Incorrect License Names in cyclonedx-gomod mod -licenses

[acid-harry]

Hello!
I've noticed that cyclonedx-gomod mod -licenses is returning incorrect license names for some Go modules. Specifically, it reports BSD-Source-Code instead of BSD-3-Clause.

Example Output:
"component [].name: golang.org/x/sync, license.id: BSD-Source-Code"
"component [].name: golang.org/x/oauth2, license.id: BSD-Source-Code"
"component [*].name: golang.org/x/net, license.id: BSD-Source-Code"

Expected License Names:
golang.org/x/sync License
golang.org/x/oauth2 License
golang.org/x/net License

Could you please clarify why this is happening? Is there a way to ensure that the correct SPDX license identifiers are assigned?

Thanks in advance for your help!

[nscuro]

This is documented in the README:

There is currently no standard way for developers to declare their module's license.
Detecting licenses based on files in a repository is a non-trivial task, which is why cyclonedx-gomod
uses go-license-detector to resolve module licenses.

While go-license-detector's license matching may be accurate most of the time, SBOMs should state facts.
This is why detected licenses are included as evidences, rather than the licenses field directly.