fix(spdx): use hasExtractedLicensingInfos
for licenses not in the SPDX license list
#7721
Labels
kind/bug
Categorizes issue or PR as related to a bug.
scan/license
Issues relating to license scanning
scan/sbom
Issues relating to SBOM
Description
We can only use licenses from SPDX license list in
licenseConcluded
andlicenseDeclared
fields.For other licenses, we should create new
LicenseRef-*
component (seehasExtractedLicensingInfos
field - https://spdx.github.io/spdx-spec/v2.3/SPDX-license-expressions/#d46-license-expressions-in-rdf) and use this component inlicenseConcluded
andlicenseDeclared
See more details here - #7716
Discussed in #7716
The text was updated successfully, but these errors were encountered: