Drop the versionless `License ::` classifier now that `license` is a valid SPDX expression
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 78/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- python
- Domain
- build-system
Research direction
Inspect the packaging configuration responsible for the built METADATA and locate the deprecated Mozilla Public License classifier. Remove that classifier while preserving the existing MPL-2.0 license field, then run the cyclonedx-bom reproduction commands and confirm the generated component license contains only the valid SPDX identifier.
Written by the indexing model from the issue text.
Description
This issue is part of a larger batch of similar-scoped issues we distribute in the context of our internal vulnerability and dependency tracking activities. The batch covers multiple projects, this is only one of them. The goal is to rise awareness and trigger/initiate the change towards clean project metadata in projects we depend on.
Summary
This project already declares a valid SPDX license id/expression in its packaging metadata (License: MPL-2.0 in the built METADATA), but the deprecated classifier License :: OSI Approved :: Mozilla Public License 2.0 (MPL 2.0) is still present. PEP 639-aware SBOM tooling like cyclonedx-bom can't map it to an SPDX id, so it falls back to emitting the raw classifier text as a free-text license name. This free-text field is just noise and causes downstream tooling to flag this project as non-SPDX-compliant.
Suggested fix
Remove the redundant License :: OSI Approved :: from classifiers in the packaging config. No change to the license field is needed.
How to reproduce
uv tool install cyclonedx-bom
uv venv .venv-repro
uv pip install --python .venv-repro/bin/python certifi
cyclonedx-py environment .venv-repro -o sbom.cdx.json
... and then check the .licenses property of the component. There should only something like:
// This is how it should look like
...
"license": {
"acknowledgement": "declared",
"id": "<VALID SPDX IDENTIFIER>"
}
...
and not:
// This is how it should not look like
...
"license": {
"acknowledgement": "declared",
"name": "<CLASSIFIER TAKEN FROM METADATA"
}
...
I'm happy to provide a PR to resolve this timely after approval!
- Dominant language
- Python
- Stars
- 998
- Forks
- 296
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 1
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from certifi/python-certifi
-
Difficulty 3/5 1-2 days Newbie friendliness 42/100
certifi/python-certifi#188 · 3 comments · 7 reactions ·
All issues in certifi/python-certifi
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100