CycloneDX / CycloneDX/cyclonedx-gradle-plugin

Failing to retrieve licenses

Open
#92 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
239
Forks
102
Avg merge
1d 9h
Merged PRs (30d)
11

Description

Hi,

I've been testing this plugin on a few different Gradle projects that I have locally and it seems the plugin fails to find license information for a large amount of the dependencies of each project. I have looked up a few of the components and can see the license information is on Maven (where the purl says it's from) but in the generated bom the license information is empty i.e. "licenses" : [ ],

An example would be com.google.guava/guava@28.1-jre which has its license information on mvn (https://mvnrepository.com/artifact/com.google.guava/guava/28.1-jre) but the plugin doesn't detect this.

To run the plugin I add the plugin block to the projects build.gradle and then run "./gradlew cyclonedxBom", not sure if I'm missing a vital step!

Contributor guide

Open the contributing guide

Research direction

Start with the plugin block in build.gradle and run ./gradlew cyclonedxBom against the example dependency com.google.guava/guava@28.1-jre. Trace how the plugin obtains Maven license metadata and compare it with the generated BOM, where the licenses array is empty. Done means dependencies with license information on Maven are represented with that information in the BOM.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.