs-7.86.0-3.ph3", "versionInfo": "7.86.0-3.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "MIT", "copyrightText": "NONE", "comment": "curl-libs:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "e2fsprogs-libs", "SPDXID": "SPDXRef-e2fsprogs-libs-1.45.5-3.ph3", "versionInfo": "1.45.5-3.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-1e11d9a", "copyrightText": "NONE", "comment": "e2fsprogs-libs:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "elfutils-libelf", "SPDXID": "SPDXRef-elfutils-libelf-0.176-1.ph3", "versionInfo": "0.176-1.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-bba2b1d", "copyrightText": "NONE", "comment": "elfutils-libelf:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "expat", "SPDXID": "SPDXRef-expat-2.2.9-11.ph3", "versionInfo": "2.2.9-11.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "MIT", "copyrightText": "NONE", "comment": "expat:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "expat-libs", "SPDXID": "SPDXRef-expat-libs-2.2.9-11.ph3", "versionInfo": "2.2.9-11.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "MIT", "copyrightText": "NONE", "comment": "expat-libs:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "filesystem", "SPDXID": "SPDXRef-filesystem-1.1-4.ph3", "versionInfo": "1.1-4.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-92fe666", "copyrightText": "NONE", "comment": "filesystem:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "glibc", "SPDXID": "SPDXRef-glibc-2.28-22.ph3", "versionInfo": "2.28-22.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-0a9356a", "copyrightText": "NONE", "comment": "glibc:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "krb5", "SPDXID": "SPDXRef-krb5-1.17-2.ph3", "versionInfo": "1.17-2.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "MIT", "copyrightText": "NONE", "comment": "krb5:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "libcap", "SPDXID": "SPDXRef-libcap-2.25-8.ph3", "versionInfo": "2.25-8.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-1e11d9a", "copyrightText": "NONE", "comment": "libcap:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "libdb", "SPDXID": "SPDXRef-libdb-5.3.28-2.ph3", "versionInfo": "5.3.28-2.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-88cb263", "copyrightText": "NONE", "comment": "libdb:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "libgcc", "SPDXID": "SPDXRef-libgcc-7.3.0-5.ph3", "versionInfo": "7.3.0-5.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-1e11d9a", "copyrightText": "NONE", "comment": "libgcc:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "libmetalink", "SPDXID": "SPDXRef-libmetalink-0.1.3-2.ph3", "versionInfo": "0.1.3-2.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "MIT", "copyrightText": "NONE", "comment": "libmetalink:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "libsolv", "SPDXID": "SPDXRef-libsolv-0.6.35-8.ph3", "versionInfo": "0.6.35-8.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-f266d93", "copyrightText": "NONE", "comment": "libsolv:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "libssh2", "SPDXID": "SPDXRef-libssh2-1.9.0-2.ph3", "versionInfo": "1.9.0-2.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-f266d93", "copyrightText": "NONE", "comment": "libssh2:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "lua", "SPDXID": "SPDXRef-lua-5.3.5-4.ph3", "versionInfo": "5.3.5-4.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "MIT", "copyrightText": "NONE", "comment": "lua:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "ncurses-libs", "SPDXID": "SPDXRef-ncurses-libs-6.1-5.ph3", "versionInfo": "6.1-5.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "MIT", "copyrightText": "NONE", "comment": "ncurses-libs:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "nspr", "SPDXID": "SPDXRef-nspr-4.21-1.ph3", "versionInfo": "4.21-1.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-4afa27a", "copyrightText": "NONE", "comment": "nspr:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "nss-libs", "SPDXID": "SPDXRef-nss-libs-3.44-8.ph3", "versionInfo": "3.44-8.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-4afa27a", "copyrightText": "NONE", "comment": "nss-libs:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "openssl", "SPDXID": "SPDXRef-openssl-1.0.2ze-3.ph3", "versionInfo": "1.0.2ze-3.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "OpenSSL", "copyrightText": "NONE", "comment": "openssl:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "photon-release", "SPDXID": "SPDXRef-photon-release-3.0-6.ph3", "versionInfo": "3.0-6.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-f124779", "copyrightText": "NONE", "comment": "photon-release:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "photon-repos", "SPDXID": "SPDXRef-photon-repos-3.0-8.ph3", "versionInfo": "3.0-8.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-f124779", "copyrightText": "NONE", "comment": "photon-repos:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "popt", "SPDXID": "SPDXRef-popt-1.16-5.ph3", "versionInfo": "1.16-5.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "MIT", "copyrightText": "NONE", "comment": "popt:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "readline", "SPDXID": "SPDXRef-readline-7.0-2.ph3", "versionInfo": "7.0-2.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-d953b10", "copyrightText": "NONE", "comment": "readline:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "rpm-libs", "SPDXID": "SPDXRef-rpm-libs-4.14.3-6.ph3", "versionInfo": "4.14.3-6.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-1e11d9a", "copyrightText": "NONE", "comment": "rpm-libs:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "sqlite-libs", "SPDXID": "SPDXRef-sqlite-libs-3.35.5-1.ph3", "versionInfo": "3.35.5-1.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-116ca55", "copyrightText": "NONE", "comment": "sqlite-libs:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "tdnf", "SPDXID": "SPDXRef-tdnf-3.1.10-1.ph3", "versionInfo": "3.1.10-1.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-b5ef29a", "copyrightText": "NONE", "comment": "tdnf:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "tdnf-cli-libs", "SPDXID": "SPDXRef-tdnf-cli-libs-3.1.10-1.ph3", "versionInfo": "3.1.10-1.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-b5ef29a", "copyrightText": "NONE", "comment": "tdnf-cli-libs:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "toybox", "SPDXID": "SPDXRef-toybox-0.8.6-2.ph3", "versionInfo": "0.8.6-2.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-f266d93", "copyrightText": "NONE", "comment": "toybox:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "xz-libs", "SPDXID": "SPDXRef-xz-libs-5.2.4-2.ph3", "versionInfo": "5.2.4-2.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-bd8fbda", "copyrightText": "NONE", "comment": "xz-libs:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "zlib", "SPDXID": "SPDXRef-zlib-1.2.11-3.ph3", "versionInfo": "1.2.11-3.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "zlib", "copyrightText": "NONE", "comment": "zlib:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}, {"name": "zstd-libs", "SPDXID": "SPDXRef-zstd-libs-1.4.5-2.ph3", "versionInfo": "1.4.5-2.ph3", "downloadLocation": "NOASSERTION", "filesAnalyzed": false, "licenseConcluded": "NOASSERTION", "licenseDeclared": "LicenseRef-d935702", "copyrightText": "NONE", "comment": "zstd-libs:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: files\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"}], "relationships": [{"spdxElementId": "SPDXRef-DOCUMENT", "relatedSpdxElement": "SPDXRef-photon-3.0", "relationshipType": "DESCRIBES"}, {"spdxElementId": "SPDXRef-photon-3.0", "relatedSpdxElement": "SPDXRef-c8a2baeeb2", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-bash-4.4.18-4.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-bzip2-libs-1.0.8-2.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-ca-certificates-20190521-3.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-ca-certificates-pki-20190521-3.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-curl-7.86.0-3.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-curl-libs-7.86.0-3.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-e2fsprogs-libs-1.45.5-3.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-elfutils-libelf-0.176-1.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-expat-2.2.9-11.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-expat-libs-2.2.9-11.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-filesystem-1.1-4.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-glibc-2.28-22.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-krb5-1.17-2.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-libcap-2.25-8.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-libdb-5.3.28-2.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-libgcc-7.3.0-5.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-libmetalink-0.1.3-2.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-libsolv-0.6.35-8.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-libssh2-1.9.0-2.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-lua-5.3.5-4.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-ncurses-libs-6.1-5.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-nspr-4.21-1.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-nss-libs-3.44-8.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-openssl-1.0.2ze-3.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-photon-release-3.0-6.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-photon-repos-3.0-8.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-popt-1.16-5.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-readline-7.0-2.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-rpm-libs-4.14.3-6.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-sqlite-libs-3.35.5-1.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-tdnf-3.1.10-1.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-tdnf-cli-libs-3.1.10-1.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-toybox-0.8.6-2.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-xz-libs-5.2.4-2.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-zlib-1.2.11-3.ph3", "relationshipType": "CONTAINS"}, {"spdxElementId": "SPDXRef-c8a2baeeb2", "relatedSpdxElement": "SPDXRef-zstd-libs-1.4.5-2.ph3", "relationshipType": "CONTAINS"}], "hasExtractedLicensingInfos": [{"extractedText": "BSD and GPLv2", "licenseId": "LicenseRef-d935702"}, {"extractedText": "MPLv2.0", "licenseId": "LicenseRef-4afa27a"}, {"extractedText": "GPLv3", "licenseId": "LicenseRef-92fe666"}, {"extractedText": "GPLv2+", "licenseId": "LicenseRef-1e11d9a"}, {"extractedText": "BSD", "licenseId": "LicenseRef-f266d93"}, {"extractedText": "GPLv2+ or LGPLv3+", "licenseId": "LicenseRef-bba2b1d"}, {"extractedText": "LGPLv2.1,GPLv2", "licenseId": "LicenseRef-b5ef29a"}, {"extractedText": "LGPLv2+", "licenseId": "LicenseRef-0a9356a"}, {"extractedText": "Apache License", "licenseId": "LicenseRef-f124779"}, {"extractedText": "Public Domain", "licenseId": "LicenseRef-116ca55"}, {"extractedText": "Custom", "licenseId": "LicenseRef-e06627e"}, {"extractedText": "GPLv2+ and GPLv3+ and LGPLv2+", "licenseId": "LicenseRef-bd8fbda"}, {"extractedText": "GPLv3+", "licenseId": "LicenseRef-d953b10"}, {"extractedText": "BSD and LGPLv2 and Sleepycat", "licenseId": "LicenseRef-88cb263"}]}
\ No newline at end of file
diff --git a/go.mod b/go.mod
index 2308c31..00ca8a6 100644
--- a/go.mod
+++ b/go.mod
@@ -8,6 +8,7 @@ require (
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/inconshreveable/mousetrap v1.0.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/spdx/gordf v0.0.0-20201111095634-7098f93598fb // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
diff --git a/go.sum b/go.sum
index d0cc155..291c309 100644
--- a/go.sum
+++ b/go.sum
@@ -12,6 +12,7 @@ github.com/inconshreveable/mousetrap v1.0.1/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLf
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/spdx/gordf v0.0.0-20201111095634-7098f93598fb h1:bLo8hvc8XFm9J47r690TUKBzcjSWdJDxmjXJZ+/f92U=
 github.com/spdx/gordf v0.0.0-20201111095634-7098f93598fb/go.mod h1:uKWaldnbMnjsSAXRurWqqrdyZen1R7kxl8TkmWk2OyM=
 github.com/spdx/tools-golang v0.3.1-0.20221108182156-8a01147e6342 h1:6uvaOTv4GeRqQV6O1/znbpziqhctMRLTy3OGeZrNMic=
 github.com/spdx/tools-golang v0.3.1-0.20221108182156-8a01147e6342/go.mod h1:VHzvNsKAfAGqs4ZvwRL+7a0dNsL20s7lGui4K9C0xQM=
diff --git a/pkg/spdx/spdx_report.go b/pkg/spdx/spdx_report.go
index ab599bc..4ba2c5b 100644
--- a/pkg/spdx/spdx_report.go
+++ b/pkg/spdx/spdx_report.go
@@ -79,7 +79,7 @@ func (r *SpdxReport) PackageVersions() scorecard.ReportValue {
 		}
 	}
 	return scorecard.ReportValue{
-		Ratio: float32(r.hasPackVer / r.totalPackages),
+		Ratio: float32(r.hasPackVer) / float32(r.totalPackages),
 	}
 }
 
@@ -91,7 +91,7 @@ func (r *SpdxReport) PackageLicenses() scorecard.ReportValue {
 		}
 	}
 	return scorecard.ReportValue{
-		Ratio: float32(r.hasLicense / r.totalPackages),
+		Ratio: float32(r.hasLicense) / float32(r.totalPackages),
 	}
 }
 


Test patch:
diff --git a/pkg/spdx/spdx_report_test.go b/pkg/spdx/spdx_report_test.go
index 85c2d09..ecf3fde 100644
--- a/pkg/spdx/spdx_report_test.go
+++ b/pkg/spdx/spdx_report_test.go
@@ -7,11 +7,11 @@ import (
 	"github.com/ebay/sbom-scorecard/pkg/scorecard"
 )
 
-func TestSpdxE2eReport(t *testing.T) {
-	r := GetSpdxReport("../../examples/julia.spdx.json")
-	report_text := r.Report()
-
-	if strings.Trim(report_text, " \n") != `34 total packages
+var report_tests = []struct {
+	path     string
+	expected string
+}{
+	{"../../examples/julia.spdx.json", `34 total packages
 0 total files
 100% have licenses.
 0% have package digest.
@@ -20,25 +20,55 @@ func TestSpdxE2eReport(t *testing.T) {
 0% have CPEs.
 0% have file digest.
 Spec valid? true
-Has creation info? false` {
-		t.Log("Incorrect report results generated.\n" +
-			"Got this: \n" + report_text)
-		t.Fail()
-	}
+Has creation info? false`},
+	{"../../examples/photon.spdx.json", `38 total packages
+0 total files
+94% have licenses.
+2% have package digest.
+97% have package versions.
+0% have purls.
+0% have CPEs.
+0% have file digest.
+Spec valid? true
+Has creation info? true`},
 }
 
-func TestSpdxE2eGrade(t *testing.T) {
-	r := GetSpdxReport("../../examples/julia.spdx.json")
-	report_text := scorecard.Grade(r)
+func TestSpdxE2eReport(t *testing.T) {
+	for _, e := range report_tests {
+		res := GetSpdxReport(e.path)
+		report_text := res.Report()
+		if strings.Trim(report_text, " \n") != e.expected {
+			t.Errorf("GetSpdxReport(%v) = %v, expected %v",
+				e.path, strings.Trim(report_text, " \n"), e.expected)
+		}
+	}
+}
 
-	if strings.Trim(report_text, " \n") != `Spec Compliance: 25/25
+var grade_tests = []struct {
+	path     string
+	expected string
+}{
+	{"../../examples/julia.spdx.json", `Spec Compliance: 25/25
 Package ID: 0/20 (0% have purls and 0% have CPEs)
 Package Versions: 0/20
 Package Licenses: 20/20
 Creation Info: 0/15 (No tool was used to create the sbom)
-Total points: 45/100 or 45%` {
-		t.Log("Incorrect report results generated.\n" +
-			"Got this: \n" + report_text)
-		t.Fail()
+Total points: 45/100 or 45%`},
+	{"../../examples/photon.spdx.json", `Spec Compliance: 25/25
+Package ID: 0/20 (0% have purls and 0% have CPEs)
+Package Versions: 19/20
+Package Licenses: 18/20
+Creation Info: 15/15
+Total points: 78/100 or 78%`},
+}
+
+func TestSpdxE2eGrade(t *testing.T) {
+	for _, e := range grade_tests {
+		res := GetSpdxReport(e.path)
+		report_text := scorecard.Grade(res)
+		if strings.Trim(report_text, " \n") != e.expected {
+			t.Errorf("GetSpdxReport(%v) = %v, expected %v",
+				e.path, strings.Trim(report_text, " \n"), e.expected)
+		}
 	}
 }