AlmaLinux / AlmaLinux/alma-sbom
[BUG]: LicenseExpressionAlongWithOthersException occured when procensing license string descrived as SPDX License Identifier
- Lingua principale
- Python
- Stelle
- 16
- Fork
- 8
- Metriche di merge delle PR
- Nessuna PR unita negli ultimi 30g
Descrizione
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Current Behavior
When building cyclonedx SBOM from RPM packages that including the license info descrived as SPDX License Identifier, bellow error occured.
```
$ alma-sbom --output-file dust --file-format cyclonedx-json package --rpm-package ./alma-sbom/dejavu-sans-fonts-2.37-25.el10.noarch.rpm
Traceback (most recent call last):
File "/home/khwarizmi/env/bin/alma-sbom", line 33, in
sys.exit(load_entry_point('alma-sbom', 'console_scripts', 'alma-sbom')())
File "/home/khwarizmi/alma-sbom/alma_sbom/cli/main.py", line 38, in cli_main
return _main.run()
File "/home/khwarizmi/alma-sbom/alma_sbom/cli/main.py", line 26, in run
return self.command.run()
File "/home/khwarizmi/alma-sbom/alma_sbom/cli/commands/package.py", line 24, in run
doc.write(self.config.output_file)
File "/home/khwarizmi/alma-sbom/alma_sbom/formats/cyclonedx/document.py", line 99, in write
pretty_output = self.formatter.write(self.bom)
File "/home/khwarizmi/alma-sbom/alma_sbom/formats/cyclonedx/document.py", line 47, in write
output = outputter.output_as_string(indent=4)
File "/home/khwarizmi/env/lib64/python3.9/site-packages/cyclonedx/output/json.py", line 83, in output_as_string
self.generate()
File "/home/khwarizmi/env/lib64/python3.9/site-packages/cyclonedx/output/json.py", line 71, in generate
bom.validate()
File "/home/khwarizmi/env/lib64/python3.9/site-packages/cyclonedx/model/bom.py", line 725, in validate
raise LicenseExpressionAlongWithOthersException(
cyclonedx.exception.model.LicenseExpressionAlongWithOthersException: Found LicenseExpression along with others licenses in: , group=None, name=dejavu-sans-fonts, version=0:2.37-25.el10, type=library>
```
### Expected Behavior
We can generate SBOMs
### Steps To Reproduce
Try to build cyclonedx SBOM from RPM packages that including the license info descrived as SPDX License Identifier. (ie. dejavu-sans-fonts-2.37-25.el10.noarch.rpm, dejavu-sans-mono-fonts-2.37-25.el10.noarch.rpm, dejavu-serif-fonts-2.37-25.el10.arc.rpm)
### Anything else?
It appears that some RPM packages in AlmaLinux 10 carry license information conforming to SPDX License Identifiers.
alma-sbom currently lacks the ability to handle this license format correctly — in the CycloneDX case, this results in an error.
In the SPDX case, no error occurs, but the license information is not processed correctly either, so this will need to be implemented properly in the future.
### Search terms
license, spdx
Guida per i contributori
Apri la guida per i contributori
Valutazione
Questa issue non è ancora stata valutata.