License exceptions with a plus sign

[javierfreire]

Description

Trivy returns license expressions that contain exceptions with a plus sign. This is invalid according to the spec. The plus sign can be used with a license identifier, not an exception identifier.

Desired Behavior

The SPDX includes licenses with valid expressions

Actual Behavior

Some licenses generated are invalid, like:
MIT AND all-permissive AND GPL-3.0-only WITH autoconf-exception+ AND BSD-2-Clause AND GPL-3.0-only

Reproduction Steps

1. trivy image bitnami/wordpress --format spdx-json | grep autoconf-exception+

Target

None

Scanner

None

Output Format

SPDX

Mode

None

Debug Output

$ trivy image bitnami/wordpress --format spdx-json --debug

2024-10-30T17:05:00+01:00       DEBUG   No plugins loaded
2024-10-30T17:05:00+01:00       DEBUG   Default config file "file_path=trivy.yaml" not found, using built in values
2024-10-30T17:05:00+01:00       DEBUG   Cache dir       dir="/home/fjavier/.cache/trivy"
2024-10-30T17:05:00+01:00       DEBUG   Cache dir       dir="/home/fjavier/.cache/trivy"
2024-10-30T17:05:00+01:00       DEBUG   Parsed severities       severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2024-10-30T17:05:00+01:00       DEBUG   Ignore statuses statuses=[]
2024-10-30T17:05:00+01:00       INFO    "--format spdx-json" disables security scanning. Specify "--scanners vuln" explicitly if you want to include vulnerabilities in the "spdx-json" report.
2024-10-30T17:05:00+01:00       DEBUG   [pkg] Package types     types=[os library]
2024-10-30T17:05:00+01:00       DEBUG   [pkg] Package relationships     relationships=[unknown root direct indirect]
2024-10-30T17:05:00+01:00       DEBUG   Enabling misconfiguration scanners      scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2024-10-30T17:05:00+01:00       DEBUG   Initializing scan cache...      type="fs"
2024-10-30T17:05:00+01:00       DEBUG   [image] Detected image ID       image_id="sha256:ec82e5c090c19016f8008c6fef63b8a9ca70a35727405d1df1c7ccdebee80fbe"
2024-10-30T17:05:00+01:00       DEBUG   [image] Detected diff ID        diff_ids=[sha256:55ae727ef0f5d6fc99c7fc6a2671e522c9038734b17c1eaf6736491393bc4091]
2024-10-30T17:05:00+01:00       DEBUG   [image] Detected base layers    diff_ids=[]
2024-10-30T17:05:00+01:00       INFO    Detected OS     family="debian" version="12.7"
2024-10-30T17:05:00+01:00       INFO    Number of language-specific files       num=13
2024-10-30T17:05:00+01:00       DEBUG   [vex] VEX filtering is disabled

Operating System

Ubuntu 23.04

Version

Version: 0.56.2

Checklist

• Run trivy clean --all
• Read the troubleshooting

[knqyf263]

Thanks. Track #7838

[nick1989Gr]

