Skip to content

setup.py uses invalid SPDX license identifier #47131

@PaulGarnerUk

Description

@PaulGarnerUk
  • Package Name: azure-appconfiguration-provider
  • Package Version: 2.4.0
  • Operating System: linux/na
  • Python Version: 3.14.5/na

Describe the bug
The licence field, bundled into the project via setup.py contains licence="MIT Licence". This is not a valid SPDX expression ( https://spdx.org/licenses/ ) and so when anyone generates an SBOM for projects using this package, the licence is not correctly identified and they then have a manual process of fixing this in the sbom management tool (we use DependencyTrack) to set the correct licence.

The correct value should be licence="MIT"

This certainly affects azure-appconfiguration-provider, but the same issue affects many other packages within this repo.

  • azure-appconfiguration
  • azure-keyvault-secrets
  • azure-storage-blob
  • azure-monitor-opentelemetry
  • azure-monitor-opentelemetry-exporter

...to name just a few that DependencyTrack flagged up as not having valid licences (due to the spdx expression being incorrect)

To Reproduce
Steps to reproduce the behavior:

  1. Generate an sbom using cyclonedx (or another sbom tool) for a project containing this package
  2. Upload the sbom to DependencyTrack
  3. DependencyTrack has no Licence for the affected packages

Expected behavior
I expect the licence to be identified by it's spdx expression

Screenshots
n/a but happy to provide further context on request.

Additional context
As above

Metadata

Metadata

Assignees

No one assigned

    Labels

    customer-reportedIssues that are reported by GitHub users external to the Azure organization.needs-triageWorkflow: This is a new issue that needs to be triaged to the appropriate team.questionThe issue doesn't require a change to the product in order to be resolved. Most issues start as that

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions