Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Problem with mapping of licenseConcluded and licenseDeclared values when importing SPDX 2.3 SBOM

Aperta
  • Qualcosa non va?
#2,143 3 commenti 0 reazioni 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@tdruez ci sta già lavorando.

Dal 2/4/2026.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
35/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Tranquilla
Stack tecnologico
python
Ambito
backend, data

Direzione di ricerca

Inizia con la pipeline load_sbom e il relativo percorso di importazione dei pacchetti SPDX 2.3. Confronta come vengono gestiti licenseDeclared e licenseConcluded quando concluded è NOASSERTION, usando gli estratti dei pacchetti forniti come casi. Il lavoro è completato quando le espressioni di licenza dichiarate vengono valorizzate correttamente e le informazioni sulla licenza conclusa vengono conservate come descritto, con il comportamento di importazione coperto dai test pertinenti.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

bug high priority

Describe the bug
Using the load_sbom pipeline, an import of an SPDX 2.3 SBOM does not interpret and map licenseConcluded and licenseDeclared values correctly when licenseDeclared has a valid SPDX license expression but licenseConcluded has a value of NOASSERTION.

System configuration

  • SCIO v37.1.0
  • input: an SPDX 2.3 SBOM
  • pipeline: load_sbom

To Reproduce
Please see the excerpt below, which was taken from a proprietary source.

  1. Create an SPDX 2.3 SBOM containing the excerpt.
  2. Import using load_sbom.
  3. Note that all of the packages show unknown as the Declared license expression.

Expected behavior
The SPDX 2.3 SBOM field for declaredLicense should be used to compute and populate the SCIO Declared license expression. The SPDX 2.3 SBOM concludedLicense is also useful information and should be stored as well; ideally, it should be available in the visible details in SCIO.

    "packages": [
        {
            "SPDXID": "SPDXRef-Package-gstreamer1.0-plugins-good-video4linux2",
            "name": "gstreamer1.0-plugins-good-video4linux2",
            "downloadLocation": "NOASSERTION",
            "packageVerificationCode": {
                "packageVerificationCodeValue": "1c6cda1dc680b9c3f88649dba0b9df5ee898c4ee"
            },
            "licenseInfoFromFiles": [
                "NOASSERTION"
            ],
            "licenseConcluded": "NOASSERTION",
            "licenseDeclared": "LGPL-2.1-or-later",
            "copyrightText": "NOASSERTION",
            "versionInfo": "1.20.7",
            "supplier": "Organization: OpenEmbedded",
            "hasFiles": [
                "SPDXRef-PackagedFile-gstreamer1.0-plugins-good-video4linux2-1"
            ]
        },
        {
            "SPDXID": "SPDXRef-Package-glibc-gconv-ibm866",
            "name": "glibc-gconv-ibm866",
            "downloadLocation": "NOASSERTION",
            "packageVerificationCode": {
                "packageVerificationCodeValue": "834cd72c9bdf9656fe946861d8b3648b49e02f26"
            },
            "licenseInfoFromFiles": [
                "NOASSERTION"
            ],
            "licenseConcluded": "NOASSERTION",
            "licenseDeclared": "(GPL-2.0-only AND LGPL-2.1-only)",
            "copyrightText": "NOASSERTION",
            "versionInfo": "2.35",
            "supplier": "Organization: OpenEmbedded",
            "hasFiles": [
                "SPDXRef-PackagedFile-glibc-gconv-ibm866-1"
            ]
        },
        {
            "SPDXID": "SPDXRef-Package-dnsmasq",
            "name": "dnsmasq",
            "downloadLocation": "NOASSERTION",
            "packageVerificationCode": {
                "packageVerificationCodeValue": "33a1a3f16ba0bef5f130549a3aa7f837a2e5c57c"
            },
            "licenseInfoFromFiles": [
                "NOASSERTION"
            ],
            "licenseConcluded": "NOASSERTION",
            "licenseDeclared": "(GPL-2.0-only OR GPL-3.0-only)",
            "copyrightText": "NOASSERTION",
            "versionInfo": "2.90",
            "supplier": "Organization: OpenEmbedded",
            "hasFiles": [
                "SPDXRef-PackagedFile-dnsmasq-1",
                "SPDXRef-PackagedFile-dnsmasq-2",
                "SPDXRef-PackagedFile-dnsmasq-3",
                "SPDXRef-PackagedFile-dnsmasq-4",
                "SPDXRef-PackagedFile-dnsmasq-5"
            ]
        },
        {
            "SPDXID": "SPDXRef-Package-perl-module-mro",
            "name": "perl-module-mro",
            "downloadLocation": "NOASSERTION",
            "packageVerificationCode": {
                "packageVerificationCodeValue": "f6f6e875c25588b7a69262dce3d2023cbe467c4e"
            },
            "licenseInfoFromFiles": [
                "NOASSERTION"
            ],
            "licenseConcluded": "NOASSERTION",
            "licenseDeclared": "(Artistic-1.0 OR GPL-1.0-or-later)",
            "copyrightText": "NOASSERTION",
            "versionInfo": "5.34.3",
            "supplier": "Organization: OpenEmbedded",
            "hasFiles": [
                "SPDXRef-PackagedFile-perl-module-mro-1",
                "SPDXRef-PackagedFile-perl-module-mro-2"
            ]
        },
        {
            "SPDXID": "SPDXRef-Package-gstreamer1.0-plugins-bad-closedcaption",
            "name": "gstreamer1.0-plugins-bad-closedcaption",
            "downloadLocation": "NOASSERTION",
            "packageVerificationCode": {
                "packageVerificationCodeValue": "8ebae79d2303808ee241060d59336fbf97a9bf78"
            },
            "licenseInfoFromFiles": [
                "NOASSERTION"
            ],
            "licenseConcluded": "NOASSERTION",
            "licenseDeclared": "LGPL-2.1-or-later",
            "copyrightText": "NOASSERTION",
            "versionInfo": "1.20.7",
            "supplier": "Organization: OpenEmbedded",
            "hasFiles": [
                "SPDXRef-PackagedFile-gstreamer1.0-plugins-bad-closedcaption-1"
            ]
        },
        {
            "SPDXID": "SPDXRef-Recipe-iptables",
            "name": "iptables",
            "downloadLocation": "http://netfilter.org/projects/iptables/files/iptables-1.8.7.tar.bz2",
            "licenseInfoFromFiles": [
                "NOASSERTION"
            ],
            "licenseConcluded": "NOASSERTION",
            "licenseDeclared": "GPL-2.0-or-later",
            "copyrightText": "NOASSERTION",
            "versionInfo": "1.8.7",
            "summary": "Tools for managing kernel packet filtering capabilities",
            "supplier": "Organization: OpenEmbedded",
            "description": "iptables is the userspace command line program used to configure and control network packet filtering code in Linux.",
            "homepage": "http://www.netfilter.org/",
            "externalRefs": [
                {
                    "referenceCategory": "SECURITY",
                    "referenceType": "http://spdx.org/rdf/references/cpe23Type",
                    "referenceLocator": "cpe:2.3:a:*:iptables:1.8.7:*:*:*:*:*:*:*"
                }
            ]
Lingua principale
Python
Stelle
223
Fork
214
Merge medio
2g 3h
PR unite (30g)
13

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di aboutcode-org/scancode.io

Tutte le issue di aboutcode-org/scancode.io

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.