All required properties should have `"minLength": 1`

[Brcrwilliams]

If a property is required, it should also not be an empty string. There are many places in the BOM schema where we use "required": [...] but do not also verify that these properties have "minLength": 1.

An example is .components[].name:

specification/schema/bom-1.6.schema.json

Line 831 in 8e131b1

"name"

It may be that optional properties should have this constraint as well. Consider the following example:

{
  "type": "library",
  "name": "whatever",
  "version": ""
}

If whatever does not have a version, it would be more clear if that key were to be omitted rather than provided as an empty string.

[stevespringett]

Thanks @Brcrwilliams. We'll add this to the 2.0 backlog.

[stevespringett]

Marking this as a defect, as the original intent of the authors using required was so that a value would be provided, not an empty string.

But I also do not think minLength is enough, as tools could simple use " ", which is technically a single whitespace character. The question is, should we also use a pattern such as "pattern": "^\\S+.*$" to block whitespace-only strings? And if we do, what will be the impact on JSON parsers that have to perform a ton more regex than they do today? There's a tradeoff here. Let's discuss.

[jkowalleck]

"pattern": "\\S" would mean "at least one non-whitespace".
"pattern": "^\\S" would mean "must start with a non-whitespace".

but to be honest, i think min-length is enough.

regex-patterns are expensive and slow when tested during schema validation, i would not recommend using them when not really REALLY really needed.