CycloneDX/sbom-utility

SBOM Utility passing SBOM with unexpected WITH clause

Open

#131 opened on Jun 12, 2025

View on GitHubContributor guide
 (2 comments) (0 reactions) (0 assignees)Go (20 forks)auto 404
enhancementhelp wantedworking as designed

Repository metrics

Stars
 (155 stars)
PR merge metrics
 (PR metrics pending)

Description

Our SBOM tool created an invalid license in that it was defined as an expression and not as it should have been as a name. (Currently being fixed.

We ran the SBOM Utility against it and it passed the validation, but it would not import into Dependency Track.

The issue is that what is in the expression is not a valid expression. DT correctly picked this up, but the utility passed it.

      {
        "expression": "Apache-2.0 WITH LLVM-exception"
      },

      "licenses": [
        {
          "expression": "Apache-2.0 WITH LLVM-exception"
        }
      ],

In this case, the tool should have thrown a wobbly as it is not valid.

Our work around is to change the license to Apache-2.0-with-LLVM-exception and that forces it to name.

Contributor guide

Research direction
Investigate the license validation logic in the SBOM utility, specifically how it handles license expressions vs names. Add validation to reject invalid expressions like 'Apache 2.0 WITH LLVM exception' that are not valid SPDX expressions.
Tech stack
go
Domain
backendtoolingsecurity
Issue type
Bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Fresh
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
Go
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
60