Description

CycloneDX supports 3 possible fields for licenses:

1. multiple licenses by ID - https://cyclonedx.org/docs/1.6/json/#tab-pane_components_items_licenses_oneOf_i0_items_license_oneOf_i0
2. multiple licenses by Name - https://cyclonedx.org/docs/1.6/json/#tab-pane_components_items_licenses_oneOf_i0_items_license_oneOf_i1
3. SPDX license expression - https://cyclonedx.org/docs/1.6/json/#tab-pane_components_items_licenses_oneOf_i1

We added handaling for SPDX licenses - #8077.
But we don't use similar logic for CycloneDX reports.
We use 2 way (licenses by Name) for all licenses:

But there are case when this is incorrect:

1. when license is SPDX license ID, but we use name instead of id
2. when license is SPDX expression (see Unofficial License Names in CycloneDX SBOMs #9033).

Solution

We need to parse each got license before insert in in CycloneDX report:

1. for single license:
   1.2. check that this is SPDX license. Use ID field for SPDX license and name for another license.
2. for multiple licenses
   2.1. Use SPDX expression for valid SPDX expression
   2.2.for other cases split licenses and use name/id field for each license

Discussed in #9033