feat(PH2155): Remove backward compatibility, only support combined package+license format

Co-authored-by: bcollamore <57269455+bcollamore@users.noreply.github.com>

Author: Copilot

Documentation/Diagnostics/PH2155.md

@@ -52,11 +52,11 @@ In the package's `.nuspec` file:
 ### Diagnostic message
 
 ```
-Package 'SomeGplPackage' version '1.0.0' has an unacceptable license 'GPL-3.0'. Consider adding to Allowed.Licenses.txt if license is acceptable.
+Package 'SomeGplPackage' version '1.0.0' has an unacceptable license 'GPL-3.0'. Add 'SomeGplPackage GPL-3.0' to Allowed.Licenses.txt if this specific package and license combination is acceptable.
 ```
 
 ```
-Package 'SomePackageWithFileLicense' version '1.0.0' has an unacceptable license 'UNKNOWN_FILE_LICENSE'. Consider adding to Allowed.Licenses.txt if license is acceptable.
+Package 'SomePackageWithFileLicense' version '1.0.0' has an unacceptable license 'UNKNOWN_FILE_LICENSE'. Add 'SomePackageWithFileLicense UNKNOWN_FILE_LICENSE' to Allowed.Licenses.txt if this specific package and license combination is acceptable.
 ```
 
 ### Resolution options
@@ -70,37 +70,18 @@ Package 'SomePackageWithFileLicense' version '1.0.0' has an unacceptable license
 </ItemGroup>
 ```
 
-```text
-# Allowed.Licenses.txt - Add acceptable licenses to this file
-# Commercial license for specific vendor
-CommercialLicense-Vendor-X
-# Allow GPL for this specific use case
-GPL-3.0
-# Combined format (recommended for maximum security)
-SomePackage GPL-3.0
-```
-
-#### Option 2: Use Combined Format (Recommended)
-
-The safest approach is to use the combined package + license format:
-
-```xml
-<!-- In your project file -->
-<ItemGroup>
-  <AdditionalFiles Include="Allowed.Licenses.txt" />
-</ItemGroup>
-```
-
 ```text
 # Allowed.Licenses.txt - Combined format for maximum security
-# Only accept SomeGplPackage if it specifically has GPL-3.0 license
+# Only accept specific packages with specific licenses
 SomeGplPackage GPL-3.0
+SomeCommercialPackage CommercialLicense-Vendor-X
+SomePackageWithFileLicense UNKNOWN_FILE_LICENSE
 
 # This prevents both license change issues and file name collisions
-# If the package later changes to a different license, it will be flagged again
+# If a package later changes to a different license, it will be flagged again
 ```
 
-#### Option 3: Find alternative package
+#### Option 2: Find alternative package
 
 Replace the package with one that has a more permissive license:
 
@@ -109,7 +90,7 @@ Replace the package with one that has a more permissive license:
 <PackageReference Include="AlternativePackage" Version="2.0.0" />
 ```
 
-#### Option 4: Remove the dependency
+#### Option 3: Remove the dependency
 
 If the package is not essential, remove it entirely:
 
@@ -183,27 +164,23 @@ Configure allowed licenses by creating an `Allowed.Licenses.txt` file in your pr
 ```
 
 The `Allowed.Licenses.txt` file supports:
-- One license identifier per line
+- Combined package + license format: `packagename license`
 - Comments using `#` at the beginning of lines
 - Custom license names for commercial or proprietary packages
 - SPDX license identifiers
-- **Package names** for whitelisting specific packages (safer than license file names)
+- Entries are case-insensitive
 
 ### Whitelisting Specific Packages
 
-For packages with unacceptable or unknown licenses that you need to use, you have several whitelisting options in `Allowed.Licenses.txt`:
+For packages with unacceptable or unknown licenses that you need to use, use the combined package + license format in `Allowed.Licenses.txt`:
 
-#### 1. Combined Package + License Format (Recommended - Safest)
+#### Combined Package + License Format (Required)
 
-The safest approach is to use the combined format: `packagename license`. This provides both package identity verification and license verification, preventing both license change vulnerabilities and license file name collisions.
+The analyzer only supports the secure combined format: `packagename license`. This provides both package identity verification and license verification, preventing both license change vulnerabilities and license file name collisions.
 
