Repository navigation
feat: SPDX license instead of expression #378
Description
BASED ON Discussed in #377
have a feature switch, that causes the output to change in behaviour:
instead of
<?xml version="1.0" encoding="UTF-8"?>
<bom xmlns="http://cyclonedx.org/schema/bom/1.4"
serialNumber="urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79"
version="1">
<components>
<component type="library">
<group>org.acme</group>
<name>card-verifier</name>
<version>1.0.2</version>
<licenses>
<expression>(Apache-2.0 OR MIT)</expression>
</licenses>
</component>
</components>
</bom>the output should look like this:
<?xml version="1.0" encoding="UTF-8"?>
<bom xmlns="http://cyclonedx.org/schema/bom/1.4"
serialNumber="urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79"
version="1">
<components>
<component type="library">
<group>org.acme</group>
<name>card-verifier</name>
<version>1.0.2</version>
<licenses>
<license>
<id>Apache-2.0</id>
</license>
<license>
<id>MIT</id>
</license>
</licenses>
</component>
</components>
</bom>Reacted by albert0815 and Michael Macnair
Activity
[-]SPDX license instead of expression[/-][+]feat: SPDX license instead of expression[/+]madpah commentedon Jun 27, 2022
Duplicates #354
jkowalleck commentedon Sep 12, 2022
discussed the topic with @madpah , and we think we will prefer ad different solution:
we will take the opportunity and create a factory in the cyclonedx-python-lib via CycloneDX/cyclonedx-python-lib#304
that accepts any string and will create the fitting license model from it - an expression, a named, or an SPDX one.
jkowalleck commentedon Sep 19, 2022
might be closed via #417
jkowalleck commentedon Dec 25, 2023
fixed by #605
jkowalleck commentedon Dec 25, 2023
This feature will be part of the next/upcoming major release.
Changelog: see #605
Install via:
pip install cyclonedx-bom==4.0.0rc1