SonarQube’s SCA doesn’t use only the license declared in the POM. It builds a license expression from several sources (package manager metadata, the source repo, and our own research) and includes licenses for any bundled components inside the JAR, not just the “main” project license. That’s why you see BSD-3, Apache-1.1 and an xpp license in addition to Apache-2.0 for plexus-utils – SCA has identified additional code in that artifact that is under those licenses as well.
In your license profile, an AND expression means all listed licenses must be allowed for this dependency not to raise a license risk.
“RocksDB is dual-licensed under both the GPLv2 (found in the COPYING file in the root directory) and Apache 2.0 License (found in the LICENSE.Apache file in the root directory). You may select, at your option, one of the above-listed licenses.”
Lets for this example if we choose License Apache 2.0 will generated SBOM have both?
How do we tell customer through SBOM we are complying with Apache 2.0 for this dependency?
GPL Licensing references cannot be found in artifacts shipped lxml-4.9.3 python dependency
No actual artifact present, only a mention in the licenses.txt file that this dependency has some test.py file which is GPL licensed, however this file is present on repository of package but not actually shipped in the runtime installable artifact.
Hey @Anant_Kurapati, I’m going to flag this for the team, since your questions are getting more specific and you’re also bringing up a new feature. I prefer to have someone more specialized look into this.