 ```text
-# Allowed.Licenses.txt - Combined format examples (RECOMMENDED)
-# Standard license identifiers (backward compatibility)
-MIT
-Apache-2.0
-
-# Combined package + license entries (safest approach)
+# Allowed.Licenses.txt - Combined format examples
+# Combined package + license entries (only supported format)
 Newtonsoft.Json MIT
 Microsoft.EntityFrameworkCore Apache-2.0
 SomeCommercialPackage CommercialLicense-2024
@@ -214,39 +191,12 @@ OldLegacyPackage UNKNOWN_FILE_LICENSE
 # - License file name collisions (entry is specific to one package)
 ```
 
-#### 2. Package Name Only (Backward Compatibility)
-
-For backward compatibility, you can still whitelist packages by name only, though this is less secure:
-
-```text
-# Package name whitelisting (less secure - license changes not detected)
-SomeTrustedPackage
-AnotherWhitelistedPackage
-```
-
-#### 3. License Only (Standard Licenses)
-
-Standard license identifiers continue to work for auto-accepting all packages with those licenses:
-
-```text
-# License-only entries (auto-accept any package with these licenses)
-MIT
-Apache-2.0
-BSD-3-Clause
-```
-
-### Security Comparison
-
-| Format | Security Level | Pros | Cons |
-|--------|---------------|------|------|
-| `packagename license` | **Highest** | Prevents license changes AND file name collisions | Requires maintenance when package versions change license |
-| `packagename` | Medium | Unique package identification | Vulnerable to license changes |
-| `license` | Basic | Simple to maintain | May accept unintended packages with same license file name |
+### Security Benefits
 
-**Recommendation**: Use the combined format (`packagename license`) for maximum security, especially for packages with:
-- Commercial or proprietary licenses
-- Unknown or file-based licenses (`UNKNOWN_FILE_LICENSE`)
-- Packages where license compliance is critical
+The combined format provides the highest security level:
+- **Prevents license changes**: If a whitelisted package changes license, it will be flagged again
+- **Prevents file name collisions**: Generic names like "LICENSE.md" can't accidentally whitelist multiple packages
+- **Unique identification**: Each entry is specific to one package with one license
 
 ### Debug Logging Configuration
 

Philips.CodeAnalysis.SecurityAnalyzers/LicenseAnalyzer.cs

@@ -29,7 +29,7 @@ public class LicenseAnalyzer : DiagnosticAnalyzer
 	{
 		private const string Title = @"Avoid Packages with Unacceptable Licenses";
 		public const string MessageFormat = @"Package '{0}' version '{1}' has an unacceptable license '{2}'. " +
-											 @"Consider adding to Allowed.Licenses.txt if license is acceptable.";
+											 @"Add '{0} {2}' to Allowed.Licenses.txt if this specific package and license combination is acceptable.";
 		private const string Description = @"Packages with unacceptable licenses (e.g., copyleft licenses like GPL) should be " +
 										   @"reviewed before use to ensure compliance with project requirements.";
 
@@ -816,39 +816,22 @@ private bool IsLicenseAcceptable(CompilationAnalysisContext context, string lice
 				return false;
 			}
 
-			// First check if the license itself is acceptable (backward compatibility)
-			var isLicenseAcceptable = allowedLicenses.Contains(license);
-			ReportDebugDiagnostic(context, $"Checking license '{license}' against {allowedLicenses.Count} allowed licenses: {(isLicenseAcceptable ? "FOUND" : "NOT FOUND")}");
-
-			// If license is already acceptable, return true
-			if (isLicenseAcceptable)
+			if (string.IsNullOrEmpty(packageName))
 			{
-				return true;
+				ReportDebugDiagnostic(context, $"Package name is null or empty - not acceptable");
+				return false;
 			}
 
-			// Check for combined package name + license format (new safer approach)
-			// Format: "packagename license" provides both package identity and license verification
-			if (!string.IsNullOrEmpty(packageName))
-			{
-				var combinedEntry = $"{packageName} {license}";
-				var isCombinedEntryAcceptable = allowedLicenses.Contains(combinedEntry);
-				ReportDebugDiagnostic(context, $"Checking combined entry '{combinedEntry}': {(isCombinedEntryAcceptable ? "FOUND" : "NOT FOUND")}");
-
-				if (isCombinedEntryAcceptable)
-				{
-					return true;
-				}
-
-				// Also check if packageName is in the allowed list (backward compatibility)
-				// This handles cases where specific packages need to be whitelisted by name rather than by license
-				// This is safer than checking license file names since package names are unique identifiers
-				var isPackageNameAcceptable = allowedLicenses.Contains(packageName);
