-
-
Notifications
You must be signed in to change notification settings - Fork 54
Closed
Labels
questionFurther information is requestedFurther information is requested
Description
The attempt to assign both a declared and a concluded license to a component results in the following error. Is it not supported to have both assigned or would this require a different construction of the argument?
Error
Traceback (most recent call last):
File "C:\Users\user\01-data\10-git\example\tests\test_cyclonedx.py", line 522, in test__generate_sbom
sbom_str = json_outputter.output_as_string(indent=4)
File "C:\Users\user\01-data\10-git\example\venv\Lib\site-packages\cyclonedx\output\json.py", line 83, in output_as_string
self.generate()
~~~~~~~~~~~~~^^
File "C:\Users\user\01-data\10-git\example\venv\Lib\site-packages\cyclonedx\output\json.py", line 71, in generate
bom.validate()
~~~~~~~~~~~~^^
File "C:\Users\user\01-data\10-git\example\venv\Lib\site-packages\cyclonedx\model\bom.py", line 731, in validate
raise LicenseExpressionAlongWithOthersException(
f'Found LicenseExpression along with others licenses in: {elem!r}')
cyclonedx.exception.model.LicenseExpressionAlongWithOthersException: Found LicenseExpression along with others licenses in: <Component bom-ref=<BomRef '1c788db5-fbbf-4223-aeaa-6873238eba95' id=2750769804880>, group=net.bytebuddy, name=byte-buddy, version=1.15.11, type=ComponentType.LIBRARY>
The license expressions where created like this, where export_dependency.declared_spdx_expression
and export_dependency.concluded_spdx_expression
are strings.
declared_license = LicenseExpression(
value=export_dependency.declared_spdx_expression,
acknowledgement=LicenseAcknowledgement.DECLARED
)
concluded_license = LicenseExpression(
value=export_dependency.concluded_spdx_expression,
acknowledgement=LicenseAcknowledgement.CONCLUDED
)
The component is instanciated like this:
component = Component(
type=ComponentType.LIBRARY,
bom_ref=product_package.data.get("uuid"),
group=package_abcd.get("namespace"),
name=package_abcd.get("name"),
version=package_abcd.get("version"),
description=package_abcd.get("description"),
scope=scope,
hashes=hashes,
licenses=[declared_license, concluded_license],
copyright=package_abcd.get("copyright"),
cpe=cpe,
purl=PackageURL.from_string(package_abcd.get("package_url")),
external_references=external_references
)
Metadata
Metadata
Assignees
Labels
questionFurther information is requestedFurther information is requested