Repository navigation
Report infer license info in sbom #1116
Description
Currently, inferred licenses from infer-license do not capture the tool’s confidence score or the configured reporting threshold.
Propose to:
Include the confidence score calculated by infer-license for each inferred license
Record the confidence threshold used to accept inferences
Store both in the evidence section for transparency and reproducibility
This improves auditability and helps downstream compliance checks
{
"licenses": [
{
"license": {
"name": "MIT"
},
"evidence": [
{
"type": "tool",
"tool": "infer-license",
"version": "0.6.2",
"confidence": 0.87, // actual detected confidence
"threshold": 0.80, // threshold used to accept inference
"comment": "License inferred from package files"
}
]
}
]
}
Activity
Add ``dfetch:license:<spdx-id>:confidence``, ``dfetch:license:thresho…
Add ``dfetch:license:<spdx-id>:confidence``, ``dfetch:license:thresho…
Add ``dfetch:license:<spdx-id>:confidence``, ``dfetch:license:thresho…
Add ``dfetch:license:<spdx-id>:confidence``, ``dfetch:license:thresho…