CycloneDX / CycloneDX/bom-examples
Example for license texts
- Dominant language
- No language data
- Stars
- 238
- Forks
- 83
- PR merge metrics
- No merged PRs in 30d
Description
The CyclonDX specification allows to add the text of a license
1. since 1.2 directly in the [license](https://cyclonedx.org/docs/1.2/json/#components_items_licenses_items_license_text)
2. since 1.3 as [evidence](https://cyclonedx.org/docs/1.3/json/#components_items_evidence_licenses)
Unfortunately there is no example of this in the bom-examples repository.
Another topic I wanted to bring up here (don't know where to address it otherwise) is the implementation in the various projects. The generators are not working consistent, and most miss the option to configure if the license-text should be added **directly to the license** or if it should be added as **evidence**.
I will give an overview here
| project | inserted as |
| ------------- | ------------- |
| cyclonedx-gomod | ? |
| cyclonedx-maven-plugin | license |
| cyclonedx-node-yarn | evidence |
| cyclonedx-node-npm | evidence |
| cyclonedx-webpack-plugin | evidence |
| cyclonedx-python | license and/or evidence |
| to be continued | .. |
*) the list was adjusted, extended and updated my the CycloneDX-CWG/maintainers
Contributor guide
Assessment
This issue has not been assessed yet.