Multiple license assigned ( WITH / OR ) operator
- Dominant language
- Go
- Stars
- 183
- Forks
- 18
- Avg merge
- 3d 7h
- Merged PRs (30d)
- 7
Description
When an SBOM contains a license expression using the SPDX `WITH` operator
(e.g. `Apache-2.0 WITH LLVM-exception`), grant fails to look it up and logs:
` linux-raw-sys 0.12.1 Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT Unknown `
Grant logs `ERROR unable to get license by ID: Apache-2.0 WITH LLVM-exception`
on every affected component and treats the expression as unresolvable.
Contributor guide
Research direction
No files or tests are named. Start by tracing the SBOM license lookup that logs `unable to get license by ID`, using `Apache-2.0 WITH LLVM-exception` as the reproducer; done means SPDX expressions containing `WITH` resolve without the repeated error and affected components receive the correct license handling.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100