License issue GPL dependency rfc3987

[kdekker-private]

cyclonedx-python (cyclonedx-bom==4.1.2) depends via cyclonedx-python-lib==6.4.3 on the package jsonschema, but with the special option format (jsonschema[format]).
This introduces the GPL dependency of package rfc3987, which I think is not the intention.

How to reproduce:

1. Install Python 3.10.11
2. In cmd call: pip install cyclonedx-bom

Prove:

Potential solution:

• Depend on jsonschema[format-nongpl]

Temporary user solution:

• Downgrade cyclonedx-bom to a version without the dependency such as 3.11.7.

[jkowalleck]

This introduces the GPL dependency of package rfc3987, which I think is not the intention.

some background: we are not shipping any assembly, nor bundle. Therefore, we never mix any licenses.
Neither do users of this package generate any bundle/assembly when installing it. All they do is putting certain packages somewhere on their machine, so that python can find and run them.
This means, at no point, a mix of licenses exists.
This means, no license issues exist.

Is that not true, @kdekker-private ?

Anyway, I will check whether a non-gpl package can do the job.

[jkowalleck]

The rfc3987 is used to validate iri-reference in JSON - which is widely used in CycloneDX.
Therefore, schema validation would not be complete without it.

[jkowalleck]

@kdekker-private could you elaborate how the current situation affects you?
What does it prevent you from doing/achieving?

[kdekker-private]

At the current stage it does not prevent us anymore from doing/achieving anything. We accidently added your package in distribution. But removed it and are happy to use it outside of that.

However, I think it would be good for transparency to at least notify the user in the readme that a GPL licensed package is used under the hood. The MIT license of your package might mask this a bit. Ideal would be to remove the dependency on the GPL package, if it is possible. Thanks for the quick response.

[jkowalleck]

re: #568 (comment)

sounds reasonable. 👍
Would you open a pull request that improves the documentation in a way that suites your needs? Thank you in advance