nebius/SWE-bench-extra huggingface dataset:
Repository: spdx/tools-python

Issue:
TagValue builder writes attribution text into comment
See https://github.com/spdx/tools-python/blob/main/spdx/parsers/tagvaluebuilders.py#L1088-L1095

Comments:

Patch:
diff --git a/spdx/parsers/tagvaluebuilders.py b/spdx/parsers/tagvaluebuilders.py
index 27b4180..4bf2320 100644
--- a/spdx/parsers/tagvaluebuilders.py
+++ b/spdx/parsers/tagvaluebuilders.py
@@ -1092,7 +1092,7 @@ class FileBuilder(object):
         """
         if self.has_package(doc) and self.has_file(doc):
             if validations.validate_file_attribution_text(text):
-                self.file(doc).comment = str_from_text(text)
+                self.file(doc).attribution_text = str_from_text(text)
                 return True
             else:
                 raise SPDXValueError("File::AttributionText")


Test patch:
diff --git a/tests/test_tag_value_parser.py b/tests/test_tag_value_parser.py
index 54dde11..64ddb17 100644
--- a/tests/test_tag_value_parser.py
+++ b/tests/test_tag_value_parser.py
@@ -243,7 +243,8 @@ class TestParser(TestCase):
         'ArtifactOfProjectName: AcmeTest',
         'ArtifactOfProjectHomePage: http://www.acme.org/',
         'ArtifactOfProjectURI: http://www.acme.org/',
-        'FileComment: <text>Very long file</text>'
+        'FileComment: <text>Very long file</text>',
+        'FileAttributionText: <text>Acknowledgements that might be required to be communicated in some contexts.</text>'
         ])
 
     unknown_tag_str = 'SomeUnknownTag: SomeUnknownValue'
@@ -318,6 +319,9 @@ class TestParser(TestCase):
         assert len(spdx_file.artifact_of_project_name) == 1
         assert len(spdx_file.artifact_of_project_home) == 1
         assert len(spdx_file.artifact_of_project_uri) == 1
+        assert spdx_file.comment == 'Very long file'
+        assert spdx_file.attribution_text == 'Acknowledgements that might be required to be communicated in ' \
+                                             'some contexts.'
 
     def test_unknown_tag(self):
Repository: spdx/tools-python

Issue:
Change fileName validation
- file names do not have to start with `./`
- file names must not start with `/`

Comments:

Patch:
diff --git a/src/spdx/validation/file_validator.py b/src/spdx/validation/file_validator.py
index cc4375e..16845e5 100644
--- a/src/spdx/validation/file_validator.py
+++ b/src/spdx/validation/file_validator.py
@@ -50,10 +50,10 @@ def validate_file(file: File, context: Optional[ValidationContext] = None) -> Li
     if not context:
         context = ValidationContext(spdx_id=file.spdx_id, element_type=SpdxElementType.FILE, full_element=file)
 
-    if not file.name.startswith("./"):
+    if file.name.startswith("/"):
         validation_messages.append(
             ValidationMessage(
-                f'file name must be a relative path to the file, starting with "./", but is: {file.name}', context)
+                f'file name must not be an absolute path starting with "/", but is: {file.name}', context)
         )
 
     if ChecksumAlgorithm.SHA1 not in [checksum.algorithm for checksum in file.checksums]:


Test patch:
diff --git a/tests/spdx/validation/test_file_validator.py b/tests/spdx/validation/test_file_validator.py
index 040edde..d06a24d 100644
--- a/tests/spdx/validation/test_file_validator.py
+++ b/tests/spdx/validation/test_file_validator.py
@@ -27,9 +27,9 @@ def test_valid_file():
 
 
 @pytest.mark.parametrize("file_input, spdx_id, expected_message",
-                         [(file_fixture(name="invalid file name"), file_fixture().spdx_id,
-                           'file name must be a relative path to the file, starting with "./", but is: invalid file name'),
-                          (
+                         [(file_fixture(name="/invalid/file/name"), file_fixture().spdx_id,
+                           f'file name must not be an absolute path starting with "/", but is: /invalid/file/name'),
+                         (
                           file_fixture(checksums=[Checksum(ChecksumAlgorithm.MD2, "d4c41ce30a517d6ce9d79c8c17bb4b66")]),
                           file_fixture().spdx_id,
                           f'checksums must contain a SHA1 algorithm checksum, but only contains: [<ChecksumAlgorithm.MD2: 13>]')
Repository: spdx/tools-python

Issue:
Line mismatch in error messages of the tag-value parser
When we try to parse a tag-value file that contains errors, the tag-value parser provides an error message like 
```
LicenseID must start with 'LicenseRef-', line: 4948
```
with an explicit line number. This line number does not always match the incorrect line in the file, probably because the parser ignores empty lines and comments. To be helpful additional infromation, the outputted line number should match the place within the file.

