Repository navigation
Drop the versionless License :: classifier now that license is a valid SPDX expression #652
Description
This issue is part of a larger batch of similar-scoped issues we distribute in the context of our internal vulnerability and dependency tracking activities. The batch covers multiple projects, this is only one of them. The goal is to rise awareness and trigger/initiate the change towards clean project metadata in projects we depend on.
Summary
This project already declares a valid SPDX license id/expression in its packaging metadata (License: MIT in the built METADATA), but the deprecated classifier License :: OSI Approved and License :: OSI Approved :: MIT License is still present. That classifier has no version and PEP 639-aware SBOM tooling like cyclonedx-bom can't map it to an SPDX id, so it falls back to emitting the raw classifier text as a free-text license name. This free-text field is just noise and causes downstream tooling to flag this project as non-SPDX-compliant.
Suggested fix
Remove the redundant License :: OSI Approved :: Apache Software License from classifiers in the packaging config. No change to the license field is needed.
How to reproduce
uv tool install cyclonedx-bom
uv venv .venv-repro
uv pip install --python .venv-repro/bin/python future
cyclonedx-py environment .venv-repro -o sbom.cdx.json... and then check the .licenses property of the component. There should only something like:
// This is how it should look like
...
"license": {
"acknowledgement": "declared",
"id": "<VALID SPDX IDENTIFIER>"
}
...and not:
// This is how it should not look like
...
"license": {
"acknowledgement": "declared",
"name": "<CLASSIFIER TAKEN FROM METADATA"
}
...I'm happy to provide a PR to resolve this timely after approval!
Activity
edschofield commentedon Aug 26, 2026
btschwertfeger commentedon Aug 26, 2026
The package is available for newer Python versions as well:
python-future/setup.py
Lines 91 to 105 in 2d56f83
We use it as part of legacy code bases we can't get rid of easily and I'm sure that we are not the only ones.
The version of cyclonedx-bom and its required Python version have nothing to do with the version required by the python-future package. cyclonedx-bom is just a tool used to generate the SBOM based on an environment that has the python-future package installed (there are of course other tools to generate the SBOM from an environment). This can be any Python environment, even Python 3.3 I guess.
I wasn't aware of the fact that this project reached end-of-life. Archiving the project would be a good indicator for that!