CycloneDX / CycloneDX/cyclonedx-gomod
Add licenses from internal libraries on private repositories like gitlab
- Dominant language
- Go
- Stars
- 187
- Forks
- 40
- Avg merge
- 1d 7h
- Merged PRs (30d)
- 14
Description
Thanks for cyclonedx-gomod! 😄
The tool works well for open-source dependencies, but we're experiencing some issues when using it with internal project libraries.
Our setup:
- We use internal libraries from a private GitLab instance
- GOPATH contains the related packages
When running:
```bash
cyclonedx-gomod mod -assert-licenses -json -licenses -output-version 1.6 -output sbom.json
```
We observe warnings that no licenses are detected for our internal libraries from the private GitLab instance. However, we can see the license files (LICENSE.md) in the GOPATH for these packages.
Expected behavior:
- License files should be identified for internal libraries
- For non-standard licenses (unlike Apache 2.0), the license name and content should be added in base64 format
I plan to share this feedback with the community since I believe other users might face similar issues when working with internal libraries in their projects.
Contributor guide
Research direction
Start by reproducing the cyclonedx-gomod mod command with packages from the private GitLab instance, then inspect the related GOPATH entries and their LICENSE.md files. Done means internal library licenses are detected in the generated SBOM, with non-standard license names and base64-encoded content included.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- gitlab, go
- Domain
- tooling
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100