Microsoft.Owin.Host.SystemWeb license detected as LicenseRef-sonar-dotnet-library

SonarQube Cloud
1

We are seeing the Microsoft.Owin.Host.SystemWeb package detected with license type LicenseRef-sonar-dotnet-library instead of the Apache 2.0 license.

I couldn’t find any details on the license type: LicenseRef-sonar-dotnet-library.

  • What does that license mean?
  • Why would packages be detected as it?
2

Hey @mark.studer.compex,

LicenseRef-sonar-xxx means that the license couldn’t be found on the official SPDX list. I had a quick look and indeed Apache 2.0 is listed there, so I assume that the problem is that the metadata in the actual package doesn’t say Apache 2.0, but something else. What does the package’s .nuspec file say? Typically, you’d be looking for the <license> or <licenseUrl> tag.

3

Thanks for the response. It has only the licenseUrl which goes to www.microsoft.com/web/webpi/eula/aspnetcomponent_rtw_enu.htm , which now just redirects to learn.microsoft.com. What would be the recommended safe way to allow these packages where we know they have an Apache 2.0 license, but sonar can’t make that determination?

4

The usual way to allow a license would be to add it to the license profile that the project is using. So here you would have to add LicenseRef-sonar-dotnet-library.

However, let’s take a step back: if the package metadata doesn’t say Apache 2.0, then I’m not sure you can assume it’s Apache 2.0. I’ve ran a simple test: I headed over to NuGet Gallery | Microsoft.Owin.Host.SystemWeb 4.2.3 , I clicked on “download package”, I unpacked the .nupkg, and I found this in Microsoft.Owin.Host.SystemWeb.nuspec:

    <license type="expression">Apache-2.0</license>
    <licenseUrl>https://licenses.nuget.org/Apache-2.0</licenseUrl>

Are you using a different version of the package? Perhaps you are caching it in a private repo? 4.2.3 seems to be correctly showing Apache 2.0 in its metadata.

5

We are using 2.1.0 of Microsoft.Owin.Host.SystemWeb, so very old packages. It only has the licenseUrl in the nuspec. I am guessing that is the same for the other packages we get this error for. This seems like something we need to deal with on our end. Is there was a way to allow just specific packages (like just Microsoft.Owin.Host.SystemWeb and a few others) vs allowing LicenseRef-sonar-dotnet-library?

7

Hi - I’m the PM for the SCA functionality.

That license is actually correct; older versions of this package, such as the ones that you are using, are not under the Apache-2.0 license. They’re under a specific Microsoft dotnet runtime license, hence the tag.

To break it down:

  • LicenseRef (prefix for a not-in-SPDX license)
  • sonar (the org that researched and named the license - us)
  • dotnet-library (an identifier for the license)

Unfortunately, Microsoft has removed most canonical URLs for this license. You can find an archived copy of the text here: LicenseDB: ms-net-library-2019-06

You can add this to your license profile to allow it. (Practically, many of the older .NET runtime libraries are under this license.)

8

Great, thanks for the details. That is very helpfull.