I don't seem able to reproduce this

log output

trivy image bitnami/wordpress --format spdx-json | grep exception 
2024-11-13T08:53:06+01:00       INFO    "--format spdx" and "--format spdx-json" disable security scanning
2024-11-13T08:53:07+01:00       INFO    Detected OS     family="debian" version="12.8"
2024-11-13T08:53:07+01:00       INFO    Number of language-specific files       num=9
    "licenseConcluded": "GPL-3.0-only AND GPL-3.0-or-later WITH Bison-exception AND GPL-2.0-only AND GFDL-NIV-1.3 AND GFDL-1.3-only AND Latex2e AND BSD-4-clause-UC AND MIT-like AND permissive",
    "licenseDeclared": "GPL-3.0-only AND GPL-3.0-or-later WITH Bison-exception AND GPL-2.0-only AND GFDL-NIV-1.3 AND GFDL-1.3-only AND Latex2e AND BSD-4-clause-UC AND MIT-like AND permissive",
    "licenseConcluded": "GPL-3.0-only AND FSFULLR AND LGPL-2.1-only AND GPL-3.0-only WITH autoconf-exception AND GPL-3.0-or-later WITH texinfo-exception AND LGPL-2.0-only AND GPL-2.0-only AND X11 AND FSFAP AND GFDL-NIV-1.3 AND LGPL-3.0-only+ AND LGPL-3.0-only AND public-domain AND GFDL-1.3-only",
    "licenseDeclared": "GPL-3.0-only AND FSFULLR AND LGPL-2.1-only AND GPL-3.0-only WITH autoconf-exception AND GPL-3.0-or-later WITH texinfo-exception AND LGPL-2.0-only AND GPL-2.0-only AND X11 AND FSFAP AND GFDL-NIV-1.3 AND LGPL-3.0-only+ AND LGPL-3.0-only AND public-domain AND GFDL-1.3-only",
    "licenseConcluded": "GFDL-NIV-1.3+ AND GPL-3.0-only AND FSFAP AND GPL-3.0-or-later WITH Autoconf-data-exception AND FSFULLR AND GPL-2.0-or-later WITH Autoconf-data-exception AND GPL-2.0-only AND X11 AND public-domain AND GPL-3.0-only WITH automake-exception AND LGPL-2.1-only AND LGPL-2.0-only AND LGPL-3.0-only AND BSD-3-clause-and-or-GPL-3+ AND GPL-3.0-or-later WITH Bison-2.2-exception AND ISC-and-or-LGPL-2.1+ AND BSD-3-Clause AND GFDL-1.3-only AND ISC",
    "licenseDeclared": "GFDL-NIV-1.3+ AND GPL-3.0-only AND FSFAP AND GPL-3.0-or-later WITH Autoconf-data-exception AND FSFULLR AND GPL-2.0-or-later WITH Autoconf-data-exception AND GPL-2.0-only AND X11 AND public-domain AND GPL-3.0-only WITH automake-exception AND LGPL-2.1-only AND LGPL-2.0-only AND LGPL-3.0-only AND BSD-3-clause-and-or-GPL-3+ AND GPL-3.0-or-later WITH Bison-2.2-exception AND ISC-and-or-LGPL-2.1+ AND BSD-3-Clause AND GFDL-1.3-only AND ISC",
    "licenseConcluded": "ImageMagick AND aclocal AND Makefile-in AND Imagemagick AND ImageMagickPartlibsquish AND ImageMagickPartGraphicsMagick AND ImageMagickPartlibjpeg AND ImageMagickLicensePartFIG AND GPL-2.0-only AND BSD-3-Clause WITH FSF-change-public-domain AND ImageMagickLicensePartGsview AND ImageMagickLicensePartOpenSSH AND Magick-- AND TatcherUlrichPublicDomain AND GPL-3.0-or-later WITH Autoconf-Macros-exception-GNU AND GPL-3.0-or-later WITH Autoconf-Macros-exception AND GPL-2.0-or-later WITH Autoconf-Macros-exception AND GNU-All-Permissive-License AND LGPL-3.0-only AND ImageMagickLicensePartEZXML AND Perllikelicence AND Artistic AND GPL-1.0-only AND GPL-3.0-only",
    "licenseDeclared": "ImageMagick AND aclocal AND Makefile-in AND Imagemagick AND ImageMagickPartlibsquish AND ImageMagickPartGraphicsMagick AND ImageMagickPartlibjpeg AND ImageMagickLicensePartFIG AND GPL-2.0-only AND BSD-3-Clause WITH FSF-change-public-domain AND ImageMagickLicensePartGsview AND ImageMagickLicensePartOpenSSH AND Magick-- AND TatcherUlrichPublicDomain AND GPL-3.0-or-later WITH Autoconf-Macros-exception-GNU AND GPL-3.0-or-later WITH Autoconf-Macros-exception AND GPL-2.0-or-later WITH Autoconf-Macros-exception AND GNU-All-Permissive-License AND LGPL-3.0-only AND ImageMagickLicensePartEZXML AND Perllikelicence AND Artistic AND GPL-1.0-only AND GPL-3.0-only",
