Error handling for unknown licenses

[c-lud]

Hi all,

I run into the following problem with my dependency track:
Whenever I upload a SBOM containing a license which is not known to Dtrack, it only throws the error "invalid schema".
This appears to be wrong for me, due to the error not being an issue with the schema. Also, it makes error handling (especially in automated pipelines) quite hard. Is there a way for Dtrack to tell me which license is unknown in the BOM? Currently, you have to look manually through all the licenses and compare with the Dtrack Database, if I'm not mistaken.
If there is no way to do this at the time and if not, is it maybe an option to add a more defined error handling?

Appreciate your help.

Dtrack Version: 4.11.1

[nscuro]

Have a look at the body of the response you're getting when uploading a BOM. If it's a schema validation error, it will list the things it found to be invalid: #3522

You can also give sbom-utility a go locally for a hopefully more nuanced answer as to what exactly might be wrong with the BOM: https://github.com/CycloneDX/sbom-utility?tab=readme-ov-file#validate

[c-lud]

Thank you very much for the fast help.
And sorry for missing that.

[nscuro]

So were the errors unrelated to licenses then? Or is there still something that we need to address?

If validation is failing for unreasonable errors then that would definitely be a problem IMO.

[c-lud]

The Error is still license related. The License was named e.g. Apache License, Version 2.0 instead of Apache-2.0 in the SBOM.
So, error "schema validation failed" was given.

[nscuro]

Thanks for the context. In that case, I think the rejection is correct, since the CycloneDX schema expects valid SPDX license IDs in the id field: https://cyclonedx.org/docs/1.6/json/#components_items_licenses_oneOf_i0_items_license_id

If the generator of the BOM can't be certain that the value is a valid SPDX license ID, it ought to use the license name field instead: https://cyclonedx.org/docs/1.6/json/#components_items_licenses_oneOf_i0_items_license_name

Is this something you can raise to the project of the BOM generator you're using?

[c-lud]

Yes it is, thank you!