fix: properly declare licenses from environment #417
Conversation
| if str(classifier).startswith('License :: OSI Approved :: '): | ||
| c.licenses.add( | ||
| LicenseChoice( | ||
| license_expression=str(classifier).replace('License :: OSI Approved :: ', '').strip() |
There was a problem hiding this comment.
a SPDX license expression like Mozilla Public License 1.0 (MPL) was NEVER valid.
jkowalleck
force-pushed
the
fix-license-usage
branch
from
313b2d9
to
8aaa2b5
Compare
|
@Jonas-vdb this should fix your issue, right? |
|
@jkowalleck Great to see this issue being picked up! Thanks. If all the licenses are indeed named, it will be shown in Dependency track. Will be great improvement! Small question: Looking at the code, it seems we now always use named licenses and never SPDX IDs? Some licenses will probably match a SPDX (e.g. MIT)? |
Tried to come with the least invasive fix possible for an actual error (wrong use of expression). A wholesome solution could be to use the new features from CycloneDX/cyclonedx-python-lib#305 |
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
jkowalleck
force-pushed
the
fix-license-usage
branch
from
8aaa2b5
to
e1ce8d6
Compare
current implementation uses SPDX license expressions for everything, instead of using license with name or wth spdx ids
this caused broken results.
better: use license with name for everything, as this cannot cause any malformed result.
Here is the fix.
closes #410