    "licenseConcluded": "GPL-2.0-only AND LGPL-2.0-only AND BSD-3-Clause AND Apache-2 AND ISC AND GPL-3.0-only AND MIT-US-export AND Kazlib AND Latex2e AND GPL-2.0-or-later WITH Texinfo-exception AND Apache-2.0",
    "licenseDeclared": "GPL-2.0-only AND LGPL-2.0-only AND BSD-3-Clause AND Apache-2 AND ISC AND GPL-3.0-only AND MIT-US-export AND Kazlib AND Latex2e AND GPL-2.0-or-later WITH Texinfo-exception AND Apache-2.0",
    "licenseConcluded": "curl AND OLDAP-2.8 AND ISC AND GPL-2.0-or-later WITH Autoconf-data-exception AND GPL-3.0-or-later WITH Autoconf-data-exception AND GPL-2.0-or-later WITH Libtool-exception AND BSD-3-Clause AND BSD-4-Clause-UC AND FSFULLR AND X11 AND GPL-2.0-only",
    "licenseDeclared": "curl AND OLDAP-2.8 AND ISC AND GPL-2.0-or-later WITH Autoconf-data-exception AND GPL-3.0-or-later WITH Autoconf-data-exception AND GPL-2.0-or-later WITH Libtool-exception AND BSD-3-Clause AND BSD-4-Clause-UC AND FSFULLR AND X11 AND GPL-2.0-only",
    "licenseConcluded": "LGPL-2.0-only AND LGPL-2.1-only AND FSFULLR AND CC0-1.0 AND Janik-permissive AND Iconv-PD AND Mingw-PD AND Old-GLib-Tests-permissive AND Expat AND AFL-2.0 AND Unicode-DFS-2016 AND GPL-2.0-only AND GPL-2.0-only WITH autoconf-exception AND LGPL-3.0-only AND Apache-2.0 WITH LLVM-exception AND Kuchling-PD AND Plumb-PD AND BSD-3-clause-pcre AND bzip2-1.0.6 AND CC-BY-SA-3.0 AND Apache-2.0",
    "licenseDeclared": "LGPL-2.0-only AND LGPL-2.1-only AND FSFULLR AND CC0-1.0 AND Janik-permissive AND Iconv-PD AND Mingw-PD AND Old-GLib-Tests-permissive AND Expat AND AFL-2.0 AND Unicode-DFS-2016 AND GPL-2.0-only AND GPL-2.0-only WITH autoconf-exception AND LGPL-3.0-only AND Apache-2.0 WITH LLVM-exception AND Kuchling-PD AND Plumb-PD AND BSD-3-clause-pcre AND bzip2-1.0.6 AND CC-BY-SA-3.0 AND Apache-2.0",
    "licenseConcluded": "GPL-2.0-only AND LGPL-3.0-only AND GPL-3.0-only AND GPL-3.0-or-later WITH Bison-exception",
    "licenseDeclared": "GPL-2.0-only AND LGPL-3.0-only AND GPL-3.0-only AND GPL-3.0-or-later WITH Bison-exception",
    "licenseConcluded": "LGPL-3.0-only AND GPL-2.0-only AND LGPL-2.0-only AND Expat AND GPL-3.0-only AND GPL-3.0-only WITH autoconf-exception AND public-domain AND GAP",
    "licenseDeclared": "LGPL-3.0-only AND GPL-2.0-only AND LGPL-2.0-only AND Expat AND GPL-3.0-only AND GPL-3.0-only WITH autoconf-exception AND public-domain AND GAP",
    "licenseConcluded": "OpenLDAP-2.8 AND FSF-unlimited AND GPL-2.0-only WITH autoconf-exception AND GPL-3.0-only WITH autoconf-exception AND GPL-2.0-or-later WITH Libtool-exception AND GPL-3.0-or-later WITH Libtool-exception AND GPL-3.0-only AND GPL-2.0-only AND UMich AND F5 AND JCG AND MIT-XC AND NeoSoft-permissive AND BSD-3-Clause AND Beerware AND public-domain AND BSD-4-clause-California AND BSD-3-clause-variant AND Expat-ISC AND Expat-UNM AND Expat AND BSD-3-clause-California",
    "licenseDeclared": "OpenLDAP-2.8 AND FSF-unlimited AND GPL-2.0-only WITH autoconf-exception AND GPL-3.0-only WITH autoconf-exception AND GPL-2.0-or-later WITH Libtool-exception AND GPL-3.0-or-later WITH Libtool-exception AND GPL-3.0-only AND GPL-2.0-only AND UMich AND F5 AND JCG AND MIT-XC AND NeoSoft-permissive AND BSD-3-Clause AND Beerware AND public-domain AND BSD-4-clause-California AND BSD-3-clause-variant AND Expat-ISC AND Expat-UNM AND Expat AND BSD-3-clause-California",
    "licenseConcluded": "ImageMagick AND aclocal AND Makefile-in AND Imagemagick AND ImageMagickPartlibsquish AND ImageMagickPartGraphicsMagick AND ImageMagickPartlibjpeg AND ImageMagickLicensePartFIG AND GPL-2.0-only AND BSD-3-Clause WITH FSF-change-public-domain AND ImageMagickLicensePartGsview AND ImageMagickLicensePartOpenSSH AND Magick-- AND TatcherUlrichPublicDomain AND GPL-3.0-or-later WITH Autoconf-Macros-exception-GNU AND GPL-3.0-or-later WITH Autoconf-Macros-exception AND GPL-2.0-or-later WITH Autoconf-Macros-exception AND GNU-All-Permissive-License AND LGPL-3.0-only AND ImageMagickLicensePartEZXML AND Perllikelicence AND Artistic AND GPL-1.0-only AND GPL-3.0-only",
    "licenseDeclared": "ImageMagick AND aclocal AND Makefile-in AND Imagemagick AND ImageMagickPartlibsquish AND ImageMagickPartGraphicsMagick AND ImageMagickPartlibjpeg AND ImageMagickLicensePartFIG AND GPL-2.0-only AND BSD-3-Clause WITH FSF-change-public-domain AND ImageMagickLicensePartGsview AND ImageMagickLicensePartOpenSSH AND Magick-- AND TatcherUlrichPublicDomain AND GPL-3.0-or-later WITH Autoconf-Macros-exception-GNU AND GPL-3.0-or-later WITH Autoconf-Macros-exception AND GPL-2.0-or-later WITH Autoconf-Macros-exception AND GNU-All-Permissive-License AND LGPL-3.0-only AND ImageMagickLicensePartEZXML AND Perllikelicence AND Artistic AND GPL-1.0-only AND GPL-3.0-only",
    "licenseConcluded": "ImageMagick AND aclocal AND Makefile-in AND Imagemagick AND ImageMagickPartlibsquish AND ImageMagickPartGraphicsMagick AND ImageMagickPartlibjpeg AND ImageMagickLicensePartFIG AND GPL-2.0-only AND BSD-3-Clause WITH FSF-change-public-domain AND ImageMagickLicensePartGsview AND ImageMagickLicensePartOpenSSH AND Magick-- AND TatcherUlrichPublicDomain AND GPL-3.0-or-later WITH Autoconf-Macros-exception-GNU AND GPL-3.0-or-later WITH Autoconf-Macros-exception AND GPL-2.0-or-later WITH Autoconf-Macros-exception AND GNU-All-Permissive-License AND LGPL-3.0-only AND ImageMagickLicensePartEZXML AND Perllikelicence AND Artistic AND GPL-1.0-only AND GPL-3.0-only",
    "licenseDeclared": "ImageMagick AND aclocal AND Makefile-in AND Imagemagick AND ImageMagickPartlibsquish AND ImageMagickPartGraphicsMagick AND ImageMagickPartlibjpeg AND ImageMagickLicensePartFIG AND GPL-2.0-only AND BSD-3-Clause WITH FSF-change-public-domain AND ImageMagickLicensePartGsview AND ImageMagickLicensePartOpenSSH AND Magick-- AND TatcherUlrichPublicDomain AND GPL-3.0-or-later WITH Autoconf-Macros-exception-GNU AND GPL-3.0-or-later WITH Autoconf-Macros-exception AND GPL-2.0-or-later WITH Autoconf-Macros-exception AND GNU-All-Permissive-License AND LGPL-3.0-only AND ImageMagickLicensePartEZXML AND Perllikelicence AND Artistic AND GPL-1.0-only AND GPL-3.0-only",
    "licenseConcluded": "LGPL-3.0-only AND GPL-2.0-only AND LGPL-2.0-only AND Expat AND GPL-3.0-only AND GPL-3.0-only WITH autoconf-exception AND public-domain AND GAP",
    "licenseDeclared": "LGPL-3.0-only AND GPL-2.0-only AND LGPL-2.0-only AND Expat AND GPL-3.0-only AND GPL-3.0-only WITH autoconf-exception AND public-domain AND GAP",
    "licenseConcluded": "Expat AND all-permissive AND GPL-3.0-only WITH autoconf-exception AND MIT AND BSD-2-Clause AND GPL-3.0-only",
