What would you like to be added:
I would like to have the ability to tell Grant to ignore licenseConcluded and only process licenseDeclared entries for a given package.
Why is this needed:
Per the description of licenseConcluded (https://spdx.org/rdf/spdx-terms-v2.0/objectproperties/licenseConcluded___-571936219.html), the value specified is based on what the SPDX generator thinks is the appropriate license...essentially a best guess. When generating a Grant license list for the tomcat:9.0.98-jdk17 container on DockerHub, I found that the license listed for the fontconfig package didn't match the contents of the fontconfig COPYING file, nor any other file listed under the SBOM sourceInfo section. In the Syft SBOM, the licenseDeclared section was listed as NOASSERTION but licenseConcluded listed fontconfig as under the HPND-sell-variant license. The text of this license (https://spdx.org/licenses/HPND-sell-variant.html) does not match what's in the COPYING file. Being able to ignore best guesses would help when trying to get team members and legal departments to trust the output of licenses, especially if licenses are used in software approval processes.
Additional context:
None
What would you like to be added:
I would like to have the ability to tell Grant to ignore licenseConcluded and only process licenseDeclared entries for a given package.
Why is this needed:
Per the description of licenseConcluded (https://spdx.org/rdf/spdx-terms-v2.0/objectproperties/licenseConcluded___-571936219.html), the value specified is based on what the SPDX generator thinks is the appropriate license...essentially a best guess. When generating a Grant license list for the tomcat:9.0.98-jdk17 container on DockerHub, I found that the license listed for the fontconfig package didn't match the contents of the fontconfig COPYING file, nor any other file listed under the SBOM sourceInfo section. In the Syft SBOM, the licenseDeclared section was listed as NOASSERTION but licenseConcluded listed fontconfig as under the HPND-sell-variant license. The text of this license (https://spdx.org/licenses/HPND-sell-variant.html) does not match what's in the COPYING file. Being able to ignore best guesses would help when trying to get team members and legal departments to trust the output of licenses, especially if licenses are used in software approval processes.
Additional context:
None