CycloneDX / CycloneDX/cyclonedx-core-java

Add support for SPDX expression resolution

未关闭
#39 2 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
enhancement
主要语言
Java
星标
120
派生
90
平均合并
12 小时 43 分钟
30 天内合并 PR
18

描述

SPDX Tools was removed from Java Core v3.0.0 due to introducing a lot of unnecessary dependencies and requiring Internet access by default (could be disabled via system property: SPDXParser.OnlyUseLocalLicenses).

Since the removal of SPDX Tools, CycloneDX Java Core had to implement the SPDX license list (json) as well as license text from the SPDX project. This enhancement request is to add support for SPDX license expressions, which is no longer possible in v3.0.0, back into this library.

There's a potential to introduce a standalone library that provides all of this functionality - similar to SPDX Tools - but without all the extras that go along with it. Possibly similar to https://github.com/nexB/license-expression

贡献指南

打开贡献指南

调研方向

该 issue 未指定任何文件、测试或入口点。首先检查 CycloneDX Java Core 中当前的 SPDX license-list 和 license-text 实现,然后将所需的表达式行为与 SPDX Tools 或 license-expression 进行比较。当 SPDX 许可证表达式能够解析,且无需恢复已移除的不必要依赖或默认 Internet 访问时,即视为完成。

由索引模型根据 Issue 内容生成。

评估

技术栈
java
领域
backend-api-design
Issue 类型
功能
难度
5/5
预计耗时
一周以上
活跃度
停滞
描述清晰度
需要澄清
新手友好度
25/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。