SBOM Component License question for commercial software

[JpWebster]

When distributing NuGet packages for commercial software there are a couple of options for packing a license (Using a license expression or a license file). We are trying to avoid packaging the license agreement in each and every NuGet package but using the LicenseExpression introduces issues as below:

When using the license expression property in our C# project, to define the license like so:
LicenseRef-CompanyName-Commercial

We end up with an SBOM that contains this for the license, which fails schema validation as the value for the "id" element is not one of the enumerated SPDX license id's.

"licenses": [
{
"license": {
"id": "LicenseRef-CompanyName-Commercial"
}
}
]

CycloneDX incorporates SPDX license IDs and expressions to document stated licenses of open source components. Licenses can be expressed three ways, by SPDX license ID, by SPDX license expression, or as a license name. Zero or more licenses can be defined by ID or by name.

I would expect to see this as the output.

"licenses": [
{
"expression": "LicenseRef-CompanyName-Commercial",
"acknowledgement": "declared"
}
]

Perhaps we are mis-reading how license expressions are supposed to be defined. When using the license expression (An SPDX user defined license reference) as defined under the Simple license expressions from (https://spdx.github.io/spdx-spec/v3.0.1/annexes/spdx-license-expressions/)

Also, with the license expression defined as "LicenseRef-CompanyName-Commercial" - VS package management also cannot be recognized.

Thanks!

[johanseb-te]

When distributing NuGet packages for commercial software there are a couple of options for packing a license (Using a license expression or a license file).

You have to include a license file, nuspec's don't use the normative ABNF in the spec annex, but a simpler one. Their simple definition only allows the ones on the shorthand list.