Error validating download location with git+ssh URI

[bdehamer]

When using git URLs to reference packages in npm, the URL often gets normalized to a form like:

git+ssh://git@github.com/foo/bar.git#b7e1e0fb20cff47bcca4be90d0c6f83a45e51e9c

When using a URL of this form as a downloadLocation value, it fails validation due to the git@ portion of the URL.

Can the URL regex be expanded to allow for the userinfo portion of the URI?

tools-python/src/spdx_tools/spdx/validation/uri_validators.py

Lines 10 to 12 in f15a64f

	url_pattern = (
	"(http:\\/\\/www\\.|https:\\/\\/www\\.|http:\\/\\/|https:\\/\\/|ssh:\\/\\/|git:\\/\\/|svn:\\/\\/|sftp:"
	"\\/\\/|ftp:\\/\\/)?[a-z0-9]+([\\-\\.]{1}[a-z0-9]+){0,100}\\.[a-z]{2,5}(:[0-9]{1,5})?(\\/.*)?"

[maxhbr]

Oh Yes, this should explicitly be allowed, see spec section 7.7.

We would also be happy to support you to contribute that fix. If you want, just start creating a PR. You already found the relevant code section.