AlmaLinux / AlmaLinux/alma-sbom

[BUG]: LicenseExpressionAlongWithOthersException occured when procensing license string descrived as SPDX License Identifier

Aperta
#91 0 commenti 0 reazioni 1 assegnatario Rivendicata da @KAWAHARA-souta Vedi su GitHub
bug
Lingua principale
Python
Stelle
16
Fork
8
Metriche di merge delle PR
Nessuna PR unita negli ultimi 30g

Descrizione

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Current Behavior

When building cyclonedx SBOM from RPM packages that including the license info descrived as SPDX License Identifier, bellow error occured.

```
$ alma-sbom --output-file dust --file-format cyclonedx-json package --rpm-package ./alma-sbom/dejavu-sans-fonts-2.37-25.el10.noarch.rpm
Traceback (most recent call last):
File "/home/khwarizmi/env/bin/alma-sbom", line 33, in
sys.exit(load_entry_point('alma-sbom', 'console_scripts', 'alma-sbom')())
File "/home/khwarizmi/alma-sbom/alma_sbom/cli/main.py", line 38, in cli_main
return _main.run()
File "/home/khwarizmi/alma-sbom/alma_sbom/cli/main.py", line 26, in run
return self.command.run()
File "/home/khwarizmi/alma-sbom/alma_sbom/cli/commands/package.py", line 24, in run
doc.write(self.config.output_file)
File "/home/khwarizmi/alma-sbom/alma_sbom/formats/cyclonedx/document.py", line 99, in write
pretty_output = self.formatter.write(self.bom)
File "/home/khwarizmi/alma-sbom/alma_sbom/formats/cyclonedx/document.py", line 47, in write
output = outputter.output_as_string(indent=4)
File "/home/khwarizmi/env/lib64/python3.9/site-packages/cyclonedx/output/json.py", line 83, in output_as_string
self.generate()
File "/home/khwarizmi/env/lib64/python3.9/site-packages/cyclonedx/output/json.py", line 71, in generate
bom.validate()
File "/home/khwarizmi/env/lib64/python3.9/site-packages/cyclonedx/model/bom.py", line 725, in validate
raise LicenseExpressionAlongWithOthersException(
cyclonedx.exception.model.LicenseExpressionAlongWithOthersException: Found LicenseExpression along with others licenses in: , group=None, name=dejavu-sans-fonts, version=0:2.37-25.el10, type=library>
```

### Expected Behavior

We can generate SBOMs

### Steps To Reproduce

Try to build cyclonedx SBOM from RPM packages that including the license info descrived as SPDX License Identifier. (ie. dejavu-sans-fonts-2.37-25.el10.noarch.rpm, dejavu-sans-mono-fonts-2.37-25.el10.noarch.rpm, dejavu-serif-fonts-2.37-25.el10.arc.rpm)

### Anything else?

It appears that some RPM packages in AlmaLinux 10 carry license information conforming to SPDX License Identifiers.
alma-sbom currently lacks the ability to handle this license format correctly — in the CycloneDX case, this results in an error.
In the SPDX case, no error occurs, but the license information is not processed correctly either, so this will need to be implemented properly in the future.

### Search terms

license, spdx

Guida per i contributori

Apri la guida per i contributori

Valutazione

Questa issue non è ancora stata valutata.

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.