    "licenseDeclared": "Expat AND all-permissive AND GPL-3.0-only WITH autoconf-exception AND MIT AND BSD-2-Clause AND GPL-3.0-only",
    "licenseConcluded": "BSD-3-Clause AND GPL-3.0-only AND GPL-2.0-only AND GPL-3.0-or-later WITH Bison-exception AND BSD-tcp-wrappers AND LGPL-2.0-only AND public-domain AND Beerware",
    "licenseDeclared": "BSD-3-Clause AND GPL-3.0-only AND GPL-2.0-only AND GPL-3.0-or-later WITH Bison-exception AND BSD-tcp-wrappers AND LGPL-2.0-only AND public-domain AND Beerware",
    "licenseConcluded": "BSD-3-Clause AND GPL-3.0-only AND GPL-2.0-only AND GPL-3.0-or-later WITH Bison-exception AND BSD-tcp-wrappers AND LGPL-2.0-only AND public-domain AND Beerware",
    "licenseDeclared": "BSD-3-Clause AND GPL-3.0-only AND GPL-2.0-only AND GPL-3.0-or-later WITH Bison-exception AND BSD-tcp-wrappers AND LGPL-2.0-only AND public-domain AND Beerware",
    "licenseConcluded": "BSD-3-Clause AND GPL-3.0-only AND GPL-2.0-only AND GPL-3.0-or-later WITH Bison-exception AND BSD-tcp-wrappers AND LGPL-2.0-only AND public-domain AND Beerware",
    "licenseDeclared": "BSD-3-Clause AND GPL-3.0-only AND GPL-2.0-only AND GPL-3.0-or-later WITH Bison-exception AND BSD-tcp-wrappers AND LGPL-2.0-only AND public-domain AND Beerware",
    "licenseConcluded": "BSD-3-Clause AND GPL-3.0-only AND GPL-2.0-only AND GPL-3.0-or-later WITH Bison-exception AND BSD-tcp-wrappers AND LGPL-2.0-only AND public-domain AND Beerware",
    "licenseDeclared": "BSD-3-Clause AND GPL-3.0-only AND GPL-2.0-only AND GPL-3.0-or-later WITH Bison-exception AND BSD-tcp-wrappers AND LGPL-2.0-only AND public-domain AND Beerware",
    "licenseConcluded": "BSD-3-clause-Cambridge WITH BINARY-LIBRARY-LIKE-PACKAGES-exception AND BSD-3-Clause AND X11 AND BSD-2-Clause AND public-domain",
    "licenseDeclared": "BSD-3-clause-Cambridge WITH BINARY-LIBRARY-LIKE-PACKAGES-exception AND BSD-3-Clause AND X11 AND BSD-2-Clause AND public-domain",
    "licenseConcluded": "GPL-1.0-only AND Artistic AND Expat AND REGCOMP AND GPL-2.0-only WITH bison-exception AND Unicode AND BZIP AND Zlib AND GPL-2.0-only AND RRA-KEEP-THIS-NOTICE AND BSD-3-Clause WITH weird-numbering AND CC0-1.0 AND TEXT-TABS AND BSD-4-clause-POWERDOG AND BSD-3-clause-GENERIC AND BSD-3-Clause AND SDBM-PUBLIC-DOMAIN AND DONT-CHANGE-THE-GPL AND Artistic-dist AND LGPL-2.1-only AND Artistic-2 AND HSIEH-DERIVATIVE AND HSIEH-BSD",
    "licenseDeclared": "GPL-1.0-only AND Artistic AND Expat AND REGCOMP AND GPL-2.0-only WITH bison-exception AND Unicode AND BZIP AND Zlib AND GPL-2.0-only AND RRA-KEEP-THIS-NOTICE AND BSD-3-Clause WITH weird-numbering AND CC0-1.0 AND TEXT-TABS AND BSD-4-clause-POWERDOG AND BSD-3-clause-GENERIC AND BSD-3-Clause AND SDBM-PUBLIC-DOMAIN AND DONT-CHANGE-THE-GPL AND Artistic-dist AND LGPL-2.1-only AND Artistic-2 AND HSIEH-DERIVATIVE AND HSIEH-BSD",
    "licenseConcluded": "LGPL-2.1-only AND CC0-1.0 AND GPL-2.0-only WITH Linux-syscall-note-exception AND Expat AND public-domain AND GPL-2.0-only",
    "licenseDeclared": "LGPL-2.1-only AND CC0-1.0 AND GPL-2.0-only WITH Linux-syscall-note-exception AND Expat AND public-domain AND GPL-2.0-only",
    "licenseConcluded": "LGPL-2.1-only AND CC0-1.0 AND GPL-2.0-only WITH Linux-syscall-note-exception AND Expat AND public-domain AND GPL-2.0-only",
