Local (file:) repositories give an invalid download location, and fail the build since 0.12.0

[thomasponsmicroej]

The plugin copies the repository URL into downloadLocation. For a local repository, Gradle gives a file: URL. SPDX 2 does not accept a file: path as a download location.

The behaviour changed between two releases:

• 0.11.0 and earlier: the plugin writes file:/home/user/.m2/repository/.... The SBOM is invalid.
• 0.12.0: the plugin throws InvalidSPDXAnalysisException. The build fails and writes no SBOM.

The plugin should write NOASSERTION instead of failing in this case.
The impact is small because most projects resolve from remote repositories.

To reproduce:

  plugins {
    java
    id("org.spdx.sbom") version "0.12.0"
  }
  version = "1.0"
  repositories { mavenLocal() }
  dependencies { implementation("com.example:someLib:1.0.0") }

A maven { url = uri("file:///path/to/repo") } repository gives the same result as mavenLocal().

Result with 0.12.0:

  > Task :spdxSbomForRelease FAILED
  > org.spdx.core.InvalidSPDXAnalysisException: Invalid download location
    file:/home/user/.m2/repository/com/example/someLib/1.0.0/someLib-1.0.0.jar.
    Must match the pattern ^(NONE|NOASSERTION|...

Expected result: the build succeeds, the plugin logs a warning, and the SBOM contains "downloadLocation": "NOASSERTION"