Replies: 3 comments
-
|
@DmitriyLewen Can you please take a look? |
Beta Was this translation helpful? Give feedback.
-
|
A couple thoughts, suggestions - It looks like the license ID is being generated from the text in the license POM file. I have found that the license URL to be much more reliable in identifying listed license IDs. The text can be somewhat ambiguous and unreliable. For an implementation in Java of this approach, see the MavenToSpdxLicenseMapper. It is licensed under Apache 2.0 - so please feel free to leverage whatever makes sense. |
Beta Was this translation helpful? Give feedback.
-
|
Hello @goneall Created #7721 for this task. Regards, Dmitriy |
Beta Was this translation helpful? Give feedback.
-
Description
In some cases, a license expression uses an ID which is not on the SPDX listed license list.
From the SPDX Spec on license expressions, a simple license must be either an ID on the license list, an ID starting with
LicenseRef-, or a reference to a license defined in an external SPDX document starting withDocumentRef-.Desired Behavior
Any non-standard licenses should have a LicenseRef created. If the license text is available, it should be included in the extracted license represented by the LicenseRef otherwise the text of the license should provide some context (e.g. "This license represent the license identifier Apache found in a POM file").
For reference, this pull request fixes up all the invalid license ID's found in a Trivy generated file: lfscanning/scaffold#93
For the Java package
com.github.java-json-tools:json-schema-validator, the following should be produced:{
"name": "com.github.java-json-tools:json-schema-validator",
"SPDXID": "SPDXRef-Package-5057bcef68a69a7c",
"versionInfo": "2.2.14",
"supplier": "NOASSERTION",
"downloadLocation": "git+https://github.com/spdx/tools-java",
"filesAnalyzed": false,
"sourceInfo": "package found in: pom.xml",
"licenseConcluded": "(Lesser-General-Public-License--version-3 OR greater) AND Apache-2.0",
"licenseDeclared": "(Lesser-General-Public-License--version-3 OR greater) AND Apache-2.0",
"externalRefs": [
{
"referenceCategory": "PACKAGE-MANAGER",
"referenceType": "purl",
"referenceLocator": "pkg:maven/com.github.java-json-tools/[email protected]"
}
],
Target
Filesystem
Scanner
License
Output Format
SPDX
Mode
Standalone
Debug Output
Operating System
Windows 11
Version
Checklist
trivy clean --allBeta Was this translation helpful? Give feedback.
All reactions