re: #404 (comment)

The first idea was to integrate this feature in the downstream project. Later we come up with some thoughts, which brought us to the implementation in the library

The fields name and url are filled by the CoponentBuilder of the library, why not fill the license texts.

There is no standard to bring the license texts into a npm package, but it is very common to use a file in the root directory of a npm package with a file name like LICENSE or License.txt.

Current component builder follows NPM's JSON schema and specifications.
For licenses, the NPM standards are already implemented.

For license file detection, there are no standards, just opinions.
Furthermore, each license text may use/allow additional rules. Like, Apache license allows a NOTICE file besides the actual license texts, which might include additions.

It was available in the forerunner package @cyclonedx/bom@~2.0.0

True. Therefore, CycloneDX/cyclonedx-node-npm#256 was raised.

The feature is time and memory consuming, so it should be decided by the user to fill the license field or not

Full acknowledgement.
Packing hundreds of megabytes into memory might not be desired by all users.
I was thinking about this issue earlier, when CycloneDX/cyclonedx-node-npm#256 was requested.
My idea was to change the Attachment data models to accept not only strings for content, but also streams and buffers. This way the memory footprint would not be this large unless the data was actually needed.
I created #406, as I understand your need for proper text attachments.

We found no way to get the local path from the library to the npm component to do it outside the library

Why is that?
Could you not patch your downstream product in a way that it adds the proper licenses right after calling Builders.FromNodePackageJson.ComponentBuilder.makeComponent() returned the component? You should have the needed data(package-object/paths/...) on hand already, as you require them to call the method in the first place, right?

Uh oh!

feat: license texts detection from NPM package description #404

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions