Azure / Azure/azure-sdk-for-python
setup.py uses invalid SPDX license identifier
- Lingua principale
- Python
- Stelle
- 5.6k
- Fork
- 3.4k
- Merge medio
- 2g 2h
- PR unite (30g)
- 213
Descrizione
- **Package Name**: azure-appconfiguration-provider
- **Package Version**: 2.4.0
- **Operating System**: linux/na
- **Python Version**: 3.14.5/na
**Describe the bug**
The licence field, bundled into the project via [setup.py](https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/appconfiguration/azure-appconfiguration-provider/setup.py) contains `licence="MIT Licence"`. This is not a valid SPDX expression ( https://spdx.org/licenses/ ) and so when anyone generates an SBOM for projects using this package, the licence is not correctly identified and they then have a manual process of fixing this in the sbom management tool (we use DependencyTrack) to set the correct licence.
The correct value should be `licence="MIT"`
This certainly affects azure-appconfiguration-provider, but the same issue affects many other packages within this repo.
- azure-appconfiguration
- azure-keyvault-secrets
- azure-storage-blob
- azure-monitor-opentelemetry
- azure-monitor-opentelemetry-exporter
...to name just a few that DependencyTrack flagged up as not having valid licences (due to the spdx expression being incorrect)
**To Reproduce**
Steps to reproduce the behavior:
1. Generate an sbom using cyclonedx (or another sbom tool) for a project containing this package
2. Upload the sbom to DependencyTrack
3. DependencyTrack has no Licence for the affected packages
**Expected behavior**
I expect the licence to be identified by it's spdx expression
**Screenshots**
n/a but happy to provide further context on request.
**Additional context**
As above
Guida per i contributori
Apri la guida per i contributori
Valutazione
Questa issue non è ancora stata valutata.