test: validate SPDX with the JSON schema (#5124)

* test: validate SPDX with the JSON schema

* use the SPDX schema version based on the document version

* additionally validate the document using spdx

integration/integration_test.go

@@ -6,6 +6,7 @@ import (
 	"context"
 	"encoding/json"
 	"flag"
+	"fmt"
 	"io"
 	"net"
 	"os"
@@ -19,6 +20,7 @@ import (
 	"github.com/samber/lo"
 	spdxjson "github.com/spdx/tools-golang/json"
 	"github.com/spdx/tools-golang/spdx"
+	"github.com/spdx/tools-golang/spdxlib"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"github.com/xeipuuv/gojsonschema"
@@ -34,6 +36,8 @@ import (
 
 var update = flag.Bool("update", false, "update golden files")
 
+const SPDXSchema = "https://raw.githubusercontent.com/spdx/spdx-spec/development/v%s/schemas/spdx-schema.json"
+
 func initDB(t *testing.T) string {
 	fixtureDir := filepath.Join("testdata", "fixtures", "db")
 	entries, err := os.ReadDir(fixtureDir)
@@ -210,9 +214,26 @@ func compareCycloneDX(t *testing.T, wantFile, gotFile string) {
 	assert.Equal(t, want, got)
 
 	// Validate CycloneDX output against the JSON schema
-	schemaLoader := gojsonschema.NewReferenceLoader(got.JSONSchema)
-	documentLoader := gojsonschema.NewGoLoader(got)
+	validateReport(t, got.JSONSchema, got)
+}
+
+func compareSPDXJson(t *testing.T, wantFile, gotFile string) {
+	want := readSpdxJson(t, wantFile)
+	got := readSpdxJson(t, gotFile)
+	assert.Equal(t, want, got)
+
+	SPDXVersion, ok := strings.CutPrefix(want.SPDXVersion, "SPDX-")
+	assert.True(t, ok)
+
+	assert.NoError(t, spdxlib.ValidateDocument(got))
 
+	// Validate SPDX output against the JSON schema
+	validateReport(t, fmt.Sprintf(SPDXSchema, SPDXVersion), got)
+}
+
+func validateReport(t *testing.T, schema string, report any) {
+	schemaLoader := gojsonschema.NewReferenceLoader(schema)
+	documentLoader := gojsonschema.NewGoLoader(report)
 	result, err := gojsonschema.Validate(schemaLoader, documentLoader)
 	require.NoError(t, err)
 
@@ -223,9 +244,3 @@ func compareCycloneDX(t *testing.T, wantFile, gotFile string) {
 		assert.True(t, valid, strings.Join(errs, "\n"))
 	}
 }
-
-func compareSpdxJson(t *testing.T, wantFile, gotFile string) {
-	want := readSpdxJson(t, wantFile)
-	got := readSpdxJson(t, gotFile)
-	assert.Equal(t, want, got)
-}

integration/repo_test.go

@@ -492,7 +492,7 @@ func TestRepository(t *testing.T) {
 			case types.FormatCycloneDX:
 				compareCycloneDX(t, tt.golden, outputFile)
 			case types.FormatSPDXJSON:
-				compareSpdxJson(t, tt.golden, outputFile)
+				compareSPDXJson(t, tt.golden, outputFile)
 			case types.FormatJSON:
 				compareReports(t, tt.golden, outputFile, tt.override)
 			default: