DependencyTrack / DependencyTrack/dependency-track

Policy violation: Library fails incorrectly on audit

Open
#1,984 2 comments 0 reactions 0 assignees View on GitHub
in triage pending more information
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

Incorrect Policy violation: On Audit libraries that do not have a permissive license are supposed to fail. This includes libraries that do not have MIT and Apache etc licenses. However many libraries WITH permissive licenses fail and show up in the audit as a policy. violation.

Setting the correct license under view details: component details: legal: license also fails to update and throws an error intermittently.

### Current Behavior:
Incorrect Policy violation for libraries.

### Steps to Reproduce:
Create a policy to fail based on license type eg Permissive license group:

![image](https://user-images.githubusercontent.com/16746699/192998357-561afd9d-61f5-4839-acbf-1c7faf86b743.png)

Dozens of Libraries that should pass the audit because they are permissive fail:

One example:

![image](https://user-images.githubusercontent.com/16746699/192998927-63088777-9cec-4c89-b1dc-685c957a22aa.png)

![image](https://user-images.githubusercontent.com/16746699/192998759-ad4ecd95-70b2-4233-8be5-cf11fded59c8.png)

### Expected Behavior:

The library does not appear as a policy violation

### Environment:

- Dependency-Track Version: latest
- Distribution: [ Docker | Executable WAR | Traditional WAR ] Docker
- BOM Format & Version: CycloneDX
- Database Server: [ H2 | MSSQL | MySQL | PostgreSQL ] H2
- Browser: Chrome

### Additional Details:

Occurs with different CycloneDX libraries in different languages.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.