-				ReportDebugDiagnostic(context, $"Checking package name '{packageName}': {(isPackageNameAcceptable ? "FOUND" : "NOT FOUND")}");
+			// Check for combined package name + license format: "packagename license"
+			// This provides both package identity and license verification, preventing
+			// both license change vulnerabilities and license file name collisions
+			var combinedEntry = $"{packageName} {license}";
+			var isCombinedEntryAcceptable = allowedLicenses.Contains(combinedEntry);
+			ReportDebugDiagnostic(context, $"Checking combined entry '{combinedEntry}': {(isCombinedEntryAcceptable ? "FOUND" : "NOT FOUND")}");
 
-				if (isPackageNameAcceptable)
-				{
-					return true;
-				}
+			if (isCombinedEntryAcceptable)
+			{
+				return true;
 			}
 
 			// For debugging, show first few allowed licenses to help troubleshoot

Philips.CodeAnalysis.Test/Security/LicenseAnalyzerTest.cs

@@ -1516,10 +1516,9 @@ public void TestMethod()
 		[TestCategory(TestDefinitions.UnitTests)]
 		public void LicenseAnalyzerSupportsCombinedPackageNameAndLicenseFormat()
 		{
-			// Test the new combined format: "packagename license"
+			// Test the combined format: "packagename license"
 			// This provides the safest whitelisting approach by requiring both package identity and license verification
 
-			// Test 1: Combined entry should be more specific than individual entries
 			// A combined entry "Newtonsoft.Json MIT" should only accept Newtonsoft.Json with MIT license
 
 			// This test verifies the parsing and matching logic for combined entries
@@ -1529,10 +1528,10 @@ public void LicenseAnalyzerSupportsCombinedPackageNameAndLicenseFormat()
 			// Test that the format parsing would work correctly
 			var sampleAllowedLicenses = new HashSet<string>(StringComparer.OrdinalIgnoreCase)
 			{
-				"MIT",  // License-only entry (backward compatibility)
-				"Newtonsoft.Json",  // Package-only entry (backward compatibility) 
-				"Microsoft.Extensions.Logging MIT",  // Combined entry - safest approach
-				"SomeCommercialPackage CommercialLicense-V1"  // Combined commercial license
+				"Microsoft.Extensions.Logging MIT",  // Combined entry - only supported format
+				"SomeCommercialPackage CommercialLicense-V1",  // Combined commercial license
+				"Newtonsoft.Json MIT",  // Another combined entry
+				"TestPackage UNKNOWN_FILE_LICENSE"  // Combined entry for file license
 			};
 
 			// Verify that the HashSet contains the expected combined entries
@@ -1591,54 +1590,16 @@ public void LicenseAnalyzerCombinedFormatProvidesBetterSecurity()
 			}
 		}
 
-		[TestMethod]
-		[TestCategory(TestDefinitions.UnitTests)]
-		public void LicenseAnalyzerCombinedFormatBackwardCompatibility()
-		{
-			// Test that the new combined format maintains backward compatibility
-			// with existing license-only and package-only entries
-
-			var mixedAllowedLicenses = new HashSet<string>(StringComparer.OrdinalIgnoreCase)
-			{
-				// Legacy license-only entries (should still work)
-				"MIT",
-				"Apache-2.0",
-				"BSD-3-Clause",
-				
-				// Legacy package-only entries (should still work)
-				"SomeLegacyPackage",
-				"AnotherWhitelistedPackage",
-				
-				// New combined entries (enhanced security)
-				"Newtonsoft.Json MIT",
-				"Microsoft.Extensions.Logging Apache-2.0",
-				"CommercialPackage CommercialLicense-V1"
-			};
-
-			// Verify all formats are preserved in the set
-			Assert.Contains("MIT", mixedAllowedLicenses, "Legacy license-only entries should work");
-			Assert.Contains("SomeLegacyPackage", mixedAllowedLicenses, "Legacy package-only entries should work");
-			Assert.Contains("Newtonsoft.Json MIT", mixedAllowedLicenses, "New combined entries should work");
-
-			// Verify the set has the expected count
-			Assert.HasCount(8, mixedAllowedLicenses, "All entries should be preserved");
-		}
-
 		[TestMethod]
 		[TestCategory(TestDefinitions.UnitTests)]
 		public void LicenseAnalyzerCombinedFormatExamples()
 		{
 			// Test realistic examples of how users would configure Allowed.Licenses.txt
-			// with the new combined format
+			// with the combined format (only supported format)
 
 			var realisticAllowedLicenses = new HashSet<string>(StringComparer.OrdinalIgnoreCase)
 			{
-				// Standard permissive licenses (auto-accepted)
-				"MIT",
-				"Apache-2.0",
-				"BSD-3-Clause",
-				
-				// Specific packages with specific licenses (safest approach)
+				// Specific packages with specific licenses (only supported approach)
 				"Newtonsoft.Json MIT",  // Only accept Newtonsoft.Json if it has MIT
 				"Microsoft.Extensions.Configuration Apache-2.0",  // Only accept if Apache-2.0
 				"EntityFramework Apache-2.0",  // Only accept if Apache-2.0