[lmco-shuynh]

Description

Adds license.licensing support. Adding this helps support our internal use cases for tracking vendor licensing terms for software we purchase/license.

Resolves or fixes issue: #578

AI Tool Disclosure

• My contribution does not include any AI-generated content
• My contribution includes AI-generated content, as disclosed below:
  • AI Tools: Windsurf
  • LLMs and versions: Claude Opus 4.6 Thinking
  • Prompts: Ex: Create unit tests to exercise the newly added licensing field in license. Update documentation to reflect newly added changes

Affirmation

• My code follows the CONTRIBUTING.md guidelines

[read-the-docs-community]

Documentation build overview

📚 CycloneDX Python Library | 🛠️ Build #35643364 | 📁 Comparing c92e22d against latest (e537812)

  🔍 Preview build  

18 files changed · + 2 added · ± 16 modified

+ Added

• autoapi/cyclonedx/contrib/bom/index.html
• autoapi/cyclonedx/contrib/bom/utils/index.html

± Modified

• changelog.html
• genindex.html
• py-modindex.html
• schema-support.html
• autoapi/index.html
• autoapi/cyclonedx/contrib/index.html
• autoapi/cyclonedx/output/index.html
• autoapi/cyclonedx/serialization/index.html
• autoapi/cyclonedx/spdx/index.html
• autoapi/cyclonedx/builder/this/index.html
• and 6 more...

[jkowalleck]

thank you for taking care of this feature, @lmco-shuynh

please add the new capability to the existing test model in https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/tests/_data/models.py
i think get_bom_with_licenses should be the right place , similar as #947 done it

[jkowalleck]

@lmco-shuynh please rebase onto latest main branch

[lmco-shuynh]

@jkowalleck I've rebased, updated some URLs, and updated the test for get_bom_with_licenses.

Thanks for your help reviewing these changes

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 52 complexity · 0 duplication

Metric	Results
Complexity	52
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[jkowalleck]

please rebase merge or onto latest main branch - and fix the conflicts..
it brings additional tests that might be needed here.

[jkowalleck]

please add tests for completeness to tests/test_enums.py

[saquibsaifee]

@lmco-shuynh is the ready from your side?

[jkowalleck]

review done by Claude Fable 5.2, prompt: "do a review, comment your findings"

---

Scope of this review: static review of the diff at c92e22d, cross-checked against the bundled 1.5 and 1.7 JSON schemas and the 1.7 XSD. I did not run the test suite, and the Python CI workflow has not reported for this head (only DCO, Codacy and GitGuardian have), so the tests and snapshots are unverified.

Overall: the model matches the schema. Property names, XML element names and order (altIds/altId, licensor, licensee, purchaser, purchaseOrder, licenseTypes/licenseType, lastRenewal, expiration), the enum values, and the 1.5+ view gating are all correct. licensing sits correctly between url and properties in DisjunctiveLicense. The findings below are ordered by importance.

Blocking

1. DCO check is failing (ACTION_REQUIRED). The commits need a sign-off before this can merge.

Should fix

2. LicenseEntity can be put into an invalid state through its setters (cyclonedx/model/license.py, organization / individual setters).
   The constructor enforces exactly one of the two, but the setters do not. LicenseEntity(organization=o).organization = None leaves both as None. That serializes to "licensor": {}, which violates the JSON schema (oneOf: required organization | required individual).
   test_set_organization_none_keeps_individual and its sibling only cover the harmless direction.
   Either raise when a setter would leave both empty, or drop the setters' implicit clearing and make the class effectively immutable.

3. docs/schema-support.rst is inaccurate after this change.

   • DisjunctiveLicense still says "Not currently supported: properties", but properties is implemented (xml_sequence(6), views 1.5–1.7). The cell should be empty.
   • LicenseExpression is now shown with no gaps. In 1.7 the detailed expression also allows licensing and properties (JSON licenseChoice/items/oneOf/1/properties/licensing; XSD licensing element after details), and neither is modelled. Please list them as unsupported rather than leaving the cell empty.

4. licensing on LicenseExpression (1.7) is not implemented. That is fine for this PR's scope, but [TRACKING] Complete support for CycloneDX v1.5 #578 should not be considered fully resolved for 1.7. Either add it here (the Licensing class is reusable as is) or say so in the PR description and open a follow-up.

Minor

5. test_equal_with_licensing does not test value equality. a and b share the same Licensing instance, so the test would pass even if Licensing.__eq__ were identity-based. Build two equal instances instead.

6. altId is xs:normalizedString in the XSD, but alt_ids has no normalization applied (compare license_identifier, which uses xml_string(NORMALIZED_STRING)). Values containing tabs or newlines would be emitted unnormalized in XML.

7. alt_ids and license_types are SortedSets, so input order is lost and duplicates are dropped. That is consistent with the rest of the library and probably intended; I am flagging it only because altIds is a plain array in the schema.

8. Unrelated tests were added (test_equal_with_acknowledgement, test_equal_different_acknowledgement), and a blank line after class TestModelLicense was removed. These are harmless but outside this feature's scope.

9. Docstring schema links use the metadata_tools_oneOf_i0_components_items_licenses_… anchors. A shorter anchor such as the XML type_licensingType one, in the style used by LicenseExpressionDetails, would be more stable.

Checked and fine

• TestEnumLicenseType covers both JSON locations: inline definitions.license.properties.licensing (1.5/1.6) and top-level definitions.licensing (1.7). The XSD licenseTypeEnum xpath is correct.
• The enum_LicenseType snapshots for 1.4 and below correctly omit licensing, and the 1.7 XML snapshot is in schema order.
• licensing is included in DisjunctiveLicense.__comparable_tuple, so equality, hashing and sorting take it into account.