SPDX license expressions incorrectly represented in CycloneDX SBOMs
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 48/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- docker
- Domain
- security
Research direction
Start by reproducing the reported docker scout sbom --format cyclonedx command for bellsoft/liberica-runtime-container:jdk-21-glibc and inspect the generated JSON. Trace how the GPL-2.0 WITH Classpath-Exception-2.0 value is serialized; done means SPDX expressions appear under license.expression rather than license.id.
Written by the indexing model from the issue text.
Description
Hello.
Docker scout version is 1.16.1.
If a license of a component of the image is encoded as a SPDX license expression, in the generated CycloneDX SBOM for the image this expression is put into the licenses[0]["license"]["id"] tag (i.e. as an existing SPDX identifier) instead of putting it into the expression tag.
For example, consider this sbom:
docker scout sbom --format cyclonedx -o lrc_scout_cdx.json --platform linux/amd64 bellsoft/liberica-runtime-container:jdk-21-glibc
The image contains components licensed as GPL-2.0 WITH Classpath-Exception-2.0. In the generated json we will see:
"licenses": [
{
"license": {
"id": "GPL-2.0 WITH Classpath-Exception-2.0"
}
}
],
whereas in accordance to the CycloneDX doc (https://cyclonedx.org/use-cases/open-source-licensing/) it should be something like:
"licenses": [
{
"license": {
"expression": "GPL-2.0 WITH Classpath-Exception-2.0"
}
}
],
- Dominant language
- Shell
- Stars
- 454
- Forks
- 134
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from docker/scout-cli
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
-
allstar
Difficulty 2/5 1-3 hours Newbie friendliness 45/100
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
-
panic: nil deref in createVCS() scanning multi-arch image by tag when no attestation sidecar exists Open
Difficulty 4/5 3-5 days Newbie friendliness 64/100
All issues in docker/scout-cli
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
danielmiessler/LifeOS#2218 ·
-
docs(agents): strengthen the no-backslash-escaped-backticks rule with an issue-creation example Open
Difficulty 1/5 Under an hour Newbie friendliness 92/100
-
technical-debt
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
ll7/robot_sf_ll7#9560 ·
-
package-update
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
oSoWoSo/vOid_Community_repOsitory#148 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100