Tag-value lexer silently drops an uppercase checksum value, producing Checksum(SHA1, "")

[Atishyy27]

Description

The tag-value checksum lexer rule (src/spdx_tools/spdx/parser/tagvalue/lexer.py:142) captures the value with ([a-f0-9]*) — a *, so a zero-length value is a legal match:

r"SHA3-256|SHA3-384|SHA3-512):\s*([a-f0-9]*)"

For an uppercase checksum (emitted by some real SBOM producers), e.g. FileChecksum: SHA1: D6A770BA38583ED4BB4525BD96E50461655D2758, the value group matches zero characters. A valid-looking CHECKSUM token is produced with an empty value, and the real digits become junk tokens the parser's p_error (body is pass) swallows. The document "parses successfully" and the user gets Checksum(SHA1, "") — then validation reports their 40-digit checksum as "0 digits long".

Reproduce

from spdx_tools.spdx.parser.tagvalue.parser import Parser
doc = ...  # a minimal doc with `FileChecksum: SHA1: D6A770...` (uppercase)
d = Parser().parse(doc)
print([(c.algorithm.name, repr(c.value)) for c in d.files[0].checksums])
# [('SHA1', "''")]

Expected

Reject it with a clear parse error (as it already does for other malformed checksums), not a silent empty value. Lowercase-only validation is intentional (PR #452), so the fix reports rather than accepts uppercase.

Fix

([a-f0-9]*) → ([a-f0-9]+). The line then falls through to the grammar's existing file_checksum : FILE_CHECKSUM error recovery, giving "Error while parsing FileChecksum: Token did not match specified grammar rule". Fix + test ready; PR incoming.