fix empty licenses in SPDX conversion

andreas-hilti · andreas-hilti · commit fe7d6959ac5f · 2025-09-27T13:58:29.000+02:00
Signed-off-by: andreas hilti &lt;69210561+andreas-hilti@users.noreply.github.com&gt;
diff --git a/src/CycloneDX.Spdx.Interop/Converters/v2_3/Helpers/CycloneDXBomHelpers.cs b/src/CycloneDX.Spdx.Interop/Converters/v2_3/Helpers/CycloneDXBomHelpers.cs
@@ -147,7 +147,7 @@ public static void AddSpdxPackages(this Bom bom, SpdxDocument doc)
                 {
                     component.Licenses = new List<LicenseChoice>();
                 }
-                else
+                else if (package.LicenseDeclared != null)
                 {
                     component.Licenses = new List<LicenseChoice> { new LicenseChoice { Expression = package.LicenseDeclared } };
                 }
diff --git a/tests/CycloneDX.Spdx.Interop.Tests/__snapshots__/ConverterTests.FromCDXToSpdxToCDXRoundTripTest_assembly.snap b/tests/CycloneDX.Spdx.Interop.Tests/__snapshots__/ConverterTests.FromCDXToSpdxToCDXRoundTripTest_assembly.snap
@@ -31,9 +31,6 @@
       "type": "library",
       "name": "acme-library-a",
       "version": "1.0.0",
-      "licenses": [
-        {}
-      ],
       "externalReferences": [
         {
           "url": "NOASSERTION",
diff --git a/tests/CycloneDX.Spdx.Interop.Tests/__snapshots__/ConverterTests.FromCDXToSpdxToCDXRoundTripTest_bom.snap b/tests/CycloneDX.Spdx.Interop.Tests/__snapshots__/ConverterTests.FromCDXToSpdxToCDXRoundTripTest_bom.snap
@@ -96,9 +96,6 @@
       "author": "Example Super Heros",
       "name": "mylibrary",
       "version": "1.0.0",
-      "licenses": [
-        {}
-      ],
       "externalReferences": [
         {
           "url": "NOASSERTION",
diff --git a/tests/CycloneDX.Spdx.Interop.Tests/__snapshots__/ConverterTests.FromCDXToSpdxToCDXRoundTripTest_component-hashes.snap b/tests/CycloneDX.Spdx.Interop.Tests/__snapshots__/ConverterTests.FromCDXToSpdxToCDXRoundTripTest_component-hashes.snap
@@ -81,9 +81,6 @@
           "content": "26cdc7fb3fd65fc3b621a4ef70bc7d2489d5c19e70c76cf7ec20e538df0047cf"
         }
       ],
-      "licenses": [
-        {}
-      ],
       "externalReferences": [
         {
           "url": "NOASSERTION",
diff --git a/tests/CycloneDX.Spdx.Interop.Tests/__snapshots__/ConverterTests.FromCDXToSpdxToCDXRoundTripTest_component-ref.snap b/tests/CycloneDX.Spdx.Interop.Tests/__snapshots__/ConverterTests.FromCDXToSpdxToCDXRoundTripTest_component-ref.snap
@@ -31,9 +31,6 @@
       "type": "library",
       "name": "acme-library",
       "version": "1.0.0",
-      "licenses": [
-        {}
-      ],
       "externalReferences": [
         {
           "url": "NOASSERTION",
@@ -55,9 +52,6 @@
       "type": "library",
       "name": "acme-library",
       "version": "1.0.0",
-      "licenses": [
-        {}
-      ],
       "externalReferences": [
         {
           "url": "NOASSERTION",
diff --git a/tests/CycloneDX.Spdx.Interop.Tests/__snapshots__/ConverterTests.FromCDXToSpdxToCDXRoundTripTest_component-swid-full.snap b/tests/CycloneDX.Spdx.Interop.Tests/__snapshots__/ConverterTests.FromCDXToSpdxToCDXRoundTripTest_component-swid-full.snap
@@ -32,9 +32,6 @@
       "author": "Acme Super Heros",
       "name": "Acme Application",
       "version": "9.1.1",
-      "licenses": [
-        {}
-      ],
       "externalReferences": [
         {
           "url": "NOASSERTION",
diff --git a/tests/CycloneDX.Spdx.Interop.Tests/__snapshots__/ConverterTests.FromCDXToSpdxToCDXRoundTripTest_component-swid.snap b/tests/CycloneDX.Spdx.Interop.Tests/__snapshots__/ConverterTests.FromCDXToSpdxToCDXRoundTripTest_component-swid.snap
@@ -32,9 +32,6 @@
       "author": "Acme Super Heros",
       "name": "Acme Application",
       "version": "9.1.1",
-      "licenses": [
-        {}
-      ],
       "externalReferences": [
         {
           "url": "NOASSERTION",
diff --git a/tests/CycloneDX.Spdx.Interop.Tests/__snapshots__/ConverterTests.FromCDXToSpdxToCDXRoundTripTest_component-types.snap b/tests/CycloneDX.Spdx.Interop.Tests/__snapshots__/ConverterTests.FromCDXToSpdxToCDXRoundTripTest_component-types.snap
@@ -31,9 +31,6 @@
       "type": "application",
       "name": "application-a",
       "version": "1.0",
-      "licenses": [
-        {}
-      ],
       "externalReferences": [
         {
           "url": "NOASSERTION",
@@ -55,9 +52,6 @@
       "type": "library",
       "name": "library-a",
       "version": "1.0",
-      "licenses": [
-        {}
-      ],
       "externalReferences": [
         {
           "url": "NOASSERTION",
@@ -79,9 +73,6 @@
       "type": "framework",
       "name": "framework-a",
       "version": "1.0",
-      "licenses": [
-        {}
-      ],
       "externalReferences": [
         {
           "url": "NOASSERTION",
@@ -103,9 +94,6 @@
       "type": "container",
       "name": "container-a",
       "version": "1.0",
-      "licenses": [
-        {}
-      ],
       "externalReferences": [
         {
           "url": "NOASSERTION",
@@ -127,9 +115,6 @@
       "type": "operating-system",
       "name": "operating-system-a",
       "version": "1.0",
-      "licenses": [
-        {}
-      ],
       "externalReferences": [
         {
           "url": "NOASSERTION",
@@ -151,9 +136,6 @@
       "type": "firmware",
       "name": "firmware-a",
       "version": "1.0",
-      "licenses": [
-        {}
-      ],
       "externalReferences": [
         {
           "url": "NOASSERTION",
diff --git a/tests/CycloneDX.Spdx.Interop.Tests/__snapshots__/ConverterTests.FromCDXToSpdxToCDXRoundTripTest_compositions.snap b/tests/CycloneDX.Spdx.Interop.Tests/__snapshots__/ConverterTests.FromCDXToSpdxToCDXRoundTripTest_compositions.snap
@@ -31,9 +31,6 @@
       "type": "library",
       "name": "Partner Shaded Library",
       "version": "1.0",
-      "licenses": [
-        {}
-      ],
       "externalReferences": [
         {
           "url": "NOASSERTION",
@@ -55,9 +52,6 @@
       "type": "library",
       "name": "Acme Library",
       "version": "3.0",
-      "licenses": [
-        {}
-      ],
       "externalReferences": [
         {
           "url": "NOASSERTION",
diff --git a/tests/CycloneDX.Spdx.Interop.Tests/__snapshots__/ConverterTests.FromCDXToSpdxToCDXRoundTripTest_dependency.snap b/tests/CycloneDX.Spdx.Interop.Tests/__snapshots__/ConverterTests.FromCDXToSpdxToCDXRoundTripTest_dependency.snap
@@ -31,9 +31,6 @@
       "type": "library",
       "name": "library-a",
       "version": "1.0.0",
-      "licenses": [
-        {}
-      ],
       "externalReferences": [
         {
           "url": "NOASSERTION",
@@ -55,9 +52,6 @@
       "type": "library",
       "name": "library-b",
       "version": "1.0.0",
-      "licenses": [
-        {}
-      ],
       "externalReferences": [
