Valid SBOM Failing to process after importing #5005

nigellh · 2025-05-29T12:10:27Z

nigellh
May 29, 2025

Hi. hoping someone can help

I have a 75Mbyte SBOM so probably in the region of 70k+ packages. I have validated it and DT imports it, but then gives the following error:

apiserver-1  | 2025-05-29 11:51:08,710 INFO [ProjectResource] Project Cloudability created by nhopper [principal=nhopper, requestUri=/v1/project, requestId=fe492fdc-efaa-4acb-87e5-5a39d0700375, requestMethod=PUT]
apiserver-1  | 2025-05-29 11:51:46,967 INFO [BomUploadProcessingTask] Consuming uploaded BOM [bomSerialNumber=3cf03ab4-8931-436b-8b78-cc16dd6a0e0f, bomFormat=CycloneDX, bomUploadToken=ee31e290-4b67-4191-9587-571c8b7e1ae5, projectName=Apptio Cloudability, bomSpecVersion=1.5, projectUuid=64a8792e-c52d-4554-8fee-e8e2a74a1136, projectVersion=null, bomVersion=1]
apiserver-1  | 2025-05-29 11:51:47,652 ERROR [BomUploadProcessingTask] Failed to process BOM [bomUploadToken=ee31e290-4b67-4191-9587-571c8b7e1ae5, projectName=Apptio Cloudability, projectUuid=64a8792e-c52d-4554-8fee-e8e2a74a1136, projectVersion=null]
apiserver-1  | java.util.NoSuchElementException: null
apiserver-1  |  at java.base/java.util.ArrayDeque.removeFirst(Unknown Source)
apiserver-1  |  at java.base/java.util.ArrayDeque.pop(Unknown Source)
apiserver-1  |  at org.dependencytrack.parser.spdx.expression.SpdxExpressionParser.parse(SpdxExpressionParser.java:113)
apiserver-1  |  at org.dependencytrack.parser.cyclonedx.util.ModelConverter.convertComponent(ModelConverter.java:244)
apiserver-1  |  at java.base/java.util.stream.ReferencePipeline$3$1.accept(Unknown Source)
apiserver-1  |  at java.base/java.util.ArrayList$ArrayListSpliterator.forEachRemaining(Unknown Source)
apiserver-1  |  at java.base/java.util.stream.AbstractPipeline.copyInto(Unknown Source)
apiserver-1  |  at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(Unknown Source)
apiserver-1  |  at java.base/java.util.stream.AbstractPipeline.evaluate(Unknown Source)
apiserver-1  |  at java.base/java.util.stream.AbstractPipeline.evaluateToArrayNode(Unknown Source)
apiserver-1  |  at java.base/java.util.stream.ReferencePipeline.toArray(Unknown Source)
apiserver-1  |  at java.base/java.util.stream.ReferencePipeline.toArray(Unknown Source)
apiserver-1  |  at java.base/java.util.stream.ReferencePipeline.toList(Unknown Source)
apiserver-1  |  at org.dependencytrack.parser.cyclonedx.util.ModelConverter.convertComponents(ModelConverter.java:162)
apiserver-1  |  at org.dependencytrack.tasks.BomUploadProcessingTask.processBom(BomUploadProcessingTask.java:202)
apiserver-1  |  at org.dependencytrack.tasks.BomUploadProcessingTask.processEvent(BomUploadProcessingTask.java:180)
apiserver-1  |  at org.dependencytrack.tasks.BomUploadProcessingTask.inform(BomUploadProcessingTask.java:153)
apiserver-1  |  at alpine.event.framework.BaseEventService.lambda$publish$0(BaseEventService.java:110)
apiserver-1  |  at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
apiserver-1  |  at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
apiserver-1  |  at java.base/java.lang.Thread.run(Unknown Source)

Any suggestions as to what to look at as to what might cause this.

Guessing it is around

projectVersion=null

and

java.util.NoSuchElementException: null

Just not sure what that might refer to in the SBOM.

Thanks, N

nigellh · 2025-05-30T09:26:51Z

nigellh
May 30, 2025
Author

We received a new SBOM that was half the size, but still 46k entries and still got the same error even though it passes the DT and other SBOM validations.

