CycloneDX / CycloneDX/cyclonedx-cli
Validate command incorrectly reports an error for `GD` license
- Dominant language
- C#
- Stars
- 541
- Forks
- 82
- PR merge metrics
- No merged PRs in 30d
Description
I've validated SBOM by the command `cyclonedx-cli validate --input-file ${NGINX_REPORTS}/Details/Anchore-SBOM.xml --input-version v1_4`, built by Anchore Syft with next component inside:
```
GD Team
libgd3
2.3.0-2
BSD-3-Clause
GD
GPL-2.0
GPL-2.0+
HPND
MIT
cpe:2.3:a:libgd3:libgd3:2.3.0-2:*:*:*:*:*:*:*
pkg:deb/debian/libgd3@2.3.0-2?arch=amd64&upstream=libgd2&distro=debian-11
dpkgdb-cataloger
DpkgMetadata
deb
sha256:c91abae8e127264382b71f8b64fdbab94c0b9a146d2969e64fa087c3b3ca2c68
/var/lib/dpkg/status
sha256:c91abae8e127264382b71f8b64fdbab94c0b9a146d2969e64fa087c3b3ca2c68
/var/lib/dpkg/info/libgd3:amd64.md5sums
sha256:c91abae8e127264382b71f8b64fdbab94c0b9a146d2969e64fa087c3b3ca2c68
/usr/share/doc/libgd3/copyright
463
libgd2
```
And I've got next output from the tool:
```
Validating XML BOM...
Validation failed at line number 10264 and position 19: The 'http://cyclonedx.org/schema/bom/1.4:id' element is invalid - The value 'GD' is invalid according to its datatype 'http://cyclonedx.org/schema/spdx:licenseId' - The Enumeration constraint failed.
BOM is not valid.
```
However, The spec has an explicit list of licenses: [https://cyclonedx.org/docs/1.4/json/#components_items_licenses_items_license_id](https://cyclonedx.org/docs/1.4/json/#components_items_licenses_items_license_id)
One of them is "GD"
Contributor guide
Assessment
This issue has not been assessed yet.