Configuration of ListedLicenses broken

[ohecker]

According to the documentation (https://github.com/spdx/Spdx-Java-Library#configuration-options) the property file to configure options for the library is named /resources/spdx-java-library.properties. The property org.spdx.useJARLicenseInfoOnly controls if license information is taken only from the data bundled in the JAR or downloaded from the internet.

The current implementation of class org.spxd.library.ListedLicenses seems to make use of file /resources/licenses.properties and property name OnlyUseLocalLicenses instead.

When looking into an older version of ListedLicenses (e.g. https://github.com/spdx/Spdx-Java-Library/blob/v1.1.11/src/main/java/org/spdx/library/model/license/ListedLicenses.java) it can be seen that this older version used the filename and property name as given in the documentation. The coding also honours OnlyUseLocalLicenses as a fallback and comments that the properties have been renamed multiple times and the implementation tries to achieve compatibility. Further on this older version of ListedLicenses also makes use of class Configuration which will create a deprecation warning if file /resources/licenses.properties is used, stating that it should be migrated to /resources/spdx-java-library.properties

All in all it seems that in the current version of ListedLicenses some outdated configuration logic has slipped in which creates a mismatch with the documentation and results in existing configurations no longer working.

[goneall]

Thanks @ohecker for reporting the issue. I likely missed the updated configuration code when merging the main branch into the SPDX version 2.0 development branch.

I'll create a PR to fix.