    "licenseDeclared": "LGPL-2.1-only AND CC0-1.0 AND GPL-2.0-only WITH Linux-syscall-note-exception AND Expat AND public-domain AND GPL-2.0-only",
    "licenseConcluded": "LGPL-3.0-only AND GPL-2.0-only AND FreeSoftware AND GPL-3.0-only AND GFDL-1.2-only+ AND GPL-2.0-or-later WITH distribution-exception AND MIT AND GFDL-1.2-only",
    "licenseDeclared": "LGPL-3.0-only AND GPL-2.0-only AND FreeSoftware AND GPL-3.0-only AND GFDL-1.2-only+ AND GPL-2.0-or-later WITH distribution-exception AND MIT AND GFDL-1.2-only",
    "licenseConcluded": "GPL-1.0-only AND Artistic AND Expat AND REGCOMP AND GPL-2.0-only WITH bison-exception AND Unicode AND BZIP AND Zlib AND GPL-2.0-only AND RRA-KEEP-THIS-NOTICE AND BSD-3-Clause WITH weird-numbering AND CC0-1.0 AND TEXT-TABS AND BSD-4-clause-POWERDOG AND BSD-3-clause-GENERIC AND BSD-3-Clause AND SDBM-PUBLIC-DOMAIN AND DONT-CHANGE-THE-GPL AND Artistic-dist AND LGPL-2.1-only AND Artistic-2 AND HSIEH-DERIVATIVE AND HSIEH-BSD",
    "licenseDeclared": "GPL-1.0-only AND Artistic AND Expat AND REGCOMP AND GPL-2.0-only WITH bison-exception AND Unicode AND BZIP AND Zlib AND GPL-2.0-only AND RRA-KEEP-THIS-NOTICE AND BSD-3-Clause WITH weird-numbering AND CC0-1.0 AND TEXT-TABS AND BSD-4-clause-POWERDOG AND BSD-3-clause-GENERIC AND BSD-3-Clause AND SDBM-PUBLIC-DOMAIN AND DONT-CHANGE-THE-GPL AND Artistic-dist AND LGPL-2.1-only AND Artistic-2 AND HSIEH-DERIVATIVE AND HSIEH-BSD",
    "licenseConcluded": "GPL-1.0-only AND Artistic AND Expat AND REGCOMP AND GPL-2.0-only WITH bison-exception AND Unicode AND BZIP AND Zlib AND GPL-2.0-only AND RRA-KEEP-THIS-NOTICE AND BSD-3-Clause WITH weird-numbering AND CC0-1.0 AND TEXT-TABS AND BSD-4-clause-POWERDOG AND BSD-3-clause-GENERIC AND BSD-3-Clause AND SDBM-PUBLIC-DOMAIN AND DONT-CHANGE-THE-GPL AND Artistic-dist AND LGPL-2.1-only AND Artistic-2 AND HSIEH-DERIVATIVE AND HSIEH-BSD",
    "licenseDeclared": "GPL-1.0-only AND Artistic AND Expat AND REGCOMP AND GPL-2.0-only WITH bison-exception AND Unicode AND BZIP AND Zlib AND GPL-2.0-only AND RRA-KEEP-THIS-NOTICE AND BSD-3-Clause WITH weird-numbering AND CC0-1.0 AND TEXT-TABS AND BSD-4-clause-POWERDOG AND BSD-3-clause-GENERIC AND BSD-3-Clause AND SDBM-PUBLIC-DOMAIN AND DONT-CHANGE-THE-GPL AND Artistic-dist AND LGPL-2.1-only AND Artistic-2 AND HSIEH-DERIVATIVE AND HSIEH-BSD",
    "licenseConcluded": "GPL-1.0-only AND Artistic AND Expat AND REGCOMP AND GPL-2.0-only WITH bison-exception AND Unicode AND BZIP AND Zlib AND GPL-2.0-only AND RRA-KEEP-THIS-NOTICE AND BSD-3-Clause WITH weird-numbering AND CC0-1.0 AND TEXT-TABS AND BSD-4-clause-POWERDOG AND BSD-3-clause-GENERIC AND BSD-3-Clause AND SDBM-PUBLIC-DOMAIN AND DONT-CHANGE-THE-GPL AND Artistic-dist AND LGPL-2.1-only AND Artistic-2 AND HSIEH-DERIVATIVE AND HSIEH-BSD",
    "licenseDeclared": "GPL-1.0-only AND Artistic AND Expat AND REGCOMP AND GPL-2.0-only WITH bison-exception AND Unicode AND BZIP AND Zlib AND GPL-2.0-only AND RRA-KEEP-THIS-NOTICE AND BSD-3-Clause WITH weird-numbering AND CC0-1.0 AND TEXT-TABS AND BSD-4-clause-POWERDOG AND BSD-3-clause-GENERIC AND BSD-3-Clause AND SDBM-PUBLIC-DOMAIN AND DONT-CHANGE-THE-GPL AND Artistic-dist AND LGPL-2.1-only AND Artistic-2 AND HSIEH-DERIVATIVE AND HSIEH-BSD",
    "licenseConcluded": "GPL-3.0-only AND GPL-3.0-or-later WITH Bison-exception AND LGPL-3.0-only AND GPL-2.0-only",
    "licenseDeclared": "GPL-3.0-only AND GPL-3.0-or-later WITH Bison-exception AND LGPL-3.0-only AND GPL-2.0-only",

