CycloneDX / CycloneDX/cyclonedx-gradle-plugin
Failing to retrieve licenses
- Dominant language
- Java
- Stars
- 239
- Forks
- 102
- Avg merge
- 1d 9h
- Merged PRs (30d)
- 11
Description
Hi,
I've been testing this plugin on a few different Gradle projects that I have locally and it seems the plugin fails to find license information for a large amount of the dependencies of each project. I have looked up a few of the components and can see the license information is on Maven (where the purl says it's from) but in the generated bom the license information is empty i.e. "licenses" : [ ],
An example would be com.google.guava/guava@28.1-jre which has its license information on mvn (https://mvnrepository.com/artifact/com.google.guava/guava/28.1-jre) but the plugin doesn't detect this.
To run the plugin I add the plugin block to the projects build.gradle and then run "./gradlew cyclonedxBom", not sure if I'm missing a vital step!
Contributor guide
Research direction
Start with the plugin block in build.gradle and run ./gradlew cyclonedxBom against the example dependency com.google.guava/guava@28.1-jre. Trace how the plugin obtains Maven license metadata and compare it with the generated BOM, where the licenses array is empty. Done means dependencies with license information on Maven are represented with that information in the BOM.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100