CycloneDX/sbom-utility

SBOM Utility passing SBOM with unexpected WITH clause

開放

#131 建立於 2025年6月12日

 (2 則留言) (0 個反應) (0 位負責人)Go (20 個分叉)auto 404
enhancementhelp wantedworking as designed

倉庫指標

星標
 (155 顆星)
PR 合併指標
 (PR 指標待抓取)

描述

Our SBOM tool created an invalid license in that it was defined as an expression and not as it should have been as a name. (Currently being fixed.

We ran the SBOM Utility against it and it passed the validation, but it would not import into Dependency Track.

The issue is that what is in the expression is not a valid expression. DT correctly picked this up, but the utility passed it.

      {
        "expression": "Apache-2.0 WITH LLVM-exception"
      },
      "licenses": [
        {
          "expression": "Apache-2.0 WITH LLVM-exception"
        }
      ],

In this case, the tool should have thrown a wobbly as it is not valid.

Our work around is to change the license to Apache-2.0-with-LLVM-exception and that forces it to name.

貢獻者指南