Review comments

Author: spoorcc

dfetch/commands/report.py

@@ -136,7 +136,7 @@ def _determine_licenses(project: ProjectEntry) -> LicenseScanResult:
 
                 if (
                     guessed_license
-                    and guessed_license.probability > LICENSE_PROBABILITY_THRESHOLD
+                    and guessed_license.probability >= LICENSE_PROBABILITY_THRESHOLD
                 ):
                     identified.append(guessed_license)
                 else:

dfetch/reporting/sbom_reporter.py

@@ -131,7 +131,7 @@
 )
 from cyclonedx.model.contact import OrganizationalEntity
 from cyclonedx.model.license import DisjunctiveLicense as CycloneDxLicense
-from cyclonedx.model.license import LicenseAcknowledgement, LicenseExpression
+from cyclonedx.model.license import LicenseAcknowledgement
 from cyclonedx.output import make_outputter
 from cyclonedx.schema import OutputFormat, SchemaVersion
 from packageurl import PackageURL
@@ -408,7 +408,7 @@ def _apply_licenses(component: Component, license_scan: LicenseScanResult) -> No
                     component.evidence.licenses.add(cdx_license)
                 # Record per-license confidence so auditors can compare against
                 # the threshold and re-evaluate if the threshold changes.
-                label = lic.spdx_id or lic.name
+                label = lic.spdx_id or lic.name or "unknown"
                 component.properties.add(
                     Property(
                         name=f"dfetch:license:{label}:confidence",
@@ -417,7 +417,7 @@ def _apply_licenses(component: Component, license_scan: LicenseScanResult) -> No
                 )
             return
 
-        noassertion = LicenseExpression("NOASSERTION")
+        noassertion = CycloneDxLicense(name="NOASSERTION")
         component.licenses.add(noassertion)
         if component.evidence:
             component.evidence.licenses.add(noassertion)

features/report-sbom-license.feature

@@ -35,7 +35,9 @@ Feature: SBOM license transparency for unresolved licenses
                         "name": "SomeProject",
                         "licenses": [
                             {
-                                "expression": "NOASSERTION"
+                                "license": {
+                                    "name": "NOASSERTION"
+                                }
                             }
                         ],
                         "properties": [
@@ -55,7 +57,9 @@ Feature: SBOM license transparency for unresolved licenses
                         "evidence": {
                             "licenses": [
                                 {
-                                    "expression": "NOASSERTION"
+                                    "license": {
+                                        "name": "NOASSERTION"
+                                    }
                                 }
                             ]
                         }
@@ -88,7 +92,9 @@ Feature: SBOM license transparency for unresolved licenses
                         "name": "SomeProject",
                         "licenses": [
                             {
-                                "expression": "NOASSERTION"
+                                "license": {
+                                    "name": "NOASSERTION"
+                                }
                             }
                         ],
                         "properties": [
@@ -108,7 +114,9 @@ Feature: SBOM license transparency for unresolved licenses
                         "evidence": {
                             "licenses": [
                                 {
-                                    "expression": "NOASSERTION"
+                                    "license": {
+                                        "name": "NOASSERTION"
+                                    }
                                 }
                             ]
                         }