So I converted the SBOM into a CSV and found there were around 30,000 duplicate package entries which probably did not help.

I removed them, converted it back into an SBOM. This does import with no error this time, but no packages are showing and no errors in the logs :-(

0 replies

nigellh · 2025-05-30T09:36:58Z

nigellh
May 30, 2025
Author

Annoyingly, it is actually taking the same error, just the apiserver log is writing out the times an hour earlier than the system time.

0 replies

nscuro · 2025-05-30T10:46:46Z

nscuro
May 30, 2025
Maintainer

The logs you shared indicate that DT failed to parse an SPDX license expression. It's unfortunate we don't log the offending value, we will change that.

0 replies

nigellh · 2025-05-30T12:25:03Z

nigellh
May 30, 2025
Author

Thanks @nscuro . It would be nice to have the logs show the SBOM importing and completing.

I ended up converting the SBOM into a CSV, transformed it into a version our tooling would import, did that and generated a new SBOM that worked. So it seems what we use to generate the SBOM manages the licenses better than whatever they were using.

As always, thanks for your advice.

0 replies

nigellh · 2025-05-30T12:30:13Z

nigellh
May 30, 2025
Author

Not sure it is related, but I noted that DT did not handle all the SPDX IDs as some were added late last year and I raised it as an issue for DT to pick them up or it does not import into DT, but that is a different error as the SBOM fails to import at all

0 replies

nigellh · 2025-06-05T10:45:18Z

nigellh
Jun 5, 2025
Author

Just for information, the following are all the license expressions from the SBOM:

