CycloneDX / CycloneDX/bom-examples

Example for license texts

Open
#53 1 comment 0 reactions 0 assignees View on GitHub
help wanted
Dominant language
No language data
Stars
238
Forks
83
PR merge metrics
No merged PRs in 30d

Description

The CyclonDX specification allows to add the text of a license

1. since 1.2 directly in the [license](https://cyclonedx.org/docs/1.2/json/#components_items_licenses_items_license_text)
2. since 1.3 as [evidence](https://cyclonedx.org/docs/1.3/json/#components_items_evidence_licenses)

Unfortunately there is no example of this in the bom-examples repository.

Another topic I wanted to bring up here (don't know where to address it otherwise) is the implementation in the various projects. The generators are not working consistent, and most miss the option to configure if the license-text should be added **directly to the license** or if it should be added as **evidence**.

I will give an overview here

| project | inserted as |
| ------------- | ------------- |
| cyclonedx-gomod | ? |
| cyclonedx-maven-plugin | license |
| cyclonedx-node-yarn | evidence |
| cyclonedx-node-npm | evidence |
| cyclonedx-webpack-plugin | evidence |
| cyclonedx-python | license and/or evidence |
| to be continued | .. |

*) the list was adjusted, extended and updated my the CycloneDX-CWG/maintainers

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.