Add complete license text to the cyclonedx-file?

[andife]

Hi,
I need to add to each package the complete license text that was supplied and not just the license name. Does anyone else have this requirement or already implemented it?

[jkowalleck]

what is the expected outcome?
Do you need license evidence - like the actual license text(s) of each package,
or do you need the license text template for well-knwon SPDX licens IDs - like from MIT license https://opensource.org/license/MIT/?

[andife]

Thank you for the answer!

I am not 100% sure if I understood the question correctly. I mean also alone with the license specification "Apache 2.0" I don't know if e.g. the Part "Copyright [yyyy] [name of copyright owner]" was filled in or not.

Because of our internal regulation I have to include the license information in the cyclondx file.

If no LICENSE.txt file was delivered, I don't know if this can happen with wheels in pip, one could also specify this. (https://wheel.readthedocs.io/en/stable/user_guide.html?highlight=license_files#including-license-files-in-the-generated-wheel-file).

I would guess sooner or later a commandline tool will be needed which post-processes the output in e.g. json of cyclone-dx by updating individual elements?

If this should not be an option to integrate something like this into the software sooner or later. Is there another tool for python (pip), which has such functionality already integrated.

[jkowalleck]

You should first find and define your proper requirements and acceptance criteria,
then think of a general/broader case,
and then file a feature request here: https://github.com/CycloneDX/cyclonedx-python/issues/new
keep in mind: a feature needs an on/off switch, and a clear described expected outcome.
When writing a feature request, be not specific to technical aspects, and do not think about feasibility. Be goal-centric: where should the data be originated from and where should it end up in the CycloneDX SBOM document.

here are examples for similar requests:

• FEAT: Option to add license text to SBOM result cyclonedx-node-npm#256
• to be continued

[jkowalleck]

see #570