Skip to content

LicenseRef lost when converting from SPDX to CycloneDX #476

@vargenau

Description

@vargenau

simplejson-3.20.2.spdx.json

simplejson-3.20.2.cdx.json

simplejson-3.20.2-from-cdx.spdx.json

simplejson-3.20.2.spdx.json is an SPDX file that contains a custom license:

        {
            "extractedText": "License :: OSI Approved :: Academic Free License (AFL)",
            "licenseId": "LicenseRef-unknown-License-OSI-Approved-Academic-Free-License-AFL",
            "name": "unknown-License-OSI-Approved-Academic-Free-License-AFL"
        }

When converted to CycloneDX, the LicenseRef information is lost, so when converting back to SPDX, you get invalid SPDX.

cyclonedx --version
0.29.2+09de64f86951325836c701dfbf9dde9b5d8fcf7d
cyclonedx convert --input-file simplejson-3.20.2.spdx.json --input-format spdxjson --output-file simplejson-3.20.2.cdx.json --output-format json
cyclonedx validate --input-file simplejson-3.20.2.cdx.json
BOM validated successfully.
cyclonedx convert --input-file simplejson-3.20.2.cdx.json --input-format json --output-file simplejson-3.20.2-from-cdx.spdx.json --output-format spdxjson
pyspdxtools -i simplejson-3.20.2-from-cdx.spdx.json
ERROR:root:The document is invalid. The following issues have been found:
Unrecognized license reference: LicenseRef-unknown-License-OSI-Approved-Academic-Free-License-AFL. license_expression must only use IDs from the license list or extracted licensing info, but is: LicenseRef-unknown-License-OSI-Approved-Academic-Free-License-AFL AND MIT
Unrecognized license reference: LicenseRef-unknown-License-OSI-Approved-Academic-Free-License-AFL. license_expression must only use IDs from the license list or extracted licensing info, but is: LicenseRef-unknown-License-OSI-Approved-Academic-Free-License-AFL AND MIT

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions