AlmaLinux / AlmaLinux/alma-sbom

[BUG]: LicenseExpressionAlongWithOthersException occured when procensing license string descrived as SPDX License Identifier

オープン
#91 コメント 0 件 リアクション 0 件 担当者 1 名 @KAWAHARA-souta が担当を希望しています GitHub で見る
bug
主要言語
Python
スター
16
フォーク
8
PR マージ指標
30日以内にマージされた PR はありません

説明

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Current Behavior

When building cyclonedx SBOM from RPM packages that including the license info descrived as SPDX License Identifier, bellow error occured.

```
$ alma-sbom --output-file dust --file-format cyclonedx-json package --rpm-package ./alma-sbom/dejavu-sans-fonts-2.37-25.el10.noarch.rpm
Traceback (most recent call last):
File "/home/khwarizmi/env/bin/alma-sbom", line 33, in
sys.exit(load_entry_point('alma-sbom', 'console_scripts', 'alma-sbom')())
File "/home/khwarizmi/alma-sbom/alma_sbom/cli/main.py", line 38, in cli_main
return _main.run()
File "/home/khwarizmi/alma-sbom/alma_sbom/cli/main.py", line 26, in run
return self.command.run()
File "/home/khwarizmi/alma-sbom/alma_sbom/cli/commands/package.py", line 24, in run
doc.write(self.config.output_file)
File "/home/khwarizmi/alma-sbom/alma_sbom/formats/cyclonedx/document.py", line 99, in write
pretty_output = self.formatter.write(self.bom)
File "/home/khwarizmi/alma-sbom/alma_sbom/formats/cyclonedx/document.py", line 47, in write
output = outputter.output_as_string(indent=4)
File "/home/khwarizmi/env/lib64/python3.9/site-packages/cyclonedx/output/json.py", line 83, in output_as_string
self.generate()
File "/home/khwarizmi/env/lib64/python3.9/site-packages/cyclonedx/output/json.py", line 71, in generate
bom.validate()
File "/home/khwarizmi/env/lib64/python3.9/site-packages/cyclonedx/model/bom.py", line 725, in validate
raise LicenseExpressionAlongWithOthersException(
cyclonedx.exception.model.LicenseExpressionAlongWithOthersException: Found LicenseExpression along with others licenses in: , group=None, name=dejavu-sans-fonts, version=0:2.37-25.el10, type=library>
```

### Expected Behavior

We can generate SBOMs

### Steps To Reproduce

Try to build cyclonedx SBOM from RPM packages that including the license info descrived as SPDX License Identifier. (ie. dejavu-sans-fonts-2.37-25.el10.noarch.rpm, dejavu-sans-mono-fonts-2.37-25.el10.noarch.rpm, dejavu-serif-fonts-2.37-25.el10.arc.rpm)

### Anything else?

It appears that some RPM packages in AlmaLinux 10 carry license information conforming to SPDX License Identifiers.
alma-sbom currently lacks the ability to handle this license format correctly — in the CycloneDX case, this results in an error.
In the SPDX case, no error occurs, but the license information is not processed correctly either, so this will need to be implemented properly in the future.

### Search terms

license, spdx

コントリビューションガイド

コントリビューションガイドを開く

評価

この issue はまだ評価されていません。

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。