Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Properly resolve licenses with "OR" expressions #670

Open
msalib opened this issue Jan 22, 2024 · 8 comments
Open

Properly resolve licenses with "OR" expressions #670

msalib opened this issue Jan 22, 2024 · 8 comments
Assignees
Labels
bug Something isn't working

Comments

@msalib
Copy link

msalib commented Jan 22, 2024

Package Version License Issue Type
ryu 1.0.16 Apache-2.0 OR BSL-1.0 Incompatible License

We reject the BSL-1.0 license, so I was confused why this Rust crate was getting rejected since it can be licensed under BSL-1.0 or Apache-2.0 which we accept.

@febuiles febuiles added the bug Something isn't working label Jan 24, 2024
@febuiles
Copy link
Contributor

febuiles commented Jan 24, 2024

The SPDX expression parser we use is brittle (see #263). I think moving to something like https://www.npmjs.com/package/@onebeyond/spdx-license-satisfies would provide a better experience and fix the issues with OR. We don't have cycles to test atm, but are happy to collaborate on community contributions.

@jonjanego jonjanego changed the title Unexpected failure for license disjunction Failing to block licenses for packages that have multiple license types defined with "OR" Mar 12, 2024
@febuiles febuiles changed the title Failing to block licenses for packages that have multiple license types defined with "OR" Properly resolve licenses with "OR" expressions Mar 13, 2024
@febuiles febuiles added the good first issue Good for newcomers label Mar 13, 2024
@jovel jovel removed the good first issue Good for newcomers label Mar 15, 2024
@febuiles febuiles self-assigned this Mar 22, 2024
@npushkarskii
Copy link

Hey there, hope this one won't slip through the cracks and be fixed at some point :) Thank you for handling this issue.

@febuiles
Copy link
Contributor

febuiles commented Mar 30, 2024

@npushkarskii #719 might need tweaks, but it fixes this bug. We hope it lands somewhere in the next week or two.

If you want to start testing it today and help us get feedback you can add uses: actions/dependency-review-action@change-spdx-parser in your worfklow file until the PR and the new version (probably v5) are merged/released.

@npushkarskii
Copy link

@febuiles only managed to see your comment now, sorry for the delay.

Thank you for all the info, my colleagues and I will try to play with the pre-release version you mentioned; if we get to it, I'll let you know about the results in this PR! Thank you again for your help.

@npushkarskii
Copy link

@febuiles Hey there, unfortunately, at our company we didn't have a chance to test a pre-release version of this action due to security policies. Sorry that I got back to you with such a delay.

Hence, I just hope that this PR will be merged anytime soon so that we'll have a new release with the fixed bug 🤞🤞 Thank you!

@febuiles
Copy link
Contributor

cc @jonjanego

@npushkarskii
Copy link

Hey there, me again :) Any chances to see this one merged anytime soon? @febuiles

I see that the version 4.3.4 partially resolves the issue, but I'm not sure if it helped in my case 🥹

Anyway, thank you for working on that and let me know if I can be of any help (even though my ability to help appeared to be extremely limited)

@febuiles
Copy link
Contributor

@npushkarskii I'm not up to date with the latest PRs, maybe @jonjanego or others can provide some guidance here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

4 participants