CycloneDX / CycloneDX/cyclonedx-gomod

Add licenses from internal libraries on private repositories like gitlab

Open
#645 2 comments 5 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
187
Forks
40
Avg merge
1d 7h
Merged PRs (30d)
14

Description

Thanks for cyclonedx-gomod! 😄

The tool works well for open-source dependencies, but we're experiencing some issues when using it with internal project libraries.

Our setup:

- We use internal libraries from a private GitLab instance
- GOPATH contains the related packages

When running:
```bash
cyclonedx-gomod mod -assert-licenses -json -licenses -output-version 1.6 -output sbom.json
```

We observe warnings that no licenses are detected for our internal libraries from the private GitLab instance. However, we can see the license files (LICENSE.md) in the GOPATH for these packages.

Expected behavior:

- License files should be identified for internal libraries
- For non-standard licenses (unlike Apache 2.0), the license name and content should be added in base64 format

I plan to share this feedback with the community since I believe other users might face similar issues when working with internal libraries in their projects.

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the cyclonedx-gomod mod command with packages from the private GitLab instance, then inspect the related GOPATH entries and their LICENSE.md files. Done means internal library licenses are detected in the generated SBOM, with non-standard license names and base64-encoded content included.

Written by the indexing model from the issue text.

Assessment

Tech stack
gitlab, go
Domain
tooling
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.