CycloneDX / CycloneDX/cyclonedx-cli

bug: SMAIL-GPL causing validate to fail

Open
#459 3 comments 1 reaction 0 assignees View on GitHub
Dominant language
C#
Stars
541
Forks
82
PR merge metrics
No merged PRs in 30d

Description

👋 Sorry if this is being handled in another thread. I tried to find all coverage of current licenses issues and didn't see this one.

### Reproduction
You might need to modify the platform flag for your local on the below:
```
syft -o cyclonedx-json docker:nginx:latest | docker run -i --platform linux/amd64 cyclonedx/cyclonedx-cli:latest validate --input-format json

On instance: /components/12/licenses/2/license:
{"id":"SMAIL-GPL"}
Value should match one of the values specified by the enum
http://cyclonedx.org/schema/spdx.schema.json
On instance: /components/12/licenses/2/license/id:
SMAIL-GPL
Unable to validate against any JSON schemas.
BOM is not valid.
```

After removing the SMAIL-GPL License from the SBOM in component[12]:

```
cat new.json | docker run -i --platform linux/amd64 cyclonedx/cyclonedx-cli:latest validate --input-format json
BOM validated successfully.
```

I'm not sure which version of `http://cyclonedx.org/schema/spdx.schema.json` the validator is pulling from since I do see `SMAIL-GPL` included there. If this is fixed by doing a new release then no harm no foul I'll close the issue when the new release comes out 😄

Also. I did notice how this issue then caused a TON of noise above it. Here is the full output of the error:
```
On instance: /components/12/licenses:
[{"license":{"id":"GPL-2.0-only"}},{"license":{"id":"GPL-2.0-or-later"}},{"license":{"id":"SMAIL-GPL"}},{"license":{"name":"public-domain"}}]
Value should have at most 1 items
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1

On instance: /components/12/licenses:
[{"license":{"id":"GPL-2.0-only"}},{"license":{"id":"GPL-2.0-or-later"}},{"license":{"id":"SMAIL-GPL"}},{"license":{"name":"public-domain"}}]
Required properties ["expression"] are not present
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1/items/0

On instance: /components/12/licenses/0:
{"license":{"id":"GPL-2.0-only"}}
All values fail against the false schema
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1/additionalItems

On instance: /components/12/licenses/1:
{"license":{"id":"GPL-2.0-or-later"}}
All values fail against the false schema
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1/additionalItems

On instance: /components/12/licenses/2:
{"license":{"id":"SMAIL-GPL"}}
All values fail against the false schema
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1/additionalItems

On instance: /components/12/licenses/3:
{"license":{"name":"public-domain"}}
All values fail against the false schema
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1/items/0/additionalProperties

On instance: /components/12/licenses/0/license:
{"id":"GPL-2.0-only"}
Required properties ["name"] are not present
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1

On instance: /components/12/licenses/2/license:
{"id":"SMAIL-GPL"}
Value should match one of the values specified by the enum
http://cyclonedx.org/schema/spdx.schema.json
On instance: /components/12/licenses/2/license/id:
SMAIL-GPL
Unable to validate against any JSON schemas.
BOM is not valid.
```

The logic basically keys on SMAIL-GPL not being a valid spdx-id, and then because of that it invalidates all other entries as failing against the schema for one reason or another ☹️ --- I think there might be some ways to clean this up, but defer to the maintainers here on what they think the best presentation of errors like this should be.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.