SBOM Utility passing SBOM with unexpected WITH clause

[nigellh]

Our SBOM tool created an invalid license in that it was defined as an expression and not as it should have been as a name. (Currently being fixed.

We ran the SBOM Utility against it and it passed the validation, but it would not import into Dependency Track.

The issue is that what is in the expression is not a valid expression. DT correctly picked this up, but the utility passed it.

      {
        "expression": "Apache-2.0 WITH LLVM-exception"
      },

      "licenses": [
        {
          "expression": "Apache-2.0 WITH LLVM-exception"
        }
      ],

In this case, the tool should have thrown a wobbly as it is not valid.

Our work around is to change the license to Apache-2.0-with-LLVM-exception and that forces it to name.

[mrutkows]

Adding the canonical spec. ref. for SPDX license expressions: https://spdx.github.io/spdx-spec/v2.3/SPDX-license-expressions/

specifically:

license-exception-id = <short form license exception identifier in Annex A.2>

compound-expression = (simple-expression /
  simple-expression "WITH" license-exception-id /
  compound-expression "AND" compound-expression /
  compound-expression "OR" compound-expression /
  "(" compound-expression ")" )

where from Annex A.2:

Linux Syscall Note 	[Linux-syscall-note](https://spdx.org/licenses/Linux-syscall-note.html)
LLVM Exception 	[LLVM-exception](https://spdx.org/licenses/LLVM-exception.html)
LZMA exception 	[LZMA-exception](https://spdx.org/licenses/LZMA-exception.html)

@nigellh As you can see the LLVM-expection is a valid license-exception-id and the BNF does not specify valid combinations and so validation is "working as designed" against the actual specification. Of course, Apache-2.0 is a valid SPDX id unto itself.

If the desired behavior is different (and goes beyond SPDX specification) this would require new, special case (optionally applied via a flag) code which would be welcome if someone wanted to contribute ;). That is a provided list of valid (whitelisted) combinations would likely need to be provided as input and additional validation against it provided...

[mrutkows]

Changed the title to reflect the actual situation described.