Comments:

Patch:
diff --git a/spdx/parsers/lexers/tagvalue.py b/spdx/parsers/lexers/tagvalue.py
index 61a99ad..4421bae 100644
--- a/spdx/parsers/lexers/tagvalue.py
+++ b/spdx/parsers/lexers/tagvalue.py
@@ -235,7 +235,7 @@ class Lexer(object):
         t.lexer.lineno += len(t.value)
 
     def t_whitespace(self, t):
-        r"\s+"
+        r"[ \t]+"
         pass
 
     def build(self, **kwargs):
diff --git a/spdx/parsers/tagvalue.py b/spdx/parsers/tagvalue.py
index bf2e937..e3ecffd 100644
--- a/spdx/parsers/tagvalue.py
+++ b/spdx/parsers/tagvalue.py
@@ -37,6 +37,8 @@ ERROR_MESSAGES = {
     "DOC_VERSION_VALUE_TYPE": "Invalid SPDXVersion value, must be SPDX-M.N where M and N are numbers. Line: {0}",
     "DOC_NAME_VALUE": "DocumentName must be single line of text, line: {0}",
     "DOC_SPDX_ID_VALUE": "Invalid SPDXID value, SPDXID must be SPDXRef-DOCUMENT, line: {0}",
+    "LIC_LIST_VER_VALUE": "Invalid LicenseListVersion '{0}', must be of type M.N where M and N are numbers. Line: {1}",
+    "LIC_LIST_VER_VALUE_TYPE": "Could not read value after LicenseListVersion-tag. Line{0}",
     "EXT_DOC_REF_VALUE": "ExternalDocumentRef must contain External Document ID, SPDX Document URI and Checksum"
                          "in the standard format, line:{0}.",
     "DOC_COMMENT_VALUE_TYPE": "DocumentComment value must be free form text between <text></text> tags"


Test patch:
diff --git a/tests/test_tag_value_parser.py b/tests/test_tag_value_parser.py
index 6ce4af7..00be54b 100644
--- a/tests/test_tag_value_parser.py
+++ b/tests/test_tag_value_parser.py
@@ -115,6 +115,9 @@ annotation_str = '\n'.join([
     'SPDXREF: SPDXRef-DOCUMENT'
 ])
 
+document_str_with_empty_line = "\n".join(
+    ['SPDXVersion: SPDX-2.1', '  ', 'DataLicense: CC0-1.0'])
+
 
 class TestLexer(TestCase):
     maxDiff = None
@@ -291,6 +294,14 @@ class TestLexer(TestCase):
         self.token_assert_helper(self.l.token(), 'ANNOTATION_SPDX_ID', 'SPDXREF', 5)
         self.token_assert_helper(self.l.token(), 'LINE', 'SPDXRef-DOCUMENT', 5)
 
+    def test_correct_line_number_with_empty_line_between(self):
+        data = document_str_with_empty_line
+        self.l.input(data)
+        self.token_assert_helper(self.l.token(), 'DOC_VERSION', 'SPDXVersion', 1)
+        self.token_assert_helper(self.l.token(), 'LINE', 'SPDX-2.1', 1)
+        self.token_assert_helper(self.l.token(), 'DOC_LICENSE', 'DataLicense', 3)
+        self.token_assert_helper(self.l.token(), 'LINE', 'CC0-1.0', 3)
+
     def token_assert_helper(self, token, ttype, value, line):
         assert token.type == ttype
         assert token.value == value
Repository: spdx/tools-python

Issue:
CLI raises error if no arguments provided
If we only call `pyspdxtools` without any argument an `AttributeError` is raised. We should instead give a hint on how to correctly use the CLI and which arguments are possible. 

Comments:

Patch:
diff --git a/src/spdx/clitools/pyspdxtools.py b/src/spdx/clitools/pyspdxtools.py
index e246176..f2d480e 100644
--- a/src/spdx/clitools/pyspdxtools.py
+++ b/src/spdx/clitools/pyspdxtools.py
@@ -29,7 +29,7 @@ from spdx.writer.write_anything import write_file
 
 
 @click.command()
-@click.option("--infile", "-i", help="The file containing the document to be validated or converted.")
+@click.option("--infile", "-i", required=True, help="The file containing the document to be validated or converted.")
 @click.option(
     "--outfile",
     "-o",


Test patch:
diff --git a/tests/spdx/test_cli.py b/tests/spdx/test_cli.py
new file mode 100644
index 0000000..3966039
--- /dev/null
+++ b/tests/spdx/test_cli.py
@@ -0,0 +1,45 @@
+import os
+
+import pytest
+from click.testing import CliRunner
+
+from spdx.clitools.pyspdxtools import main
+
+
+@pytest.mark.parametrize(
+    "options",
+    [
+        ("--infile", os.path.join(os.path.dirname(__file__), "data/SPDXJSONExample-v2.3.spdx.json")),
+        ("-i", os.path.join(os.path.dirname(__file__), "data/SPDXJSONExample-v2.3.spdx.json"), "--novalidation"),
+        (
+            "-i",
+            os.path.join(os.path.dirname(__file__), "data/SPDXJSONExample-v2.3.spdx.json"),
+            "--novalidation",
+            "--version",
+            "SPDX-2.3",
+        ),
+        ("-i", os.path.join(os.path.dirname(__file__), "data/SPDXJSONExample-v2.3.spdx.json"), "-o", "-"),
+    ],
+)
+def test_cli_with_system_exit_code_0(options):
+    runner = CliRunner()
+
+    result = runner.invoke(main, options)
+
+    assert result.exit_code == 0
+
+
+@pytest.mark.parametrize(
+    "options",
+    [
+        (),
+        ("-i", os.path.join(os.path.dirname(__file__), "data/SPDXJSONExample-v2.3.spdx.json"), "--version"),
+        ("-i", os.path.join(os.path.dirname(__file__), "data/SPDXJSONExample-v2.3.spdx.json"), "-o"),
+    ],
+)
+def test_cli_with_system_exit_code_2(options):
+    runner = CliRunner()
+
+    result = runner.invoke(main, options)
+
+    assert result.exit_code == 2
Repository: spdx/tools-python

Issue:
Error validating download location with git+ssh URI
When using git URLs to reference packages in npm, the URL often gets normalized to a form like:

```
git+ssh://git@github.com/foo/bar.git#b7e1e0fb20cff47bcca4be90d0c6f83a45e51e9c
```

When using a URL of this form as a `downloadLocation` value, it fails validation due to the `git@` portion of the URL.

Can the URL regex be expanded to allow for the [`userinfo`](https://datatracker.ietf.org/doc/html/rfc2396#section-3.2.2) portion of the URI?

https://github.com/spdx/tools-python/blob/f15a64fdd3c2b889c613997fc35da908a794c607/src/spdx_tools/spdx/validation/uri_validators.py#L10-L12

Comments:

Patch:
diff --git a/src/spdx_tools/spdx/validation/uri_validators.py b/src/spdx_tools/spdx/validation/uri_validators.py
index d9c23f9..d3a4237 100644
--- a/src/spdx_tools/spdx/validation/uri_validators.py
+++ b/src/spdx_tools/spdx/validation/uri_validators.py
@@ -9,7 +9,8 @@ from uritools import isabsuri, urisplit
 
 url_pattern = (
     "(http:\\/\\/www\\.|https:\\/\\/www\\.|http:\\/\\/|https:\\/\\/|ssh:\\/\\/|git:\\/\\/|svn:\\/\\/|sftp:"
-    "\\/\\/|ftp:\\/\\/)?[a-z0-9]+([\\-\\.]{1}[a-z0-9]+){0,100}\\.[a-z]{2,5}(:[0-9]{1,5})?(\\/.*)?"
+    "\\/\\/|ftp:\\/\\/)?([\\w\\-.!~*'()%;:&=+$,]+@)?[a-z0-9]+([\\-\\.]{1}[a-z0-9]+){0,100}\\.[a-z]{2,5}"
+    "(:[0-9]{1,5})?(\\/.*)?"
 )
 supported_download_repos: str = "(git|hg|svn|bzr)"
 git_pattern = "(git\\+git@[a-zA-Z0-9\\.\\-]+:[a-zA-Z0-9/\\\\.@\\-]+)"


Test patch:
diff --git a/tests/spdx/validation/test_uri_validators.py b/tests/spdx/validation/test_uri_validators.py
index ffe3008..069cb1b 100644
--- a/tests/spdx/validation/test_uri_validators.py
+++ b/tests/spdx/validation/test_uri_validators.py
@@ -34,6 +34,7 @@ def test_invalid_url(input_value):
         "git+https://git.myproject.org/MyProject.git",
         "git+http://git.myproject.org/MyProject",
         "git+ssh://git.myproject.org/MyProject.git",
+        "git+ssh://git@git.myproject.org/MyProject.git",
         "git+git://git.myproject.org/MyProject",
         "git+git@git.myproject.org:MyProject",
         "git://git.myproject.org/MyProject#src/somefile.c",