"expression": "LGPL-2.1-or-later AND GPL-2.0-or-later"
"expression": "MIT OR Apache-2.0"
"expression": "MIT AND CC-BY-4.0 AND ISC AND BSD-2-Clause"
"expression": "(WTFPL OR MIT)"
"expression": "GPL-3.0-or-later AND (GPL-3.0-or-later WITH Bison-exception-2.2) AND (LGPL-2.0-or-later WITH GCC-exception-2.0) AND BSD-3-Clause AND GFDL-1.3-or-later AND GPL-2.0-or-later AND LGPL-2.1-or-later AND LGPL-2.0-or-later"
"expression": "LGPL-2.1-only OR MPL-1.1"
"expression": "LGPL-2.1-or-later OR MPL-1.1"
"expression": "ISC AND (BSD-3-Clause OR MIT)"
"expression": "GPL-1.0-or-later OR Artistic-1.0-Perl"
"expression": "MIT AND BSD-2-Clause AND GPL-2.0-or-later"
"expression": "BSD-3-Clause OR GPL-2.0-or-later"
"expression": "LGPL-3.0-only AND GPL-2.0-only AND GPL-3.0-only"
"expression": "BSD-2-Clause AND FSFULLR AND GPL-2.0-or-later WITH Libtool-exception AND BSD-3-Clause AND FSFUL"
"expression": "GPL-2.0-or-later OR LGPL-3.0-or-later"
"expression": "Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0 AND Apache-2.0 WITH Swift-exception"
"expression": "(AFL-2.1 OR BSD-3-Clause)"
"expression": "(Apache-2.0 OR MIT) AND (Artistic-2.0 AND BSD-3-Clause AND ISC AND MIT AND MPL-2.0 AND Unicode-3.0)"
"expression": "HPND AND HPND-sell-variant AND X11 AND X11-distribute-modifications-variant AND MIT AND MIT-open-group AND xkeyboard-config-Zinoviev"
"expression": "MIT AND X11 AND MIT-CMU"
"expression": "LGPL-3.0-or-later OR GPL-2.0-or-later"
"expression": "(FTL OR GPL-2.0-or-later) AND BSD-3-Clause AND MIT AND MIT-Modern-Variant AND LicenseRef-Fedora-Public-Domain AND Zlib"
"expression": "Apache-2.0 OR MIT"
"expression": "GPL-2.0-or-later AND LGPL-2.1-or-later"
"expression": "GPL-2.0-or-later AND LGPL-2.0-or-later"
"expression": "BSD-3-Clause OR GPL-2.0-only"
"expression": "Apache-2.0 AND BSD-2-Clause"
"expression": "Artistic-1.0-Perl OR GPL-1.0-or-later"
"expression": "GPL-2.0-or-later AND LGPL-2.0-or-later AND LGPL-2.1-or-later AND BSD-2-Clause"
"expression": "MIT-open-group AND X11 AND HPND AND HPND-sell-variant AND SMLNJ AND MIT AND ISC AND HPND-doc AND HPND-doc-sell"
"expression": "BSD-2-Clause AND MIT AND X11"
"expression": "(GPL-1.0-or-later OR Artistic-1.0-Perl) AND MPL-2.0"
"expression": "Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"
"expression": "FTL OR GPL-2.0-or-later"
"expression": "MPL-2.0 AND MIT"
"expression": "BSD-2-Clause AND BSD-3-Clause"
"expression": "BSD-3-Clause AND IJG AND Zlib"
"expression": "(Apache-2.0 OR BSD-3-Clause)"
"expression": "(MIT OR CC0-1.0)"
"expression": "GPL-2.0-or-later AND LGPL-2.1-or-later AND BSD-3-Clause"
"expression": "MIT AND Python-2.0"
"expression": "GPL-2.0-or-later AND LGPL-2.1-or-later AND GPL-2.0-only"
"expression": "GPL-2.0-or-later AND LGPL-2.0-or-later AND BSD-3-Clause AND MIT"
"expression": "MIT AND X11"
"expression": "Apache-2.0 OR BSD-3-Clause"
"expression": "GPL-3.0-or-later AND LGPL-2.1-or-later AND MIT"
"expression": "GPL-2.0-or-later AND LGPL-3.0-or-later"
"expression": "GPL-3.0-or-later AND LGPL-2.0-or-later AND (GPL-2.0-or-later WITH GCC-exception-2.0) AND (LGPL-2.0-or-later WITH GCC-exception-2.0) AND GFDL-1.3-or-later"
"expression": "BSD-3-Clause AND GPL-2.0-only AND GPL-2.0-or-later AND LGPL-2.1-or-later AND MIT"
"expression": "LGPL-2.1-or-later AND BSD-3-Clause AND BSD-2-Clause AND BSD-2-Clause-FreeBSD AND 0BSD AND CC0-1.0 AND LicenseRef-Fedora-Public-Domain"
"expression": "LGPL-2.1-or-later AND GPL-2.0-or-later"
"expression": "LGPL-2.1-or-later AND GPL-2.0-or-later"
"expression": "GPL-2.0-or-later AND LGPL-2.1-or-later AND BSD-3-Clause"
"expression": "GPL-2.0-or-later AND LGPL-2.1-or-later AND BSD-3-Clause"
"expression": "GPL-2.0-or-later AND LGPL-2.1-or-later AND BSD-3-Clause"
