feat: support multi license mix #582

jkowalleck · 2025-01-20T15:41:25Z

As discussed in ticket #454, this PR adds the following abilities:

have multiple license expressions
have a mix of license expressions, SPDX license IDs, and named licenses

Please read the original ticket and see the provided example data for use-cases.

fixes #454

TODO/DONE

jkowalleck · 2025-01-22T08:37:29Z

tools/src/test/resources/1.7/valid-license-declared-concluded-mix-1.7.textproto

this example is new

the examples are taken from the use-cases of #454

All licence posture in here is for show-case ony.
This is not a real law-case!

jkowalleck · 2025-01-22T08:37:38Z

tools/src/test/resources/1.7/valid-license-declared-concluded-mix-1.7.json

this example is new.

the examples are taken from the use-cases of #454

All licence posture in here is for show-case ony.
This is not a real law-case!

jkowalleck · 2025-01-22T08:37:45Z

tools/src/test/resources/1.7/valid-license-declared-concluded-mix-1.7.xml

this example is new

the examples are taken from the use-cases of #454

All licence posture in here is for show-case ony.
This is not a real law-case!

jkowalleck · 2025-01-22T08:40:07Z

tools/src/test/resources/1.6/invalid-license-declared-concluded-mix-1.6.json

this is a backport of a newly added valid example for CDX 1.7.
in CDX 1.6, it is invalid.

jkowalleck · 2025-01-22T08:40:13Z

tools/src/test/resources/1.6/invalid-license-declared-concluded-mix-1.6.xml

this is a backport of a newly added valid example for CDX 1.7.
in CDX 1.6, it is invalid.

… named/spdx licenses Signed-off-by: Jan Kowalleck <[email protected]>

Signed-off-by: Jan Kowalleck <[email protected]>

jkowalleck · 2025-01-22T09:39:08Z

tools/src/test/resources/1.7/valid-license-choice-1.7.xml

this case is now passing - as expected

jkowalleck · 2025-01-22T09:39:15Z

tools/src/test/resources/1.7/valid-license-choice-1.7.json

this case is now passing - as expected

jkowalleck · 2025-01-22T09:39:22Z

tools/src/test/resources/1.7/valid-license-choice-1.7.textproto

this case is now passing - as expected

jkowalleck · 2025-01-22T09:58:06Z

@stevespringett this one is ready for review

stevespringett · 2025-02-06T17:04:26Z

RFC notice sent.
https://groups.io/g/CycloneDX/message/304
https://cyclonedx.slack.com/archives/CVA0G10FN/p1738861352347449

Public RFC period ends March 6, 2025

jkowalleck · 2025-03-06T16:22:23Z

RFC notice sent. https://groups.io/g/CycloneDX/message/304 https://cyclonedx.slack.com/archives/CVA0G10FN/p1738861352347449

Public RFC period ends March 6, 2025

Period ended today, change was promoted to TC54.

In today's TC54 meeting, some members rejected the feature as it is today, and rejected the original promoted feature. Reason: they expressed, that allowing multiple licenses was a bad idea.

The discussion about that shall be continued in the original ticket: #454

jkowalleck · 2025-04-11T17:10:29Z

schema/bom-1.7.schema.json

    "licenseChoice": {
      "title": "License Choice",
-      "description": "EITHER (list of SPDX licenses and/or named licenses) OR (tuple of one SPDX License Expression)",
+      "description": "A list of SPDX licenses and/or named licenses and/or SPDX License Expression.",


@pombredanne proposed to go with

EITHER (list of SPDX licenses and/or named licenses) OR (list of SPDX License Expressions)
but with the addons from #619

i dont see how this proposal is a user-friendly solution.
if my intake is a list of declared SPDX licenses, and i am planning to add a single SPDX Expression for the concluded license, then I would have to migrate all the existing structures from SPDX licenses to SPDX license expressions.

INTAKE

<licenses> <license acknowledgement="declared"><id>Apache-2.0<id><license> <license acknowledgement="declared"><id>MIT<id><license> <license acknowledgement="declared"><name>My Custom Foo<name><license> <licenses>

OUTPUT as proposed - causing migration

<licenses> <expression acknowledgement="declared">Apache-2.0</expression> <expression acknowledgement="declared">MIT</expression> <expression acknowledgement="declared">LicenseRef-My-Custom-Foo</expression> <expression acknowledgement="concluded">Apache-2.0 and MIT and LicenseRef-My-Custom-Foo</expression> <licenses>

instead, i would prefer to not migrate any structures and still be able to add new data.

this is especially important when evidence collection happens - i want to be free with the types i record, i dont want ot be forces to use only one or the other.

Signed-off-by: Jan Kowalleck <[email protected]>

jkowalleck · 2025-06-06T13:02:49Z

Incorporated the latest development of 1.7-dev into the examples.
This will add additional justification to this feature.

pombredanne

Good for me... we can always refine it later!
Sorry to have taken so much time to review and come to an agreement.

jkowalleck · 2025-07-24T15:17:35Z

Good for me... we can always refine it later! Sorry to have taken so much time to review and come to an agreement.

no worries, @pombredanne,
Some things just take longer. I mean, it took me half a year to understand community needs fully, and come up with a solution that actually helps.
I can clearly understand that you had questions and fears. Now that this is ready for merging, a followup is needed, to minimize ambiguity - one of the things you feared:

[FEATURE]: there SHOULD be at most one "declared" and one "conclude" license per component #619

## Fixed * XML schema: add type for `ComponentData` sub-elements ([#600] via [#601]) * JSON schema: added the correct `deprecated` mark for already deprecated structures (via [a973a6b]) ## Deprecated * Deprecated various fields and structures related to _cryptographic transparency_ - _CBOM_ . (via [#657]) Use the newly added structures and fields for detailing the information instead. ## Changed * Extended the scope of _formulations_. (via [#647]) From now on, _formulations_ may be used to describe how any referencable object within the BOM came together, including components, services, metadata, declarations, or the BOM itself. Before, it was restricted to components and services. ## Added * Support for _external components_ with _version-ranges_ ([#321] via [#586]) * Support for _multiple_ SPDX License Expressions alongside with other licenses ([#454] via [#582]) * Support for _Streebog hashing algorithm_ ([#485] via [#525]) * Support for license expression _details and properties_ ([#549], [#554] via [#599]) * Support for expressing BOM distribution constraints with the _Traffic Light Protocol_ (TLP) in metadata ([#595] via [#604], [#653]) * Support for representing _patent information_ ([#596] via [#597]) * Support for _properties_ on external-references ([#608] via [#610]) * Support for _citations_ ([#630] via [#629]) * Support for detailing _cryptographic transparency_ information - _CBOM_ ([#569] via [#657]) ## Documentation * Elaborated component classification "platform", explicitly expressed that it includes just-in-time compilers and interpreters ([#233] via [#647]) * Removed the term "optional" from the schema where the definition was already unambiguous ([#616], [#649] via [#680]) ## Test data * Add test data for CycloneDX 1.7 implementations in XML, JSON, Protobuf [#233]: #233 [#321]: #321 [#454]: #454 [#485]: #485 [#525]: #525 [#549]: #549 [#554]: #554 [#569]: #569 [#582]: #582 [#586]: #586 [#595]: #595 [#596]: #596 [#597]: #597 [#599]: #599 [#600]: #600 [#601]: #601 [#604]: #604 [#608]: #608 [#610]: #610 [#616]: #616 [#629]: #629 [#630]: #630 [#647]: #647 [#649]: #649 [#653]: #653 [#657]: #657 [#680]: #680 [a973a6b]: a973a6b ---- - fixes #233 - fixes #321 - fixes #454 - fixes #485 - fixes #549 - fixes #554 - fixes #595 - fixes #596 - fixes #600 - fixes #608 - fixes #629 - fixes #616 - fixes #649

jkowalleck added the proposed core enhancement label Jan 20, 2025

jkowalleck requested a review from a team as a code owner January 20, 2025 15:41

jkowalleck changed the base branch from master to 1.7-dev January 20, 2025 15:41

jkowalleck marked this pull request as draft January 20, 2025 15:41

jkowalleck changed the title ~~draft: Feat/licenses multi mix all~~ feat: multi license mix Jan 20, 2025

jkowalleck added the ready for review label Jan 20, 2025

jkowalleck marked this pull request as ready for review January 20, 2025 16:02

jkowalleck added this to the 1.7 milestone Jan 20, 2025

jkowalleck mentioned this pull request Jan 20, 2025

licenses: allow mix of multiple SPDX expressions AND/OR multiple named/spdx licenses #454

Closed

jkowalleck force-pushed the feat/licenses-multi-mix-all branch 2 times, most recently from fb297fa to 9374fbe Compare January 22, 2025 08:38

jkowalleck commented Jan 22, 2025

View reviewed changes

feat: licenses allow mix of multiple SPDX expressions AND/OR multiple…

9f5b308

… named/spdx licenses Signed-off-by: Jan Kowalleck <[email protected]>

jkowalleck force-pushed the feat/licenses-multi-mix-all branch from 9374fbe to 9f5b308 Compare January 22, 2025 09:07

jkowalleck removed the ready for review label Jan 22, 2025

jkowalleck marked this pull request as draft January 22, 2025 09:09

tests

4abbe2f

Signed-off-by: Jan Kowalleck <[email protected]>

jkowalleck force-pushed the feat/licenses-multi-mix-all branch from c2dcce9 to 4abbe2f Compare January 22, 2025 09:40

jkowalleck commented Jan 22, 2025

View reviewed changes

jkowalleck marked this pull request as ready for review January 22, 2025 09:55

jkowalleck added the ready for review label Jan 22, 2025

Joerki mentioned this pull request Jan 28, 2025

Add clarification on what a list of licenses means #349

Open

Merge branch '1.7-dev' into feat/licenses-multi-mix-all

3f3873e

stevespringett added the RFC notice sent A public RFC notice was distributed to the CycloneDX mailing list for consideration label Feb 6, 2025

jkowalleck changed the title ~~feat: multi license mix~~ feat: support multi license mix Feb 8, 2025

Merge branch '1.7-dev' into feat/licenses-multi-mix-all

f5aa93e

jkowalleck added the draft label Feb 24, 2025

jkowalleck mentioned this pull request Feb 25, 2025

feat: license expression details and properties - text attachment, licensing, etc #599

Merged

4 tasks

stevespringett approved these changes Mar 6, 2025

View reviewed changes

jkowalleck removed the RFC notice sent A public RFC notice was distributed to the CycloneDX mailing list for consideration label Mar 6, 2025

jkowalleck added request for comment RFC notice sent A public RFC notice was distributed to the CycloneDX mailing list for consideration promote to tc54 Promote to Ecma Technical Committee 54 labels Mar 18, 2025

jkowalleck commented Apr 11, 2025

View reviewed changes

jkowalleck added the RFC vote accepted label Apr 14, 2025

jkowalleck added 3 commits June 6, 2025 14:14

Merge branch '1.7-dev' into feat/licenses-multi-mix-all

bc3dda0

tests: add latest features to test cases

5462e66

Signed-off-by: Jan Kowalleck <[email protected]>

tests: add latest features to test cases

32b73df

Signed-off-by: Jan Kowalleck <[email protected]>

jkowalleck mentioned this pull request Jun 6, 2025

feat: licenses acknowledgement SHOULD be unique #626

Open

pombredanne approved these changes Jul 24, 2025

View reviewed changes

jkowalleck added tc54 reviewed Ecma TC54 has reviewed the feature candidate tc54 accepted Ecma TC54 has accepted the feature candidate labels Jul 24, 2025

jkowalleck merged commit e95af17 into 1.7-dev Jul 24, 2025
9 checks passed

jkowalleck mentioned this pull request Jul 24, 2025

v1.7 #511

Merged

jkowalleck mentioned this pull request Aug 14, 2025

Declared and concluded license results in error CycloneDX/cyclonedx-python-lib#874

Closed

Uh oh!

feat: support multi license mix #582

feat: support multi license mix #582

Uh oh!

Conversation

jkowalleck commented Jan 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jkowalleck Jan 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jkowalleck Jan 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jkowalleck Jan 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jkowalleck Jan 22, 2025

Choose a reason for hiding this comment

Uh oh!

jkowalleck Jan 22, 2025

Choose a reason for hiding this comment

Uh oh!

jkowalleck Jan 22, 2025

Choose a reason for hiding this comment

Uh oh!

jkowalleck Jan 22, 2025

Choose a reason for hiding this comment

Uh oh!

jkowalleck Jan 22, 2025

Choose a reason for hiding this comment

Uh oh!

jkowalleck commented Jan 22, 2025

Uh oh!

stevespringett commented Feb 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jkowalleck commented Mar 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jkowalleck Apr 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jkowalleck Apr 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jkowalleck commented Jun 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pombredanne left a comment

Choose a reason for hiding this comment

Uh oh!

jkowalleck commented Jul 24, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

jkowalleck commented Jan 20, 2025 •

edited

Loading

jkowalleck Jan 22, 2025 •

edited

Loading

jkowalleck Jan 22, 2025 •

edited

Loading

jkowalleck Jan 22, 2025 •

edited

Loading

stevespringett commented Feb 6, 2025 •

edited

Loading

jkowalleck commented Mar 6, 2025 •

edited

Loading

jkowalleck Apr 11, 2025 •

edited

Loading

jkowalleck Apr 14, 2025 •

edited

Loading

jkowalleck commented Jun 6, 2025 •

edited

Loading