-
Notifications
You must be signed in to change notification settings - Fork 3.3k
setup.py uses invalid SPDX license identifier #47131
Copy link
Copy link
Open
Labels
customer-reportedIssues that are reported by GitHub users external to the Azure organization.Issues that are reported by GitHub users external to the Azure organization.needs-triageWorkflow: This is a new issue that needs to be triaged to the appropriate team.Workflow: This is a new issue that needs to be triaged to the appropriate team.questionThe issue doesn't require a change to the product in order to be resolved. Most issues start as thatThe issue doesn't require a change to the product in order to be resolved. Most issues start as that
Metadata
Metadata
Assignees
Labels
customer-reportedIssues that are reported by GitHub users external to the Azure organization.Issues that are reported by GitHub users external to the Azure organization.needs-triageWorkflow: This is a new issue that needs to be triaged to the appropriate team.Workflow: This is a new issue that needs to be triaged to the appropriate team.questionThe issue doesn't require a change to the product in order to be resolved. Most issues start as thatThe issue doesn't require a change to the product in order to be resolved. Most issues start as that
Type
Fields
Give feedbackNo fields configured for issues without a type.
Describe the bug
The licence field, bundled into the project via setup.py contains
licence="MIT Licence". This is not a valid SPDX expression ( https://spdx.org/licenses/ ) and so when anyone generates an SBOM for projects using this package, the licence is not correctly identified and they then have a manual process of fixing this in the sbom management tool (we use DependencyTrack) to set the correct licence.The correct value should be
licence="MIT"This certainly affects azure-appconfiguration-provider, but the same issue affects many other packages within this repo.
...to name just a few that DependencyTrack flagged up as not having valid licences (due to the spdx expression being incorrect)
To Reproduce
Steps to reproduce the behavior:
Expected behavior
I expect the licence to be identified by it's spdx expression
Screenshots
n/a but happy to provide further context on request.
Additional context
As above