Problem with mapping of licenseConcluded and licenseDeclared values when importing SPDX 2.3 SBOM

Abierto
  • ¿Algo no está bien?
#2,143 3 comentarios 0 reacciones 1 asignado Ver en GitHub

Los mantenedores suelen responder en 1 día

@tdruez ya está trabajando en esto.

Desde el 2/4/2026.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
35/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Tranquilo
Stack tecnológico
python
Área
backend, data

Línea de trabajo

Comienza con el pipeline load_sbom y su ruta de importación de paquetes SPDX 2.3. Compara cómo se gestionan licenseDeclared y licenseConcluded cuando concluded es NOASSERTION, utilizando los extractos de paquetes proporcionados como casos. La tarea estará terminada cuando las expresiones de licencia declaradas se rellenen correctamente y la información de licencia concluida se conserve tal como se describe, con el comportamiento de importación cubierto por las pruebas pertinentes.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

bug high priority

Describe the bug
Using the load_sbom pipeline, an import of an SPDX 2.3 SBOM does not interpret and map licenseConcluded and licenseDeclared values correctly when licenseDeclared has a valid SPDX license expression but licenseConcluded has a value of NOASSERTION.

System configuration

  • SCIO v37.1.0
  • input: an SPDX 2.3 SBOM
  • pipeline: load_sbom

To Reproduce
Please see the excerpt below, which was taken from a proprietary source.

  1. Create an SPDX 2.3 SBOM containing the excerpt.
  2. Import using load_sbom.
  3. Note that all of the packages show unknown as the Declared license expression.

Expected behavior
The SPDX 2.3 SBOM field for declaredLicense should be used to compute and populate the SCIO Declared license expression. The SPDX 2.3 SBOM concludedLicense is also useful information and should be stored as well; ideally, it should be available in the visible details in SCIO.

    "packages": [
        {
            "SPDXID": "SPDXRef-Package-gstreamer1.0-plugins-good-video4linux2",
            "name": "gstreamer1.0-plugins-good-video4linux2",
            "downloadLocation": "NOASSERTION",
            "packageVerificationCode": {
                "packageVerificationCodeValue": "1c6cda1dc680b9c3f88649dba0b9df5ee898c4ee"
            },
            "licenseInfoFromFiles": [
                "NOASSERTION"
            ],
            "licenseConcluded": "NOASSERTION",
            "licenseDeclared": "LGPL-2.1-or-later",
            "copyrightText": "NOASSERTION",
            "versionInfo": "1.20.7",
            "supplier": "Organization: OpenEmbedded",
            "hasFiles": [
                "SPDXRef-PackagedFile-gstreamer1.0-plugins-good-video4linux2-1"
            ]
        },
        {
            "SPDXID": "SPDXRef-Package-glibc-gconv-ibm866",
            "name": "glibc-gconv-ibm866",
            "downloadLocation": "NOASSERTION",
            "packageVerificationCode": {
                "packageVerificationCodeValue": "834cd72c9bdf9656fe946861d8b3648b49e02f26"
            },
            "licenseInfoFromFiles": [
                "NOASSERTION"
            ],
            "licenseConcluded": "NOASSERTION",
            "licenseDeclared": "(GPL-2.0-only AND LGPL-2.1-only)",
            "copyrightText": "NOASSERTION",
            "versionInfo": "2.35",
            "supplier": "Organization: OpenEmbedded",
            "hasFiles": [
                "SPDXRef-PackagedFile-glibc-gconv-ibm866-1"
            ]
        },
        {
            "SPDXID": "SPDXRef-Package-dnsmasq",
            "name": "dnsmasq",
            "downloadLocation": "NOASSERTION",
            "packageVerificationCode": {
                "packageVerificationCodeValue": "33a1a3f16ba0bef5f130549a3aa7f837a2e5c57c"
            },
            "licenseInfoFromFiles": [
                "NOASSERTION"
            ],
            "licenseConcluded": "NOASSERTION",
            "licenseDeclared": "(GPL-2.0-only OR GPL-3.0-only)",
            "copyrightText": "NOASSERTION",
            "versionInfo": "2.90",
            "supplier": "Organization: OpenEmbedded",
            "hasFiles": [
                "SPDXRef-PackagedFile-dnsmasq-1",
                "SPDXRef-PackagedFile-dnsmasq-2",
                "SPDXRef-PackagedFile-dnsmasq-3",
                "SPDXRef-PackagedFile-dnsmasq-4",
                "SPDXRef-PackagedFile-dnsmasq-5"
            ]
        },
        {
            "SPDXID": "SPDXRef-Package-perl-module-mro",
            "name": "perl-module-mro",
            "downloadLocation": "NOASSERTION",
            "packageVerificationCode": {
                "packageVerificationCodeValue": "f6f6e875c25588b7a69262dce3d2023cbe467c4e"
            },
            "licenseInfoFromFiles": [
                "NOASSERTION"
            ],
            "licenseConcluded": "NOASSERTION",
            "licenseDeclared": "(Artistic-1.0 OR GPL-1.0-or-later)",
            "copyrightText": "NOASSERTION",
            "versionInfo": "5.34.3",
            "supplier": "Organization: OpenEmbedded",
            "hasFiles": [
                "SPDXRef-PackagedFile-perl-module-mro-1",
                "SPDXRef-PackagedFile-perl-module-mro-2"
            ]
        },
        {
            "SPDXID": "SPDXRef-Package-gstreamer1.0-plugins-bad-closedcaption",
            "name": "gstreamer1.0-plugins-bad-closedcaption",
            "downloadLocation": "NOASSERTION",
            "packageVerificationCode": {
                "packageVerificationCodeValue": "8ebae79d2303808ee241060d59336fbf97a9bf78"
            },
            "licenseInfoFromFiles": [
                "NOASSERTION"
            ],
            "licenseConcluded": "NOASSERTION",
            "licenseDeclared": "LGPL-2.1-or-later",
            "copyrightText": "NOASSERTION",
            "versionInfo": "1.20.7",
            "supplier": "Organization: OpenEmbedded",
            "hasFiles": [
                "SPDXRef-PackagedFile-gstreamer1.0-plugins-bad-closedcaption-1"
            ]
        },
        {
            "SPDXID": "SPDXRef-Recipe-iptables",
            "name": "iptables",
            "downloadLocation": "http://netfilter.org/projects/iptables/files/iptables-1.8.7.tar.bz2",
            "licenseInfoFromFiles": [
                "NOASSERTION"
            ],
            "licenseConcluded": "NOASSERTION",
            "licenseDeclared": "GPL-2.0-or-later",
            "copyrightText": "NOASSERTION",
            "versionInfo": "1.8.7",
            "summary": "Tools for managing kernel packet filtering capabilities",
            "supplier": "Organization: OpenEmbedded",
            "description": "iptables is the userspace command line program used to configure and control network packet filtering code in Linux.",
            "homepage": "http://www.netfilter.org/",
            "externalRefs": [
                {
                    "referenceCategory": "SECURITY",
                    "referenceType": "http://spdx.org/rdf/references/cpe23Type",
                    "referenceLocator": "cpe:2.3:a:*:iptables:1.8.7:*:*:*:*:*:*:*"
                }
            ]
Lenguaje dominante
Python
Estrellas
223
Forks
214
Merge medio
2 d 3 h
PR fusionados (30 d)
13

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de aboutcode-org/scancode.io

Todos los issues de aboutcode-org/scancode.io

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.