Mesut Oezdil 0310cbed6c fix(sbom): detect sha256 hashes in expression-form licenses in needs_fix (#1911) ...

* fix(sbom): detect sha256 hashes in expression-form licenses in needs_fix

CycloneDX allows licenses as either {"license": {"id": "..."}} or
{"expression": "..."}. needs_fix only checked the license form, so
expression entries with sha256 hashes were silently skipped.

Add expression-form check to needs_fix, mirroring the fix in
extract_licenses (#1898). Add tests covering both forms.

* fix(sbom): align license checks with current test layout

Reuse needs_fix from sbom:check so expression-form hashes are detected. Fold coverage into the existing SBOM test module and task introduced on main.

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

---------

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

2026-08-11 18:45:22 +00:00

..

resolve_licenses_test.py

fix(sbom): detect sha256 hashes in expression-form licenses in needs_fix (#1911)

2026-08-11 18:45:22 +00:00

resolve_licenses.py

fix(sbom): detect sha256 hashes in expression-form licenses in needs_fix (#1911)

2026-08-11 18:45:22 +00:00

sbom_to_csv.py

fix(sbom): handle SPDX expression licenses in extract_licenses (#1898)

2026-06-22 17:36:24 -05:00