anchore / anchore/grant

Multiple license assigned ( WITH / OR ) operator

Open
#500 4 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
183
Forks
18
Avg merge
3d 7h
Merged PRs (30d)
7

Description

When an SBOM contains a license expression using the SPDX `WITH` operator
(e.g. `Apache-2.0 WITH LLVM-exception`), grant fails to look it up and logs:

` linux-raw-sys 0.12.1 Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT Unknown `

Grant logs `ERROR unable to get license by ID: Apache-2.0 WITH LLVM-exception`
on every affected component and treats the expression as unresolvable.

Contributor guide

Open the contributing guide

Research direction

No files or tests are named. Start by tracing the SBOM license lookup that logs `unable to get license by ID`, using `Apache-2.0 WITH LLVM-exception` as the reproducer; done means SPDX expressions containing `WITH` resolve without the repeated error and affected components receive the correct license handling.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.