DependencyTrack / DependencyTrack/dependency-track

Policy violations not showing up even though policy criteria are met

Open
#4,183 5 comments 0 reactions 0 assignees View on GitHub
defect pending more information
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

Greetings,

I am posting this as a defect report because the same question has already been asked in Discussions without getting any answers, so I believe it might be a bug.

I have created a Policy to detect license conflicts in my projects.
At first I used the pre-defined License Groups in Dependency Track to create a Policy that would fail if a project used both Copyleft and Permissive components at the same time. This did not work even though I had such projects in my Dependency Track instance.

I then tried to do the same with specific Licenses instead of License Groups, as such:
![image](https://github.com/user-attachments/assets/94e015ac-e3fa-470c-9220-bab7f4afbcb5)

However the policy still does not show up as violated. I re-uploaded the bom several times to trigger an analysis in the specific project that uses both of the licenses in the screenshot (GPL-2.0-with-classpath-exception and Apache-2.0), but with no luck.
Also, the policy is globally applied, I have not limited it only to specific projects.

Is this behavior normal?

### Steps to Reproduce

1. Create a policy that should be violated if two or more "conflicting" licenses are used from a project at the same time.
2. Analyze a project that has two or more components with "conflicting" licenses.
3. No policy violation shows up in the project

### Expected Behavior

The policy should show up as violated.

### Dependency-Track Version

4.11.7

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

_No response_

### Browser

Mozilla Firefox

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.