Licensing format mismatch

[cyclonedx]

Licensing format mismatch

[stevespringett]

Yes, Dependency-Track will eventually support SPDX license expressions. Currently it's limited to a single SPDX ID, or an unresolved license name. IMO, I would leave the current rust implementation as-is, because its outputting exactly what it should be.

[stevespringett]

@UgniusV DT supports SPDX license IDs, but does not currently support SPDX license expressions. Refer to DependencyTrack/dependency-track#170 for updates. PR's are also welcome :-)

[stevespringett]

I'll let the maintainers comment on the implementation differences, but Dependency Track does not currently support expressions or evidence, only license id and name.

[amy-keibler]

Hello! Thank you for opening an issue. We output licenses as expressions, because the Cargo manifest format definition of the license field indicates that it will be a SPDX license expression. The Rust community tends to default to MIT OR Apache-2.0 by community convention, so this field will probably rarely be a single license.

@stevespringett is there a plan for Dependency Track to support license expressions?

We could probably use something like the spdx crate to parse the expression into individual licenses and emit a single license where possible as a compatibility solution, but we might not be able to handle complex SPDX expressions (e.g. ones containing AND, OR, or WITH clauses).

[UgniusV]

Great, thanks for the information! Is there any ETA for when DT adds SPDX license support?