"expression": "MPL-2.0 AND MIT"
"expression": "MPL-2.0 AND MIT"
"expression": "MPL-2.0 AND MIT"
"expression": "MPL-2.0 AND MIT"
"expression": "LGPL-2.1-or-later OR MPL-1.1"
"expression": "GPL-2.0-or-later AND LGPL-2.0-or-later AND BSD-3-Clause AND MIT"
"expression": "GPL-2.0-or-later AND LGPL-2.0-or-later AND BSD-3-Clause AND MIT"
"expression": "GPL-2.0-or-later AND LGPL-2.0-or-later AND BSD-3-Clause AND MIT"
"expression": "FTL OR GPL-2.0-or-later"
"expression": "GPL-2.0-or-later AND LGPL-2.1-or-later"
"expression": "GPL-2.0-or-later AND LGPL-2.1-or-later"
"expression": "GPL-2.0-or-later AND LGPL-2.1-or-later"
"expression": "GPL-2.0-or-later AND LGPL-2.1-or-later"
"expression": "GPL-3.0-or-later AND LGPL-2.1-or-later AND MIT"
"expression": "LGPL-3.0-or-later OR GPL-2.0-or-later"
"expression": "LGPL-3.0-or-later OR GPL-2.0-or-later"
"expression": "LGPL-3.0-or-later OR GPL-2.0-or-later"
"expression": "LGPL-2.1-or-later OR MPL-1.1"
"expression": "GPL-2.0-or-later AND LGPL-2.0-or-later"
"expression": "GPL-2.0-or-later AND LGPL-2.0-or-later"
"expression": "BSD-2-Clause AND BSD-3-Clause"
"expression": "BSD-3-Clause OR GPL-2.0-only"
"expression": "LGPL-2.1-or-later AND GPL-2.0-or-later"
"expression": "GPL-2.0-or-later AND LGPL-2.1-or-later"
"expression": "GPL-2.0-or-later AND LGPL-3.0-or-later"
"expression": "GPL-2.0-or-later OR LGPL-3.0-or-later"
"expression": "GPL-2.0-or-later OR LGPL-3.0-or-later"
"expression": "BSD-3-Clause AND IJG AND Zlib"
"expression": "LGPL-3.0-only AND GPL-2.0-only AND GPL-3.0-only"
"expression": "ISC AND (BSD-3-Clause OR MIT)"
"expression": "GPL-2.0-or-later OR LGPL-3.0-or-later"
"expression": "GPL-2.0-or-later OR LGPL-3.0-or-later"
"expression": "GPL-2.0-or-later OR LGPL-3.0-or-later"
"expression": "MIT AND X11"
"expression": "MIT AND BSD-2-Clause AND GPL-2.0-or-later"
"expression": "GPL-2.0-or-later OR LGPL-3.0-or-later"
"expression": "GPL-1.0-or-later OR Artistic-1.0-Perl"
"expression": "Artistic-1.0-Perl OR GPL-1.0-or-later"
"expression": "Artistic-1.0-Perl OR GPL-1.0-or-later"
"expression": "Apache-2.0 AND BSD-2-Clause"
"expression": "Apache-2.0 AND BSD-2-Clause"
"expression": "BSD-2-Clause AND MIT AND X11"
"expression": "BSD-3-Clause OR GPL-2.0-or-later"
"expression": "BSD-3-Clause OR GPL-2.0-or-later"
"expression": "BSD-3-Clause OR GPL-2.0-or-later"
"expression": "LGPL-2.1-or-later AND GPL-2.0-or-later"
"expression": "GPL-3.0-or-later AND LGPL-2.0-or-later AND (GPL-2.0-or-later WITH GCC-exception-2.0) AND (LGPL-2.0-or-later WITH GCC-exception-2.0) AND GFDL-1.3-or-later"
"expression": "GPL-3.0-or-later AND LGPL-2.0-or-later AND (GPL-2.0-or-later WITH GCC-exception-2.0) AND (LGPL-2.0-or-later WITH GCC-exception-2.0) AND GFDL-1.3-or-later"
"expression": "BSD-2-Clause AND BSD-3-Clause"
"expression": "MPL-2.0 AND MIT"
"expression": "MPL-2.0 AND MIT"
"expression": "MPL-2.0 AND MIT"
"expression": "MPL-2.0 AND MIT"
"expression": "LGPL-2.1-or-later OR MPL-1.1"
"expression": "LGPL-2.1-or-later OR MPL-1.1"
"expression": "LGPL-2.1-or-later OR MPL-1.1"
"expression": "FTL OR GPL-2.0-or-later"
"expression": "(FTL OR GPL-2.0-or-later) AND BSD-3-Clause AND MIT AND MIT-Modern-Variant AND LicenseRef-Fedora-Public-Domain AND Zlib"
"expression": "GPL-2.0-or-later AND LGPL-2.1-or-later"
"expression": "GPL-2.0-or-later AND LGPL-2.1-or-later"
"expression": "GPL-2.0-or-later AND LGPL-2.1-or-later"
"expression": "GPL-3.0-or-later AND LGPL-2.1-or-later AND MIT"
"expression": "GPL-3.0-or-later AND LGPL-2.1-or-later AND MIT"
"expression": "GPL-3.0-or-later AND LGPL-2.1-or-later AND MIT"
"expression": "GPL-3.0-or-later AND LGPL-2.1-or-later AND MIT"
"expression": "GPL-2.0-or-later AND LGPL-2.1-or-later"
"expression": "GPL-2.0-or-later AND LGPL-2.1-or-later"
"expression": "BSD-3-Clause AND GPL-2.0-only AND GPL-2.0-or-later AND LGPL-2.1-or-later AND MIT"
"expression": "BSD-3-Clause AND GPL-2.0-only AND GPL-2.0-or-later AND LGPL-2.1-or-later AND MIT"
"expression": "BSD-3-Clause AND GPL-2.0-only AND GPL-2.0-or-later AND LGPL-2.1-or-later AND MIT"
"expression": "BSD-3-Clause AND GPL-2.0-only AND GPL-2.0-or-later AND LGPL-2.1-or-later AND MIT"
"expression": "BSD-3-Clause AND GPL-2.0-only AND GPL-2.0-or-later AND LGPL-2.1-or-later AND MIT"
"expression": "BSD-3-Clause AND GPL-2.0-only AND GPL-2.0-or-later AND LGPL-2.1-or-later AND MIT"
"expression": "LGPL-3.0-or-later OR GPL-2.0-or-later"
"expression": "LGPL-2.1-or-later OR MPL-1.1"
"expression": "GPL-2.0-or-later AND LGPL-2.0-or-later"
"expression": "GPL-2.0-or-later AND LGPL-2.0-or-later"
"expression": "LGPL-2.1-or-later AND GPL-2.0-or-later"
"expression": "GPL-2.0-or-later AND LGPL-2.1-or-later"
"expression": "GPL-2.0-or-later AND LGPL-2.1-or-later"
"expression": "GPL-2.0-or-later AND LGPL-2.1-or-later"
"expression": "BSD-3-Clause OR GPL-2.0-only"
"expression": "BSD-3-Clause OR GPL-2.0-only"
"expression": "GPL-2.0-or-later AND LGPL-2.0-or-later AND BSD-3-Clause AND MIT"
"expression": "GPL-2.0-or-later AND LGPL-2.0-or-later AND BSD-3-Clause AND MIT"
"expression": "GPL-2.0-or-later AND LGPL-2.0-or-later AND BSD-3-Clause AND MIT"
"expression": "GPL-2.0-or-later AND LGPL-2.1-or-later"
"expression": "GPL-2.0-or-later AND LGPL-2.1-or-later"
"expression": "GPL-2.0-or-later AND LGPL-2.1-or-later"
"expression": "GPL-2.0-or-later AND LGPL-2.1-or-later"
"expression": "GPL-2.0-or-later AND LGPL-2.1-or-later"
"expression": "GPL-2.0-or-later AND LGPL-2.1-or-later"
"expression": "LGPL-3.0-or-later OR GPL-2.0-or-later"
"expression": "GPL-2.0-or-later AND LGPL-2.1-or-later"
"expression": "GPL-2.0-or-later AND LGPL-2.1-or-later"
"expression": "GPL-2.0-or-later AND LGPL-2.1-or-later"
"expression": "GPL-3.0-or-later AND LGPL-2.1-or-later AND MIT"
"expression": "BSD-3-Clause AND IJG AND Zlib"
"expression": "GPL-2.0-or-later AND LGPL-2.1-or-later"
"expression": "GPL-2.0-or-later AND LGPL-2.1-or-later"
"expression": "GPL-2.0-or-later AND LGPL-2.1-or-later"
"expression": "GPL-2.0-or-later AND LGPL-2.1-or-later"
"expression": "GPL-2.0-or-later AND LGPL-2.1-or-later"
"expression": "GPL-2.0-or-later AND LGPL-2.1-or-later"
"expression": "GPL-2.0-or-later AND LGPL-2.1-or-later"
"expression": "GPL-2.0-or-later AND LGPL-2.1-or-later"
"expression": "GPL-2.0-or-later AND LGPL-2.1-or-later"
"expression": "BSD-3-Clause AND IJG AND Zlib"
"expression": "MIT AND X11"
"expression": "LGPL-2.1-or-later AND BSD-3-Clause AND BSD-2-Clause AND BSD-2-Clause-FreeBSD AND 0BSD AND CC0-1.0 AND LicenseRef-Fedora-Public-Domain"
"expression": "LGPL-2.1-or-later AND BSD-3-Clause AND BSD-2-Clause AND BSD-2-Clause-FreeBSD AND 0BSD AND CC0-1.0 AND LicenseRef-Fedora-Public-Domain"
"expression": "MIT AND BSD-2-Clause AND GPL-2.0-or-later"
"expression": "BSD-3-Clause AND GPL-2.0-only AND GPL-2.0-or-later AND LGPL-2.1-or-later AND MIT"
"expression": "BSD-3-Clause AND GPL-2.0-only AND GPL-2.0-or-later AND LGPL-2.1-or-later AND MIT"
"expression": "BSD-3-Clause AND GPL-2.0-only AND GPL-2.0-or-later AND LGPL-2.1-or-later AND MIT"
"expression": "Apache-2.0 AND BSD-2-Clause"
"expression": "Apache-2.0 AND BSD-2-Clause"
"expression": "(Apache-2.0 OR MIT) AND (Artistic-2.0 AND BSD-3-Clause AND ISC AND MIT AND MPL-2.0 AND Unicode-3.0)"
"expression": "Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"
"expression": "Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"
"expression": "Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"