Is this still an issue or am I missing something?

[knqyf263]

Yes, the software license is a mess. We're not sure what autoconf-exception+ means. I think we need to define it as a custom license denoted by LicenseRef-.

[nick1989Gr]

Thanks for your feedback @knqyf263 . So if I understand correctly instead of removing the + sign we should do something like:
AFL 2.0 with Bison-exception+ --> AFL 2.0 with LicenseRef-<id> where LicenseRef-<id> is a custom license that we need to create on the go. I am wondering if for the scope of this issue would be better to first start by just removing the +. So going from AFL 2.0 with Bison-exception+ --> AFL 2.0 with Bison-exception . This could be a first step so at least the SPDX license expression is not completely wrong. I am also not very familiar with how to create a custom license but I guess that probably we have all the information that we need right? WDYT?

[knqyf263]

Bison-exception is not in the list, so it's invalid anyway, right? Do you mean removing + helps align with idstring?

idstring = 1*(ALPHA / DIGIT / "-" / "." )

BTW, we might need to add AdditionRef- for exceptions.

license-ref = [%s"DocumentRef-"(idstring)":"]%s"LicenseRef-"(idstring)
addition-ref = [%s"DocumentRef-"(idstring)":"]%s"AdditionRef-"(idstring)

[nick1989Gr]

Bison-exception is not in the list, so it's invalid anyway, right?

You are right. My bad. I didn't realise that Bison-exception is not a valid one. So basically I was wondering if I could transform Bison-exception+ into Bison-exception-2.2 AND Bison-exception-1.24 which I guess it should be a valid license expression. I am basing this suggestion in the assumption that when someone is using Bison-exception+ probably they mean the latest Bison-exception which is 2.2.

Probably what is really needed here is what you are describing.

[knqyf263]

I am basing this suggestion in the assumption that when someone is using Bison-exception+ probably they mean the latest Bison-exception which is 2.2.

I am afraid that if the conversion method is not obvious, the tool may change the meaning on its own. So I thought it would be better to use AdditionRef- to keep the original value, but in any case, idstring in addition-ref does not allow plus signs, so it does not seem possible to save the value as it is.