CycloneDX
Feature: License overrides
Basically a copy of the feature that spdx-maven-plugin has.
Some components have misspelled license names, which causes problems down the line.
Coming from SPDX to CycloneDX, we would love to have such a feature, too.
@jakub-bochenski As a (dirty) workaround, we use a script executed after the SBOM generation that modifies the licenses section of components based on their purl according to our rules.
@jakub-bochenski As a (dirty) workaround, we use a script executed after the SBOM generation that modifies the licenses section of components based on their purl according to our rules.
Yes, I do the same thing
BTW @spfeiffer-iem what you can also do is fork https://github.com/CycloneDX/cyclonedx-core-java/blob/master/src/main/resources/license-mapping.json and add you own mappings, then use it like https://github.com/jakub-bochenski/example-cyclonedx-core-java/blob/master/pom.xml#L51-L61
It's cleaner if you are only on Maven, but won't handle cases where license is missing completely
"Some components have misspelled license names, which causes problems down the line."
Some components have no license at all, which also causes problems down the line. So that feature would be really helpful...