"expression": "Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0 AND Apache-2.0 WITH Swift-exception"
"expression": "Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"
"expression": "Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"
"expression": "Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"
"expression": "BSD-3-Clause OR GPL-2.0-or-later"
"expression": "BSD-3-Clause OR GPL-2.0-or-later"
"expression": "BSD-3-Clause OR GPL-2.0-or-later"
"expression": "BSD-3-Clause OR GPL-2.0-or-later"
"expression": "(Apache-2.0 OR BSD-3-Clause)"
"expression": "(Apache-2.0 OR BSD-3-Clause)"
"expression": "(AFL-2.1 OR BSD-3-Clause)"
"expression": "(WTFPL OR MIT)"
"expression": "(MIT OR CC0-1.0)"
"expression": "(MIT OR CC0-1.0)"
"expression": "(MIT OR CC0-1.0)"
"expression": "Apache-2.0 OR BSD-3-Clause"
"expression": "Apache-2.0 OR BSD-3-Clause"
"expression": "Apache-2.0 OR BSD-3-Clause"
"expression": "Apache-2.0 OR BSD-3-Clause"
"expression": "MIT AND Python-2.0"
"expression": "Apache-2.0 OR MIT"
"expression": "Apache-2.0 OR MIT"
"expression": "Apache-2.0 OR MIT"
"expression": "Apache-2.0 OR MIT"
"expression": "Apache-2.0 OR MIT"
"expression": "Apache-2.0 OR MIT"
"expression": "Apache-2.0 OR MIT"
"expression": "MIT OR Apache-2.0"
"expression": "MPL-2.0 AND MIT"
"expression": "MIT OR Apache-2.0"
"expression": "MIT OR Apache-2.0"
"expression": "MIT OR Apache-2.0"
"expression": "GPL-3.0-or-later AND LGPL-2.0-or-later AND (GPL-2.0-or-later WITH GCC-exception-2.0) AND (LGPL-2.0-or-later WITH GCC-exception-2.0) AND GFDL-1.3-or-later"
"expression": "GPL-3.0-or-later AND (GPL-3.0-or-later WITH Bison-exception-2.2) AND (LGPL-2.0-or-later WITH GCC-exception-2.0) AND BSD-3-Clause AND GFDL-1.3-or-later AND GPL-2.0-or-later AND LGPL-2.1-or-later AND LGPL-2.0-or-later"
"expression": "LGPL-2.1-only OR MPL-1.1"
"expression": "GPL-2.0-or-later AND LGPL-2.1-or-later AND GPL-2.0-only"
"expression": "(FTL OR GPL-2.0-or-later) AND BSD-3-Clause AND MIT AND MIT-Modern-Variant AND LicenseRef-Fedora-Public-Domain AND Zlib"
"expression": "BSD-3-Clause AND GPL-2.0-only AND GPL-2.0-or-later AND LGPL-2.1-or-later AND MIT"
"expression": "BSD-3-Clause AND GPL-2.0-only AND GPL-2.0-or-later AND LGPL-2.1-or-later AND MIT"
"expression": "BSD-3-Clause AND GPL-2.0-only AND GPL-2.0-or-later AND LGPL-2.1-or-later AND MIT"
"expression": "GPL-2.0-or-later AND LGPL-2.0-or-later AND LGPL-2.1-or-later AND BSD-2-Clause"
"expression": "BSD-2-Clause AND FSFULLR AND GPL-2.0-or-later WITH Libtool-exception AND BSD-3-Clause AND FSFUL"
"expression": "BSD-3-Clause OR GPL-2.0-only"
"expression": "BSD-3-Clause OR GPL-2.0-only"
"expression": "MIT AND CC-BY-4.0 AND ISC AND BSD-2-Clause"
"expression": "MIT AND X11"
"expression": "LGPL-2.1-or-later AND BSD-3-Clause AND BSD-2-Clause AND BSD-2-Clause-FreeBSD AND 0BSD AND CC0-1.0 AND LicenseRef-Fedora-Public-Domain"
"expression": "MIT-open-group AND X11 AND HPND AND HPND-sell-variant AND SMLNJ AND MIT AND ISC AND HPND-doc AND HPND-doc-sell"
"expression": "MIT AND X11 AND MIT-CMU"
"expression": "(GPL-1.0-or-later OR Artistic-1.0-Perl) AND MPL-2.0"
"expression": "(Apache-2.0 OR MIT) AND (Artistic-2.0 AND BSD-3-Clause AND ISC AND MIT AND MPL-2.0 AND Unicode-3.0)"
"expression": "Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"
"expression": "Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"
"expression": "Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0"
"expression": "Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0 AND Apache-2.0 WITH Swift-exception"
"expression": "HPND AND HPND-sell-variant AND X11 AND X11-distribute-modifications-variant AND MIT AND MIT-open-group AND xkeyboard-config-Zinoviev"

