search

DependencyTrack / dependency-track

Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.
https://dependencytrack.org/
Apache License 2.0
2.58k stars 541 forks source link

Policy violation: Library fails incorrectly on audit #1984

Open AfshinOnline opened 1 year ago

AfshinOnline commented 1 year ago

Incorrect Policy violation: On Audit libraries that do not have a permissive license are supposed to fail. This includes libraries that do not have MIT and Apache etc licenses. However many libraries WITH permissive licenses fail and show up in the audit as a policy. violation.

Setting the correct license under view details: component details: legal: license also fails to update and throws an error intermittently.

Current Behavior:

Incorrect Policy violation for libraries.

Steps to Reproduce:

Create a policy to fail based on license type eg Permissive license group:

image

Dozens of Libraries that should pass the audit because they are permissive fail:

One example:

image

image

Expected Behavior:

The library does not appear as a policy violation

Environment:

Additional Details:

Occurs with different CycloneDX libraries in different languages.

nscuro commented 1 year ago

Can you please provide more details about the components? Sharing the entire BOM that you imported into DT would be even more helpful.

What license is reported by GitHub is irrelevant for DT, it only ingests what you provide to it in your BOM. If it's a .NET project, perhaps you used cyclonedx-dotnet? If the license is incorrectly detected, you may want to raise an issue in that tool's repo: https://github.com/CycloneDX/cyclonedx-dotnet