Removed check that packages have SHA1 checksum, per spec

spdx/package.py

@@ -276,9 +276,6 @@ def validate_checksum(self, messages):
  messages.append(
  "Package checksum must be instance of spdx.checksum.Algorithm"
  )
- else:
- if self.check_sum.identifier != "SHA1":
- messages.append("File checksum algorithm must be SHA1")
 
  return messages
 

tests/test_package.py

@@ -12,6 +12,7 @@
 import unittest
 from unittest import TestCase
 
+from spdx.checksum import Algorithm
 from spdx.package import Package
 
 
@@ -21,6 +22,14 @@ def test_calc_verif_code(self):
  package = Package()
  package.calc_verif_code()
 
+ def test_package_with_non_sha1_check_sum(self):
+ package = Package()
+ package.check_sum = Algorithm("SHA256", '')
+
+ # Make sure that validation still works despite the checksum not being SHA1
+ messages = []
+ messages = package.validate_checksum(messages)
+
 
 if __name__ == '__main__':
  unittest.main()