resolve: spdxnorm alias table guesses licenses, violating 'never guess' #31

New Issue

2026-06-08T16:38:25Z

KofTwentyTwo commented

2026-06-08 16:38:25 +00:00

(Migrated from github.com)

Found during full-codebase review (see docs/review/02-audit-policy-resolve.md).

[HIGH] internal/resolve/spdxnorm.go (~89, 98): the alias table fabricates SPDX ids. "bsd" -> BSD-2-Clause invents a clause count; "gnu lesser general public license" -> LGPL-3.0-or-later invents both a version and the -or-later grant. Wrong guesses flow straight into deny/allow verdicts and the incompatibility table, where -only vs -or-later matters.

This violates the package's core 'never guess' invariant. These ambiguous aliases should resolve to unresolved with a reason, not a fabricated id.

[MED] Related: some aliases map to EPL/AGPL ids that pass Validate but are not curated, so policy.Classify returns Unknown while the dep is marked 'resolved'.

Found during full-codebase review (see docs/review/02-audit-policy-resolve.md). **[HIGH]** `internal/resolve/spdxnorm.go` (~89, 98): the alias table fabricates SPDX ids. `"bsd"` -> BSD-2-Clause invents a clause count; `"gnu lesser general public license"` -> LGPL-3.0-or-later invents both a version and the `-or-later` grant. Wrong guesses flow straight into deny/allow verdicts and the incompatibility table, where `-only` vs `-or-later` matters. This violates the package's core 'never guess' invariant. These ambiguous aliases should resolve to *unresolved* with a reason, not a fabricated id. **[MED]** Related: some aliases map to EPL/AGPL ids that pass `Validate` but are not curated, so `policy.Classify` returns Unknown while the dep is marked 'resolved'.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/license-tool#31