Azure / Azure/azure-sdk-for-python

setup.py uses invalid SPDX license identifier

Aperta
#47,131 2 commenti 0 reazioni 1 assegnatario Rivendicata da @kashifkhan Vedi su GitHub
customer-reported needs-team-attention question
Lingua principale
Python
Stelle
5.6k
Fork
3.4k
Merge medio
2g 2h
PR unite (30g)
213

Descrizione

- **Package Name**: azure-appconfiguration-provider
- **Package Version**: 2.4.0
- **Operating System**: linux/na
- **Python Version**: 3.14.5/na

**Describe the bug**
The licence field, bundled into the project via [setup.py](https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/appconfiguration/azure-appconfiguration-provider/setup.py) contains `licence="MIT Licence"`. This is not a valid SPDX expression ( https://spdx.org/licenses/ ) and so when anyone generates an SBOM for projects using this package, the licence is not correctly identified and they then have a manual process of fixing this in the sbom management tool (we use DependencyTrack) to set the correct licence.

The correct value should be `licence="MIT"`

This certainly affects azure-appconfiguration-provider, but the same issue affects many other packages within this repo.
- azure-appconfiguration
- azure-keyvault-secrets
- azure-storage-blob
- azure-monitor-opentelemetry
- azure-monitor-opentelemetry-exporter

...to name just a few that DependencyTrack flagged up as not having valid licences (due to the spdx expression being incorrect)

**To Reproduce**
Steps to reproduce the behavior:
1. Generate an sbom using cyclonedx (or another sbom tool) for a project containing this package
2. Upload the sbom to DependencyTrack
3. DependencyTrack has no Licence for the affected packages

**Expected behavior**
I expect the licence to be identified by it's spdx expression

**Screenshots**
n/a but happy to provide further context on request.

**Additional context**
As above

Guida per i contributori

Apri la guida per i contributori

Valutazione

Questa issue non è ancora stata valutata.

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.