anchore / anchore/syft

`License` field in Python package metadata could be name or full text

Open
#2,969 4 comments 1 reaction 0 assignees View on GitHub
bug license
Dominant language
Go
Stars
9.6k
Forks
954
Avg merge
23h 27m
Merged PRs (30d)
48

Description

**What would you like to be added**:

The *python-installed-package-cataloger* cataloger could employ a heuristic to determine whether the `License` field in package metadata contains a license descriptor or the full license text.
For example, if a certain number of newlines and text length are exceeded, the value could be considered the full text.

When it's determined to be the full text, it should be added as such to the SBOM. In CycloneDX, that means creating a license object such as:
```
"license": {
"name": "Found in ",
"text": {
"content": ""
}
}
```

**Why is this needed**:

The `License` field [isn't clearly defined](https://packaging.python.org/en/latest/specifications/core-metadata/#license). While in my experience, most packages just put down a license name or even SPDX id, it is not uncommon to find the full text in there.
For example, [pandas](https://pypi.org/project/pandas/) uses it this way.

**Additional context**:

This would fit well with #656. If a full text is identified, it could immediately be classified.

`License` field might be deprecated if [PEP-639](https://peps.python.org/pep-0639) get's approved. Still, even then I believe this issue will stay relevant for years to come.

Contributor guide

Open the contributing guide

Research direction

Start at the python-installed-package-cataloger and trace how the License metadata field becomes an SBOM license. Review the CycloneDX license representation and existing cataloger tests, then cover both descriptor values and long full-text values, with completion shown by tests verifying the full text is emitted in the license object.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
tooling
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.