Syft creates two LicenseRef- that differ only by case
- Dominant language
- Go
- Stars
- 9.6k
- Forks
- 954
- Avg merge
- 1d 5h
- Merged PRs (30d)
- 42
Description
**What happened**:
In the following file:
[syft-container5.spdx.json.txt](https://github.com/anchore/syft/files/12746483/syft-container5.spdx.json.txt)
Syft has created two LicenseRef- that differ only by case:
```
LicenseRef-BSD-3-clause-generic
```
```
LicenseRef-BSD-3-clause-GENERIC
```
This is invalid SPDX. See https://github.com/spdx/tools-java/issues/143
**What you expected to happen**:
Syft should create two distinct indentifiers.
**Steps to reproduce the issue**:
**Anything else we need to know?**:
**Environment**:
- Output of `syft version`: syft-0.86.1
Contributor guide
Research direction
Start with the attached syft-container5.spdx.json.txt and the reported syft-0.86.1 behavior. Reproduce the case-only LicenseRef variants and trace the SPDX output generation; done means the generated output no longer violates SPDX because identifiers differ only by case.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100