CycloneDX / CycloneDX/sbom-utility

License Scanning does not work on license name containing url to license

Open
#117 2 comments 0 reactions 0 assignees View on GitHub
working as designed
Dominant language
Go
Stars
163
Forks
21
PR merge metrics
No merged PRs in 30d

Description

We are using the license policy functionality for scanning the licenses inside the SBOM, there is an issue on getting the correct license when the license name is an URL.

Is there a possible fix for that, adjusting the license.json was not successful. I tried putting it as name,family, alias or url but the sbom-utitlity couldn't find any suitable license choice.

Is this a known Issue, I've seen the IBM implementation stated something about a similar issue with license expressions

> // NOTE: we have found some SBOM authors have placed license expressions
// within the "name" field. This prevents us from assigning policy
// return
https://github.com/IBM/sbom-utility/blob/main/cmd/license_policy.go#L154C1-L156C11

I'm a nohead in go therefore I cannot fix it on my own :(

Example output:

```
[TRACE] [ENTER] [2025-01-17 14:52:02.889267424] license.go(228) cmd.hashComponentLicense()
[TRACE] [2025-01-17 14:52:02.889278504] license.go(236) cmd.hashComponentLicense() hashing license for component=`tomcat-embed-core`
[TRACE] [ENTER] [2025-01-17 14:52:02.889283874] license.go(321) cmd.hashLicenseInfoByLicenseType()
[TRACE] [ENTER] [2025-01-17 14:52:02.889288603] license_policy_config.go(365) schema.(*LicensePolicyConfig).FindPolicy()
[TRACE] [ENTER] [2025-01-17 14:52:02.889298552] license_policy_config.go(438) schema.(*LicensePolicyConfig).FindPolicyByFamilyName() ((string):name:, (string):https://www.apache.org/licenses/LICENSE-2.0.txt)
[TRACE] [ENTER] [2025-01-17 14:52:02.889312518] license_policy_config.go(496) schema.(*LicensePolicyConfig).searchForLicenseFamilyName()
[TRACE] [EXIT ] [2025-01-17 14:52:02.889325222] license_policy_config.go(518) schema.(*LicensePolicyConfig).searchForLicenseFamilyName()
[TRACE] [2025-01-17 14:52:02.889331082] license_policy_config.go(486) schema.(*LicensePolicyConfig).FindPolicyByFamilyName() No policy match found for license family name=`https://www.apache.org/licenses/LICENSE-2.0.txt`
[TRACE] [EXIT ] [2025-01-17 14:52:02.889342314] license_policy_config.go(490) schema.(*LicensePolicyConfig).FindPolicyByFamilyName()
[TRACE] [EXIT ] [2025-01-17 14:52:02.889346872] license_policy_config.go(397) schema.(*LicensePolicyConfig).FindPolicy()
[TRACE] [2025-01-17 14:52:02.889373171] bom_hash.go(252) schema.(*BOM).HashmapLicenseInfo() Hashmap Put() licenseInfo: {UsagePolicy:UNDEFINED LicenseChoiceTypeValue:2 LicenseChoiceType:name License:https://www.apache.org/licenses/LICENSE-2.0.txt ResourceName:tomcat-embed-core BOMRef:pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.34?package-id=1c2ad5ed5dfa7568 BOMLocationValue:3 BOMLocation:components LicenseChoice:{License:0xc00060b2c0 CDXLicenseExpression:{Expression: BOMRef: Acknowledgement:}} Policy:{Id: Reference: IsOsiApproved:false IsFsfLibre:false IsDeprecated:false Family: Name: UsagePolicy:UNDEFINED Aliases:[] Children:[] Notes:[] Urls:[] AnnotationRefs:[] AltUsagePolicy: AltAnnotationRefs: AltSPDXId:} Component:{Primary:false Type:library Name:tomcat-embed-core Version:10.1.34 Description: Group: BOMRef:pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.34?package-id=1c2ad5ed5dfa7568 MimeType: Supplier: Publisher: Scope: Hashes: Licenses:0xc000013db8 Copyright: Cpe:cpe:2.3:a:apache:tomcat-embed-core:10.1.34:*:*:*:*:*:*:* Purl:pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.34 Swid: Pedigree: ExternalReferences:0xc000013d88 Components: Evidence: Properties:0xc000013dd0 ReleaseNotes: Signature: Modified:false ModelCard: Data: Authors: OmniborId: Swhid: CryptoProperties: Tags: Manufacturer: Author:} Service:{Name: Version: Description: Group: BOMRef: Endpoints: Authenticated:false XTrustBoundary:false Provider: Data: Licenses: ExternalReferences: Services: Properties: ReleaseNotes: Signature: TrustZone: Tags:} ExtendedLicenseInfo:{LicenseId: LicenseName:https://www.apache.org/licenses/LICENSE-2.0.txt LicenseExpression: LicenseUrl: LicenseTextEncoding: LicenseTextContentType: LicenseTextContent:}}
[TRACE] [EXIT ] [2025-01-17 14:52:02.889382108] license.go(355) cmd.hashLicenseInfoByLicenseType() ((): )
[TRACE] [EXIT ] [2025-01-17 14:52:02.889387788] license.go(266) cmd.hashComponentLicense() ((): )
```

Extract from the sbom
```
{
"bom-ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.34?package-id=1c2ad5ed5dfa7568",
"type": "library",
"name": "tomcat-embed-core",
"version": "10.1.34",
"licenses": [
{
"license": {
"name": "https://www.apache.org/licenses/LICENSE-2.0.txt"
}
}
],
"cpe": "cpe:2.3:a:apache:tomcat-embed-core:10.1.34:*:*:*:*:*:*:*",
"purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.34",
"externalReferences": [
{
"url": "",
"hashes": [
{
"alg": "SHA-1",
"content": "f610f84be607fbc82e393cc220f0ad45f92afc91"
}
],
"type": "build-meta"
}
],
"properties": [
{
"name": "syft:package:foundBy",
"value": "java-archive-cataloger"
},
{
"name": "syft:package:language",
"value": "java"
},
{
"name": "syft:package:type",
"value": "java-archive"
},
{
"name": "syft:package:metadataType",
"value": "java-archive"
},
{
"name": "syft:cpe23",
"value": "cpe:2.3:a:apache:tomcat_embed_core:10.1.34:*:*:*:*:*:*:*"
},
{
"name": "syft:cpe23",
"value": "cpe:2.3:a:apache:tomcat:10.1.34:*:*:*:*:*:*:*"
},
{
"name": "syft:cpe23",
"value": "cpe:2.3:a:apache:embed:10.1.34:*:*:*:*:*:*:*"
},
{
"name": "syft:location:0:path",
"value": "/workflow-0.0.1-SNAPSHOT.jar"
},
{
"name": "syft:metadata:virtualPath",
"value": "/workflow-0.0.1-SNAPSHOT.jar:BOOT-INF/lib/tomcat-embed-core-10.1.34.jar"
}
]
},
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.