search

CycloneDX / cyclonedx-core-java

CycloneDX SBOM Model and Utils for Creating and Validating BOMs
https://cyclonedx.org/
Apache License 2.0
81 stars 60 forks source link

Add support for SPDX expression resolution #39

Open stevespringett opened 4 years ago

stevespringett commented 4 years ago

SPDX Tools was removed from Java Core v3.0.0 due to introducing a lot of unnecessary dependencies and requiring Internet access by default (could be disabled via system property: SPDXParser.OnlyUseLocalLicenses).

Since the removal of SPDX Tools, CycloneDX Java Core had to implement the SPDX license list (json) as well as license text from the SPDX project. This enhancement request is to add support for SPDX license expressions, which is no longer possible in v3.0.0, back into this library.

There's a potential to introduce a standalone library that provides all of this functionality - similar to SPDX Tools - but without all the extras that go along with it. Possibly similar to https://github.com/nexB/license-expression

sschuberth commented 3 years ago

You might also want to consider ORT's SPDX expression library at https://github.com/oss-review-toolkit/ort/tree/master/spdx-utils. Currently, no separate binary artifacts are published for this, but if you're interested we could do that.

sschuberth commented 6 months ago

Currently, no separate binary artifacts are published for this, but if you're interested we could do that.

By now the library is published at https://mvnrepository.com/artifact/org.ossreviewtoolkit.utils/spdx-utils.