bug: emit standards-valid SPDX file identifiers and validate SBOM interoperability

[codeforester]

Goal

emit standards-valid SPDX file identifiers and validate SBOM interoperability.

Background and verified evidence

Review date: 2026-09-17. Reviewed commit: 38042cbf23b9380c626aae6c9fe168f97096c1cc. Parent: #214.

Reopening existing #456 rather than creating a duplicate: its acceptance criteria already require an independent SPDX 2.3 semantic validator. A fresh current-main 2.1.0 artifact passes the repository verifier but spdx-tools==0.8.5 reports 46 file validation errors: each file has SHA256 but lacks the SPDX-required SHA1 checksum. The identifier fix did land; the remaining semantic validation criterion did not. Reference: https://spdx.github.io/spdx-spec/v2.3/file-information/#84-file-checksum-field .

Scope and acceptance criteria

• Retain the corrected collision-resistant file IDs.
• Make the complete newly generated SPDX document pass a pinned independent semantic validator, including file checksums and package/file relationships.
• Run that validator in CI and include a fixture rejected for semantic, rather than JSON-only, errors.
• Correct future artifacts through the normal release process, preserving published immutable bytes.

Validation

Build at 38042cb, parse with spdx_tools.spdx.parser.parse_anything.parse_file, then require no messages from validate_full_spdx_document. Pin spdx-tools 0.8.5 or a reviewed successor.

Non-goals

No unrelated API expansion or automatic release publication. Preserve immutable published assets and unrelated consumer files.

Project fields

• Status: Ready
• Priority: P2
• Area: Packaging
• Initiative: Adoption Polish
• Size: M
• Milestone: v2.2.0
• Target date: unset; no delivery date has been committed.
• Type: Bug

Agent assignment

Assignee: codeforester. This is review/backlog intake; implementation has not started.

Original issue description (historical evidence)

Goal

Produce an SPDX SBOM that standard external consumers can validate.

Background

Parent: #214. Identified in the 2026-09-11 design, engineering, and adoption review at de1589c803591ac41a16cca33da4726bb96e15fc.

write_sbom transforms punctuation in paths to underscores for SPDXRef-File-* IDs. SPDX 2.3 clause 8.2 permits letters, numbers, dot, and hyphen in the identifier suffix, not underscores. A fresh artifact build from the reviewed commit produced 45 invalid file IDs out of 46, including SPDXRef-File-lib_bash_std_lib_std_sh. The repository's scripts/release-artifact verify still accepted the set when run from the repository root: self-consistency checking is not standards validation.

Scope

Use a collision-resistant standards-valid identifier mapping and add external/specification-based validation of generated SBOMs.

Acceptance Criteria

• All SPDX identifiers obey the specification and remain unique for paths that differ only in punctuation.
• Required package/file metadata and relationships pass an appropriate SPDX 2.3 semantic validator, beyond JSON parseability.
• Keep deterministic output and coherent archive/checksum/provenance binding.
• Add regression fixtures that fail the former underscore mapping and potential normalization collisions.
• Apply corrections to a future authorized release; preserve immutable published bytes.

Validation

Run scripts/release-artifact build --version 2.1.0 --commit de1589c803591ac41a16cca33da4726bb96e15fc --output <new-temp-dir>, then inspect file IDs against SPDXRef-[A-Za-z0-9.-]+. Run both the existing verifier and a pinned standards-aware SBOM validator. The reviewed artifact was a local test build, not a published release.

Non-Goals

No unrelated public API expansion or release publication.

Project Fields

• Status: Ready
• Priority: P2
• Area: Packaging
• Initiative: Adoption Polish
• Size: M
• Milestone: v2.2.0
• Target date: unset; no delivery date has been committed.

Agent Assignment

• Assignee: codeforester
• No implementation has started; ready/backlog status is intentional.

[codeforester]

Implemented and merged via PR #469. Release SBOM file IDs now use collision-resistant hexadecimal path encoding, verifier validation rejects invalid/duplicate IDs, and the former underscore mapping has regression coverage. Existing immutable release bytes were not modified.