fix(sbom): handle SPDX expression licenses in extract_licenses#1898
fix(sbom): handle SPDX expression licenses in extract_licenses#1898mesutoezdil wants to merge 1 commit into
Conversation
CycloneDX allows licenses as either {"license": {"id": "..."}} or
{"expression": "MIT OR Apache-2.0"}. The expression form was silently
dropped, producing an empty license field in the CSV output.
mesutoezdil
requested review from
a team,
derekwaynecarr and
mrunalp
as code owners
PR Review StatusValidation: This is a small, concentrated SBOM tooling bug fix. The PR addresses a documented CycloneDX license form ( Review findings:
Docs: Fern docs update is not needed because this only changes generated SBOM CSV extraction behavior and does not alter a documented user-facing workflow, CLI contract, provider flow, policy syntax, or published API. E2E: No Next state: |
|
/ok to test e18f427 |
Maintainer Approval NeededGator validation and PR monitoring are complete. Validation: This is a small, concentrated SBOM CSV extraction fix for CycloneDX SPDX expression licenses in Human maintainer approval or merge decision is now required. |
johntmyers
added
gator:approval-needed
2 participants
CycloneDX allows licenses in 2 forms:
{"license": {"id": "MIT"}}; handled correctly{"expression": "MIT OR Apache-2.0"}; silently droppedextract_licensesonly checked for thelicensekey, so any componentusing the
expressionform got an empty license field in the CSV output.Add a check for
expressionbefore falling back to thelicenseblock.