## Overview This epic covers the Rails monolith changes needed to support SPDX license expressions end-to-end in GitLab. It is the counterpart to [SPDX License Expressions Ingestion and Processing in PMDB](https://gitlab.com/groups/gitlab-org/-/work_items/18346) and depends on the PMDB v3 export format being available. ## Problem to solve Once PMDB exports SPDX license expressions, the monolith must be able to ingest, evaluate, and surface them. Without these changes, composite licenses continue to appear as `unknown` and cannot be used in approval policies. ## Engineering breakdown (high level) 1. **pm_licenses ingestion + fetching** — Add `spdx_expression` column, update `package_metadata` sync to ingest expressions from the PMDB v3 format, and prioritize returning `spdx_expression` over `spdx_identifier` when present. 2. Ensure the v3 license sync supports resumable downloads, the same way GLAM (advisories) already does. 3. **sbom_occurrences ingestion** — Add `spdx_expression` column and update SBOM ingestion to store expressions from CycloneDX reports 4. ~~**Security policy evaluation** _(largest chunk)_ — Update policy models and services to accept expressions; integrate the `spdx` Ruby gem for parsing and implement `satisfies?` evaluation logic against allow/deny rules~~ This is currently being implemented by the ~"group::security policies" 5. **Dependency list UI + API/GraphQL** — Expose expressions across controllers, GraphQL types/resolvers, and REST API; display expressions with operators visible in the dependency list and assess impact on sorting, filtering, and other UI features ## Dependencies - **Upstream:** [PMDB epic](https://gitlab.com/groups/gitlab-org/-/work_items/18346) — v3 export format must be available first ## References - [Parent epic](https://gitlab.com/groups/gitlab-org/-/work_items/16801) - [Design document](https://handbook.gitlab.com/handbook/engineering/architecture/design-documents/complex_spdx_expression_evaluation/) - [spdx Ruby gem](https://github.com/librariesio/spdx) ## DRI - Engineer: @zmartins, EM: @nilieskou, PM: @joelpatterson