CycloneDX / CycloneDX/cyclonedx-cli
bug: SMAIL-GPL causing validate to fail
- Dominant language
- C#
- Stars
- 541
- Forks
- 82
- PR merge metrics
- No merged PRs in 30d
Description
👋 Sorry if this is being handled in another thread. I tried to find all coverage of current licenses issues and didn't see this one.
### Reproduction
You might need to modify the platform flag for your local on the below:
```
syft -o cyclonedx-json docker:nginx:latest | docker run -i --platform linux/amd64 cyclonedx/cyclonedx-cli:latest validate --input-format json
On instance: /components/12/licenses/2/license:
{"id":"SMAIL-GPL"}
Value should match one of the values specified by the enum
http://cyclonedx.org/schema/spdx.schema.json
On instance: /components/12/licenses/2/license/id:
SMAIL-GPL
Unable to validate against any JSON schemas.
BOM is not valid.
```
After removing the SMAIL-GPL License from the SBOM in component[12]:
```
cat new.json | docker run -i --platform linux/amd64 cyclonedx/cyclonedx-cli:latest validate --input-format json
BOM validated successfully.
```
I'm not sure which version of `http://cyclonedx.org/schema/spdx.schema.json` the validator is pulling from since I do see `SMAIL-GPL` included there. If this is fixed by doing a new release then no harm no foul I'll close the issue when the new release comes out 😄
Also. I did notice how this issue then caused a TON of noise above it. Here is the full output of the error:
```
On instance: /components/12/licenses:
[{"license":{"id":"GPL-2.0-only"}},{"license":{"id":"GPL-2.0-or-later"}},{"license":{"id":"SMAIL-GPL"}},{"license":{"name":"public-domain"}}]
Value should have at most 1 items
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1
On instance: /components/12/licenses:
[{"license":{"id":"GPL-2.0-only"}},{"license":{"id":"GPL-2.0-or-later"}},{"license":{"id":"SMAIL-GPL"}},{"license":{"name":"public-domain"}}]
Required properties ["expression"] are not present
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1/items/0
On instance: /components/12/licenses/0:
{"license":{"id":"GPL-2.0-only"}}
All values fail against the false schema
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1/additionalItems
On instance: /components/12/licenses/1:
{"license":{"id":"GPL-2.0-or-later"}}
All values fail against the false schema
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1/additionalItems
On instance: /components/12/licenses/2:
{"license":{"id":"SMAIL-GPL"}}
All values fail against the false schema
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1/additionalItems
On instance: /components/12/licenses/3:
{"license":{"name":"public-domain"}}
All values fail against the false schema
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1/items/0/additionalProperties
On instance: /components/12/licenses/0/license:
{"id":"GPL-2.0-only"}
Required properties ["name"] are not present
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1
On instance: /components/12/licenses/2/license:
{"id":"SMAIL-GPL"}
Value should match one of the values specified by the enum
http://cyclonedx.org/schema/spdx.schema.json
On instance: /components/12/licenses/2/license/id:
SMAIL-GPL
Unable to validate against any JSON schemas.
BOM is not valid.
```
The logic basically keys on SMAIL-GPL not being a valid spdx-id, and then because of that it invalidates all other entries as failing against the schema for one reason or another ☹️ --- I think there might be some ways to clean this up, but defer to the maintainers here on what they think the best presentation of errors like this should be.
Contributor guide
Assessment
This issue has not been assessed yet.