AlmaLinux / AlmaLinux/alma-sbom

[BUG]: LicenseExpressionAlongWithOthersException occured when procensing license string descrived as SPDX License Identifier

Abierto
#91 0 comentarios 0 reacciones 1 asignado Reclamado por @KAWAHARA-souta Ver en GitHub
bug
Lenguaje dominante
Python
Estrellas
16
Forks
8
Métricas de merge de PR
Sin PR fusionados en 30 d

Descripción

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Current Behavior

When building cyclonedx SBOM from RPM packages that including the license info descrived as SPDX License Identifier, bellow error occured.

```
$ alma-sbom --output-file dust --file-format cyclonedx-json package --rpm-package ./alma-sbom/dejavu-sans-fonts-2.37-25.el10.noarch.rpm
Traceback (most recent call last):
File "/home/khwarizmi/env/bin/alma-sbom", line 33, in
sys.exit(load_entry_point('alma-sbom', 'console_scripts', 'alma-sbom')())
File "/home/khwarizmi/alma-sbom/alma_sbom/cli/main.py", line 38, in cli_main
return _main.run()
File "/home/khwarizmi/alma-sbom/alma_sbom/cli/main.py", line 26, in run
return self.command.run()
File "/home/khwarizmi/alma-sbom/alma_sbom/cli/commands/package.py", line 24, in run
doc.write(self.config.output_file)
File "/home/khwarizmi/alma-sbom/alma_sbom/formats/cyclonedx/document.py", line 99, in write
pretty_output = self.formatter.write(self.bom)
File "/home/khwarizmi/alma-sbom/alma_sbom/formats/cyclonedx/document.py", line 47, in write
output = outputter.output_as_string(indent=4)
File "/home/khwarizmi/env/lib64/python3.9/site-packages/cyclonedx/output/json.py", line 83, in output_as_string
self.generate()
File "/home/khwarizmi/env/lib64/python3.9/site-packages/cyclonedx/output/json.py", line 71, in generate
bom.validate()
File "/home/khwarizmi/env/lib64/python3.9/site-packages/cyclonedx/model/bom.py", line 725, in validate
raise LicenseExpressionAlongWithOthersException(
cyclonedx.exception.model.LicenseExpressionAlongWithOthersException: Found LicenseExpression along with others licenses in: , group=None, name=dejavu-sans-fonts, version=0:2.37-25.el10, type=library>
```

### Expected Behavior

We can generate SBOMs

### Steps To Reproduce

Try to build cyclonedx SBOM from RPM packages that including the license info descrived as SPDX License Identifier. (ie. dejavu-sans-fonts-2.37-25.el10.noarch.rpm, dejavu-sans-mono-fonts-2.37-25.el10.noarch.rpm, dejavu-serif-fonts-2.37-25.el10.arc.rpm)

### Anything else?

It appears that some RPM packages in AlmaLinux 10 carry license information conforming to SPDX License Identifiers.
alma-sbom currently lacks the ability to handle this license format correctly — in the CycloneDX case, this results in an error.
In the SPDX case, no error occurs, but the license information is not processed correctly either, so this will need to be implemented properly in the future.

### Search terms

license, spdx

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.