Handle dual license

Some projects such as TF-PSA-Crypto have a single license file that contains 2 licenses, infer license could be improved to detect this.

When a license file is detected but the license cannot be determined, the SBOM currently omits the licenses field.

Propose to:

Explicitly set license to NOASSERTION (or "Unknown")
Add an evidence entry indicating a license file was found but could not be classified

This improves transparency and downstream compliance analysis

For components where no license file is present, propose to:

Set licenses to NOASSERTION or "Unknown"
Add an evidence entry indicating that no license file was found

This ensures transparency and supports downstream compliance checks.

Solve Handle dual license

Embed base64-encoded license text in SBOM ``licenses[].text`` when a …

Navigation Menu