As an example of one with one with a long expression, possibly the longest expression is:

    {
      "type": "library",
      "bom-ref": "pkg:generic/vim-filesystem@9.1.1202-1.amzn2023.0.1",
      "supplier": {
        "name": "Unknown"
      },
      "name": "vim-filesystem",
      "version": "9.1.1202-1.amzn2023.0.1",
      "licenses": [
        {
          "expression": "Vim AND LGPL-2.1-or-later AND MIT AND GPL-1.0-only AND (GPL-2.0-only OR Vim) AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-or-later AND GPL-3.0-or-later AND OPUBL-1.0 AND Apache-2.0 WITH Swift-exception"
        }
      ],
      "copyright": "",
      "purl": "pkg:generic/vim-filesystem@9.1.1202-1.amzn2023.0.1",
      "properties": [
        {
          "name": "Relationship Completeness",
          "value": "Unknown"
        }
      ]
    },

I hope it is useful in identifying the issue.

0 replies

nigellh · 2025-06-05T10:54:16Z

nigellh
Jun 5, 2025
Author

Raised as an issue #5025

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Valid SBOM Failing to process after importing #5005

Uh oh!

{{title}}

Uh oh!

Replies: 7 comments

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Uh oh!

Valid SBOM Failing to process after importing #5005

Uh oh!

nigellh May 29, 2025

Replies: 7 comments

Uh oh!

nigellh May 30, 2025 Author

Uh oh!

nigellh May 30, 2025 Author

Uh oh!

nscuro May 30, 2025 Maintainer

Uh oh!

nigellh May 30, 2025 Author

Uh oh!

nigellh May 30, 2025 Author

Uh oh!

nigellh Jun 5, 2025 Author

Uh oh!

nigellh Jun 5, 2025 Author

nigellh
May 29, 2025

nigellh
May 30, 2025
Author

nigellh
May 30, 2025
Author

nscuro
May 30, 2025
Maintainer

nigellh
May 30, 2025
Author

nigellh
May 30, 2025
Author

nigellh
Jun 5, 2025
Author

nigellh
Jun 5, 2025
Author