Does repository_license_choices has an effect on CycloneDXReporter sbom output?

[mawl]

Hey,

I wonder if repository_license_choices has an effect on sbom output generated by CycloneDXReporter.

ort/plugins/reporters/cyclonedx/src/main/kotlin/CycloneDxReporter.kt

Line 271 in 9cbcf9f

licenseChoice = LicenseChoice().apply { licenses = licenseObjects }

Here's an example:

analyzer-result.yml

   - id: "NPM::pizzip:3.1.4"
      purl: "pkg:npm/pizzip@3.1.4"
      authors:
      - "Edgar Hipp"
      declared_licenses:
      - "(MIT OR GPL-3.0)"
      declared_licenses_processed:
        spdx_expression: "GPL-3.0-only OR MIT"
        mapped:
          (MIT OR GPL-3.0): "MIT OR GPL-3.0-only"
      description: "Create, read and edit .zip files synchronously with Javascript"
      homepage_url: "https://github.com/open-xml-templating/pizzip#readme"
...

evaluation-result.yml

 config:
...
    license_choices:
      repository_license_choices:
      - given: "GPL-3.0-only OR MIT"
        choice: "MIT"
      - given: "MIT OR GPL-3.0-only"
        choice: "MIT"
...
   - id: "NPM::pizzip:3.1.4"
      purl: "pkg:npm/pizzip@3.1.4"
      authors:
      - "Edgar Hipp"
      declared_licenses:
      - "(MIT OR GPL-3.0)"
      declared_licenses_processed:
        spdx_expression: "GPL-3.0-only OR MIT"
        mapped:
          (MIT OR GPL-3.0): "MIT OR GPL-3.0-only"
      description: "Create, read and edit .zip files synchronously with Javascript"
      homepage_url: "https://github.com/open-xml-templating/pizzip#readme"

ORT Scan Report > Tree

Effective SPDX is MIT, license choice works:

bom.cyclonedx.json

Still both licenses in sbom - license choice has no effect.

    {
      "group": "",
      "name": "pizzip",
      "version": "3.1.4",
      "description": "Create, read and edit .zip files synchronously with Javascript",
      "scope": "required",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0c2578506ce5b487fa00bc2dd62eebeb291ee677"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "GPL-3.0-only",
            "text": {
              "encoding": "base64",
              "contentType": "plain/text",
              "content": "..."
            }
          }
        },
        {
          "license": {
            "id": "MIT",
            "text": {
              "encoding": "base64",
              "contentType": "plain/text",
              "content": "..."
            }
          }
        }
      ],

Or did I miss something?

[sschuberth]

As a side note, I thought this would be too complicated:

  repository_license_choices:
  - given: "GPL-3.0-only OR MIT"
    choice: "MIT"
  - given: "MIT OR GPL-3.0-only"
    choice: "MIT"

But I indeed just verified that the order of OR operands matters in given directives! Is that intended, @MarcelBochtler? It seems highly counter-intuitive to me.

[fviernau]

But I indeed just verified that the order of OR operands matters in given directives! Is that intended, @MarcelBochtler? It seems high counter-intuitive to me.

IIUC, the ordering issue is a bug which was already on the radar, see #6721.

[sschuberth]

IIUC, the ordering issue is a bug which was already on the radar, see #6721.

I don't think that's related. Creating the DNF does not alter / create a deterministic order of licenses.

But I remember that we once discussed whether SpdxExpression.normalize() should also sort licenses by name, which IMO would solve this (if DNF would also normalize), but IIRC we ditched the sorting due to performance concerns or so...

[sschuberth]

But I remember that we once discussed whether SpdxExpression.normalize() should also sort licenses by name, which IMO would solve this (if DNF would also normalize), but IIRC we ditched the sorting due to performance concerns or so...

It was almost like at: #4077

[mawl]

As a side note, I thought this would be too complicated:

  repository_license_choices:
  - given: "GPL-3.0-only OR MIT"
    choice: "MIT"
  - given: "MIT OR GPL-3.0-only"
    choice: "MIT"

But I indeed just verified that the order of OR operands matters in given directives! Is that intended, @MarcelBochtler? It seems highly counter-intuitive to me.

Yes, I have declared both combinations just to exclude possible "given" order issues.

But my first question is, if repository_license_choices would work for CycloneDXReporter or not. So, Just to clarify: is a license choice only important during report phase or should it change the licenses of a dependency even in the evaluation-result.yml?

[sschuberth]

Any (general) reporter should take licenses choices into account (unless it's a very special reporter that somehow needs to provide access to "raw" data), and licenses choices are also applied before the evaluation phase (otherwise you'd never be able to fix rule violations by making a license choice).

So, your bug report sounds valid, but I haven't verified it yet.

[mawl]

Tested and it works. Thanks :)