### Overview Once PMDB publishes the v3 license format, the monolith must sync, parse, store, and serve SPDX license expressions (for example `MIT OR (Apache-2.0 AND GPL-3.0)`) instead of only single identifiers. Build the v3 path dark behind the version pin, then flip the producer once verified. ### Feature flag All of this ships behind a feature flag so the v3 sync stays dark until it is verified end to end and can be rolled back instantly, **though it does not revert data already ingested**. The flag gates the producer switch in https://gitlab.com/gitlab-org/gitlab/-/issues/606527+s (a dedicated rollout issue, mirroring `cyclonedx_license_expression_ingestion` / https://gitlab.com/gitlab-org/gitlab/-/issues/604791+s from the CycloneDX work). Until it is enabled, the default v2 license sync is unchanged. ### Key facts - **Format (https://gitlab.com/gitlab-org/gitlab/-/issues/596923+s):** `default_licenses`/`other_licenses` are arrays of blocks, each block `{expression}` or `{licenses:[{id}]}`; identifiers now wrapped as `{id}` objects. Blocks can mix, and multiple expressions per version are allowed. `LicenseRef-*` arrive as expressions. - Transport: PDS. v3 licenses sync through the PMDB-distribution-Service, the same distribution boundary GLAM uses — not directly from the bucket. Rails authenticates with the Cloud Connector instance JWT and a licenses-specific scope; PDS reads the v3 format from the licenses bucket and hands back URLs. - **State:** `VERSION_FORMAT_V3` + enum already exist; `license_configs` still pinned to v2 (`sync_configuration.rb`). No `spdx_expression` anywhere in the pm_* path yet. ### Sequencing See issues list below ### Dependencies - Exporter v3 publish: https://gitlab.com/groups/gitlab-org/-/work_items/22925+s - PDS: https://gitlab.com/groups/gitlab-org/-/work_items/23152+s ### Out of scope - Exporter/feeder (https://gitlab.com/groups/gitlab-org/-/epics/18346+s). - CycloneDX/sbom_occurrences (https://gitlab.com/gitlab-org/gitlab/-/issues/606225+s). - policy evaluation (security policies); `LicenseRef` dereferencing; backfill.