CycloneDX / CycloneDX/cyclonedx-cli

Validate command incorrectly reports an error for `GD` license

Open
#220 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
541
Forks
82
PR merge metrics
No merged PRs in 30d

Description

I've validated SBOM by the command `cyclonedx-cli validate --input-file ${NGINX_REPORTS}/Details/Anchore-SBOM.xml --input-version v1_4`, built by Anchore Syft with next component inside:
```

GD Team
libgd3
2.3.0-2

BSD-3-Clause

GD

GPL-2.0

GPL-2.0+

HPND

MIT

cpe:2.3:a:libgd3:libgd3:2.3.0-2:*:*:*:*:*:*:*
pkg:deb/debian/libgd3@2.3.0-2?arch=amd64&upstream=libgd2&distro=debian-11

dpkgdb-cataloger
DpkgMetadata
deb
sha256:c91abae8e127264382b71f8b64fdbab94c0b9a146d2969e64fa087c3b3ca2c68
/var/lib/dpkg/status
sha256:c91abae8e127264382b71f8b64fdbab94c0b9a146d2969e64fa087c3b3ca2c68
/var/lib/dpkg/info/libgd3:amd64.md5sums
sha256:c91abae8e127264382b71f8b64fdbab94c0b9a146d2969e64fa087c3b3ca2c68
/usr/share/doc/libgd3/copyright
463
libgd2

```

And I've got next output from the tool:
```
Validating XML BOM...
Validation failed at line number 10264 and position 19: The 'http://cyclonedx.org/schema/bom/1.4:id' element is invalid - The value 'GD' is invalid according to its datatype 'http://cyclonedx.org/schema/spdx:licenseId' - The Enumeration constraint failed.
BOM is not valid.
```

However, The spec has an explicit list of licenses: [https://cyclonedx.org/docs/1.4/json/#components_items_licenses_items_license_id](https://cyclonedx.org/docs/1.4/json/#components_items_licenses_items_license_id)
One of them is "GD"

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.