AlmaLinux / AlmaLinux/alma-sbom

[BUG]: LicenseExpressionAlongWithOthersException occured when procensing license string descrived as SPDX License Identifier

Open
#91 0 comments 0 reactions 1 assignee Claimed by @KAWAHARA-souta View on GitHub
bug
Dominant language
Python
Stars
16
Forks
8
PR merge metrics
No merged PRs in 30d

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Current Behavior

When building cyclonedx SBOM from RPM packages that including the license info descrived as SPDX License Identifier, bellow error occured.

```
$ alma-sbom --output-file dust --file-format cyclonedx-json package --rpm-package ./alma-sbom/dejavu-sans-fonts-2.37-25.el10.noarch.rpm
Traceback (most recent call last):
File "/home/khwarizmi/env/bin/alma-sbom", line 33, in
sys.exit(load_entry_point('alma-sbom', 'console_scripts', 'alma-sbom')())
File "/home/khwarizmi/alma-sbom/alma_sbom/cli/main.py", line 38, in cli_main
return _main.run()
File "/home/khwarizmi/alma-sbom/alma_sbom/cli/main.py", line 26, in run
return self.command.run()
File "/home/khwarizmi/alma-sbom/alma_sbom/cli/commands/package.py", line 24, in run
doc.write(self.config.output_file)
File "/home/khwarizmi/alma-sbom/alma_sbom/formats/cyclonedx/document.py", line 99, in write
pretty_output = self.formatter.write(self.bom)
File "/home/khwarizmi/alma-sbom/alma_sbom/formats/cyclonedx/document.py", line 47, in write
output = outputter.output_as_string(indent=4)
File "/home/khwarizmi/env/lib64/python3.9/site-packages/cyclonedx/output/json.py", line 83, in output_as_string
self.generate()
File "/home/khwarizmi/env/lib64/python3.9/site-packages/cyclonedx/output/json.py", line 71, in generate
bom.validate()
File "/home/khwarizmi/env/lib64/python3.9/site-packages/cyclonedx/model/bom.py", line 725, in validate
raise LicenseExpressionAlongWithOthersException(
cyclonedx.exception.model.LicenseExpressionAlongWithOthersException: Found LicenseExpression along with others licenses in: , group=None, name=dejavu-sans-fonts, version=0:2.37-25.el10, type=library>
```

### Expected Behavior

We can generate SBOMs

### Steps To Reproduce

Try to build cyclonedx SBOM from RPM packages that including the license info descrived as SPDX License Identifier. (ie. dejavu-sans-fonts-2.37-25.el10.noarch.rpm, dejavu-sans-mono-fonts-2.37-25.el10.noarch.rpm, dejavu-serif-fonts-2.37-25.el10.arc.rpm)

### Anything else?

It appears that some RPM packages in AlmaLinux 10 carry license information conforming to SPDX License Identifiers.
alma-sbom currently lacks the ability to handle this license format correctly — in the CycloneDX case, this results in an error.
In the SPDX case, no error occurs, but the license information is not processed correctly either, so this will need to be implemented properly in the future.

### Search terms

license, spdx

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.