Vadation failure: The value 'Kazlib' is invalid according to its datatype 'http://cyclonedx.org/schema/spdx:licenseId'

[DavidJuanes]

I have created a SBOM using Syft, for the following docker image: debian:bookworm-slim Here is the produced SBOM: syft-bom.zip

When I validate it using cyclonedx-cli, I get the following error: Validation failed at line number 579 and position 23: The 'http://cyclonedx.org/schema/bom/1.5:id' element is invalid - The value 'Kazlib' is invalid according to its datatype 'http://cyclonedx.org/schema/spdx:licenseId' - The Enumeration constraint failed.

Looking at the spec for licenseId I see that Kazlib is a valid enumeration value: https://cyclonedx.org/schema/spdx

Therefore I believe there might be a bug here.

I am using cyclonedx-cli version 0.25.0

[DavidJuanes]

Manually removing Kazlilb license entries in the SBOM fixes the issue; SBOM is successfully validated.

[DavidJuanes]

Similar issue found for licenseId libutil-David-Nugent

[andreas-hilti]

I think one would need to update the schema here: https://github.com/CycloneDX/cyclonedx-dotnet-library/blob/main/src/CycloneDX.Core/Schemas/spdx.xsd and then use the new version of the cyclonedx-dotnet-library.

[mtsfoni]

The spdx schema in the library was updated with 0.25.1. Please let me know if there is still an issue.