         {
           "url": "NOASSERTION",
@@ -79,9 +73,6 @@
       "type": "library",
       "name": "library-c",
       "version": "1.0.0",
-      "licenses": [
-        {}
-      ],
       "externalReferences": [
         {
           "url": "NOASSERTION",
diff --git a/tests/CycloneDX.Spdx.Interop.Tests/__snapshots__/ConverterTests.FromCDXToSpdxToCDXRoundTripTest_external-reference.snap b/tests/CycloneDX.Spdx.Interop.Tests/__snapshots__/ConverterTests.FromCDXToSpdxToCDXRoundTripTest_external-reference.snap
@@ -31,9 +31,6 @@
       "type": "library",
       "name": "mylibrary",
       "version": "1.0.0",
-      "licenses": [
-        {}
-      ],
       "externalReferences": [
         {
           "url": "NOASSERTION",
diff --git a/tests/CycloneDX.Spdx.Interop.Tests/__snapshots__/ConverterTests.FromCDXToSpdxToCDXRoundTripTest_license-name.snap b/tests/CycloneDX.Spdx.Interop.Tests/__snapshots__/ConverterTests.FromCDXToSpdxToCDXRoundTripTest_license-name.snap
@@ -31,9 +31,6 @@
       "type": "library",
       "name": "tomcat-catalina",
       "version": "9.0.14",
-      "licenses": [
-        {}
-      ],
       "externalReferences": [
         {
           "url": "NOASSERTION",
diff --git a/tests/CycloneDX.Spdx.Interop.Tests/__snapshots__/ConverterTests.FromCDXToSpdxToCDXRoundTripTest_minimal-viable.snap b/tests/CycloneDX.Spdx.Interop.Tests/__snapshots__/ConverterTests.FromCDXToSpdxToCDXRoundTripTest_minimal-viable.snap
@@ -31,9 +31,6 @@
       "type": "library",
       "name": "acme-library",
       "version": "1.0.0",
-      "licenses": [
-        {}
-      ],
       "externalReferences": [
         {
           "url": "NOASSERTION",
diff --git a/tests/CycloneDX.Spdx.Interop.Tests/__snapshots__/ConverterTests.FromCDXToSpdxToCDXRoundTripTest_patch.snap b/tests/CycloneDX.Spdx.Interop.Tests/__snapshots__/ConverterTests.FromCDXToSpdxToCDXRoundTripTest_patch.snap
@@ -31,9 +31,6 @@
       "type": "library",
       "name": "sample-library",
       "version": "1.0.0",
-      "licenses": [
-        {}
-      ],
       "externalReferences": [
         {
           "url": "NOASSERTION",
diff --git a/tests/CycloneDX.Spdx.Interop.Tests/__snapshots__/ConverterTests.FromCDXToSpdxToCDXRoundTripTest_properties.snap b/tests/CycloneDX.Spdx.Interop.Tests/__snapshots__/ConverterTests.FromCDXToSpdxToCDXRoundTripTest_properties.snap
@@ -31,9 +31,6 @@
       "type": "library",
       "name": "acme-library",
       "version": "1.0.0",
-      "licenses": [
-        {}
-      ],
       "externalReferences": [
         {
           "url": "NOASSERTION",

Original file line number	Diff line number	Diff line change
`@@ -147,7 +147,7 @@ public static void AddSpdxPackages(this Bom bom, SpdxDocument doc)`
`147`	`147`	`{`
`148`	`148`	`component.Licenses = new List<LicenseChoice>();`
`149`	`149`	`}`
`150`		`- else`
	`150`	`+ else if (package.LicenseDeclared != null)`
`151`	`151`	`{`
`152`	`152`	`component.Licenses = new List<LicenseChoice> { new LicenseChoice { Expression = package.LicenseDeclared } };`
`153`	`153`	`}`
Original file line number	Diff line number	Diff line change
`@@ -81,9 +81,6 @@`
`81`	`81`	`"content": "26cdc7fb3fd65fc3b621a4ef70bc7d2489d5c19e70c76cf7ec20e538df0047cf"`
`82`	`82`	`}`
`83`	`83`	`],`
`84`		`- "licenses": [`
`85`		`- {}`
`86`		`- ],`
`87`	`84`	`"externalReferences": [`
`88`	`85`	`{`
`89`	`86`	`"url": "NOASSERTION",`