Azure / Azure/azure-sdk-for-python
setup.py uses invalid SPDX license identifier
- Dominant language
- Python
- Stars
- 5.6k
- Forks
- 3.4k
- Avg merge
- 1d 21h
- Merged PRs (30d)
- 193
Description
- **Package Name**: azure-appconfiguration-provider
- **Package Version**: 2.4.0
- **Operating System**: linux/na
- **Python Version**: 3.14.5/na
**Describe the bug**
The licence field, bundled into the project via [setup.py](https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/appconfiguration/azure-appconfiguration-provider/setup.py) contains `licence="MIT Licence"`. This is not a valid SPDX expression ( https://spdx.org/licenses/ ) and so when anyone generates an SBOM for projects using this package, the licence is not correctly identified and they then have a manual process of fixing this in the sbom management tool (we use DependencyTrack) to set the correct licence.
The correct value should be `licence="MIT"`
This certainly affects azure-appconfiguration-provider, but the same issue affects many other packages within this repo.
- azure-appconfiguration
- azure-keyvault-secrets
- azure-storage-blob
- azure-monitor-opentelemetry
- azure-monitor-opentelemetry-exporter
...to name just a few that DependencyTrack flagged up as not having valid licences (due to the spdx expression being incorrect)
**To Reproduce**
Steps to reproduce the behavior:
1. Generate an sbom using cyclonedx (or another sbom tool) for a project containing this package
2. Upload the sbom to DependencyTrack
3. DependencyTrack has no Licence for the affected packages
**Expected behavior**
I expect the licence to be identified by it's spdx expression
**Screenshots**
n/a but happy to provide further context on request.
**Additional context**
As above
Contributor guide
Assessment
This issue has not been assessed yet.