DependencyTrack / DependencyTrack/dependency-track
Policy violations not showing up even though policy criteria are met
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
Greetings,
I am posting this as a defect report because the same question has already been asked in Discussions without getting any answers, so I believe it might be a bug.
I have created a Policy to detect license conflicts in my projects.
At first I used the pre-defined License Groups in Dependency Track to create a Policy that would fail if a project used both Copyleft and Permissive components at the same time. This did not work even though I had such projects in my Dependency Track instance.
I then tried to do the same with specific Licenses instead of License Groups, as such:

However the policy still does not show up as violated. I re-uploaded the bom several times to trigger an analysis in the specific project that uses both of the licenses in the screenshot (GPL-2.0-with-classpath-exception and Apache-2.0), but with no luck.
Also, the policy is globally applied, I have not limited it only to specific projects.
Is this behavior normal?
### Steps to Reproduce
1. Create a policy that should be violated if two or more "conflicting" licenses are used from a project at the same time.
2. Analyze a project that has two or more components with "conflicting" licenses.
3. No policy violation shows up in the project
### Expected Behavior
The policy should show up as violated.
### Dependency-Track Version
4.11.7
### Dependency-Track Distribution
Container Image
### Database Server
PostgreSQL
### Database Server Version
_No response_
### Browser
Mozilla Firefox
### Checklist
- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Assessment
This issue has not been assessed yet.