fix(sbom): detect sha256 hashes in expression-form licenses in needs_fix#1911
fix(sbom): detect sha256 hashes in expression-form licenses in needs_fix#1911mesutoezdil wants to merge 1 commit into
Conversation
CycloneDX allows licenses as either {"license": {"id": "..."}} or
{"expression": "..."}. needs_fix only checked the license form, so
expression entries with sha256 hashes were silently skipped.
Add expression-form check to needs_fix, mirroring the fix in
extract_licenses (NVIDIA#1898). Add tests covering both forms.
mesutoezdil
requested review from
a team,
derekwaynecarr and
mrunalp
as code owners
johntmyers
left a comment
johntmyers
left a comment
There was a problem hiding this comment.
PR Review: fix(sbom): detect sha256 hashes in expression-form licenses in needs_fix
Findings
-
[P1]
deploy/sbom/test_resolve_licenses.py:11will fail Python lint. The file mutatessys.pathand then importsresolve_licenseson line 12; Ruff selectsEinpyproject.toml:80, andpython:lintruns againstdeploy/sbom/*.pyviatasks/python.toml:200, so this tripsE402before the tests can help protect the fix. Use an import pattern that does not require a post-statement module import, or add an explicit local exemption if that is the accepted pattern. -
[P2]
deploy/sbom/test_resolve_licenses.py:15is not covered by the default test runner.mise run test:pythonrunsuv run pytest python/, and pytest is configured withtestpaths = ["python"]pluspython_files = ["*_test.py"]inpyproject.toml:107-109. This new file is underdeploy/sbom/and namedtest_*.py, so the regression tests are effectively dead unless invoked manually. -
[P2]
tasks/sbom.toml:80still has the old unresolved-license detector.sbom:checkonly checkslicense.idandlicense.name, so an SBOM containing{"expression": "sha256:..."}can still report “All licenses resolved.” after this PR. That leaves the same false-negative in the user-facing SBOM check path; it should either reuseneeds_fixor mirror the new expression handling.
Notes
The needs_fix production change itself matches the PR description.
Testing
Not run. This was a code-only review per the review workflow.
2 participants
CycloneDX allows licenses in 2 forms:
{"license": {"id": "MIT"}}// handled correctly{"expression": "MIT OR Apache-2.0"}// not checked inneeds_fixneeds_fixonly looked at thelicensekey, so components with a sha256 hash in expression form were silently skipped and never resolved.This is the parallel fix to #1898, which fixed the same gap in
extract_licenses. Adds tests covering both forms.