Bug: Package FilesAnalyzed field does not behave according to spec

[ianling]

Per the spec, if the FilesAnalyzed field is absent from a document, that should be interpreted as FilesAnalyzed: true.

Unfortunately, for the JSON and YAML parsers/savers, this was missed, so if they are absent, they default to false.

Additionally, the zero/empty value of a boolean in Go is false, and the FilesAnalyzed field's JSON tag contains omitempty, so we are unable to write out the FilesAnalyzed field to a file if it is false; it will simply be omitted, which results in other things (like the online SPDX validator tool) interpreting it as true.

We should change this field to a pointer to denote that it can be absent, and also make sure that we handle that case properly by interpreting it as true across all the different file parsers.

[ianling]

I am handling this

[swinslow]

Thanks @ianling. For what it's worth, the way I addressed this in the original tag-value code and SPDX model for the Golang tools was to add a second parameter, IsFilesAnalyzedTagPresent:

tools-golang/spdx/package.go

Lines 139 to 143 in a532726

	// 3.8: FilesAnalyzed
	// Cardinality: optional, one; default value is "true" if omitted
	FilesAnalyzed bool `json:"filesAnalyzed,omitempty"`
	// NOT PART OF SPEC: did FilesAnalyzed tag appear?
	IsFilesAnalyzedTagPresent bool `json:"-"`

Then, when parsing a document and encountering a new Package section, the default settings for that new Package are:

tools-golang/tvloader/parser2v2/parse_package.go

Lines 27 to 30 in a532726

	parser.pkg = &spdx.Package2_2{
	FilesAnalyzed: true,
	IsFilesAnalyzedTagPresent: false,
	}

which then gets overwritten only if a FilesAnalyzed tag actually appears:

tools-golang/tvloader/parser2v2/parse_package.go

Lines 95 to 101 in a532726

	case "FilesAnalyzed":
	parser.pkg.IsFilesAnalyzedTagPresent = true
	if value == "false" {
	parser.pkg.FilesAnalyzed = false
	} else if value == "true" {
	parser.pkg.FilesAnalyzed = true
	}

Happy to modify this if there's a more appropriate way to handle, especially given how the JSON / YAML tooling will have to handle this.