fix: fix SBOM license parsing

ChangeLog.md

@@ -10,6 +10,7 @@
 * fix: urls coming from granularity file are repository urls and not source code
   download urls.
 * fix wrong variable to correct `bom findsources`.
+* fix loading of SBOMs that support different kinds of licenses.
 
 ## 2.5.0 (2024-07-19)
 

capycli/common/capycli_bom_support.py

@@ -1,5 +1,5 @@
 # -------------------------------------------------------------------------------
-# Copyright (c) 2023 Siemens
+# Copyright (c) 2023-2024 Siemens
 # All Rights Reserved.
 # Author: thomas.graf@siemens.com
 #
@@ -160,7 +160,23 @@ def read_license(self, param: Dict[str, Any]) -> Optional[License]:
             return None
 
         text = param.get("text", None)
-        license_text = AttachedText(content=text) if text else None
+        if text:
+            if isinstance(text, dict):
+                content_type = text.get("contentType", "text/plain")
+                encoding = text.get("encoding", "base64")
+                content = text.get("content", "")
+                license_text = AttachedText(content_type=content_type,
+                                            encoding=encoding,
+                                            content=content)
+            else:
+                # This is some text - not CycloneDX spec >= 1.2 compliant
+                license_text = AttachedText(content=text)
+        else:
+            license_text = None
+
+        # NOTE: CycloneDX spec 1.4:
+        # "If SPDX does not define the license used, this field may be used to provide the license name"
+        # The CycloneDX python lib just ignores the name if id (=SPDX) has been specified!
         return License(
             spdx_license_id=param.get("id", None),
             license_name=param.get("name", None),

tests/test_bom_filter.py

@@ -9,12 +9,13 @@
 import os
 from typing import Any, Dict, List
 
+from cyclonedx.model import XsUri
+
 import capycli.bom.filter_bom
 import capycli.common.json_support
 import capycli.common.script_base
 from capycli.common.capycli_bom_support import CaPyCliBom, CycloneDxSupport
 from capycli.main.result_codes import ResultCode
-from cyclonedx.model import XsUri
 from tests.test_base import AppArguments, TestBase