bom Include license list in distribution

What would you like to be added:

The SPDX license list should be included with the bom distribution to avoid downloading it.

Why is this needed:

On first run, bom will download the SPDX license list. When generating a quick SBOM from a cold start like this the license download can be a bit cumbersome. It can also lead to a CI/CD failure when running bom in a pipeline.

I think we should exploring compiling the license list into a distributable form (a tarball or similar) and shipping it with the binary. I think using go embed could be the way to go to do this.

Jan 29 '22 02:01 puerco

I can take care of that one. Would you mind assigning it to me?

Mar 14 '22 05:03 developer-guy

@puerco https://github.com/spdx/license-list-data

Mar 14 '22 08:03 developer-guy

https://github.com/google/licensecheck

Mar 14 '22 08:03 developer-guy

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Mark this issue or PR as fresh with /remove-lifecycle stale
Mark this issue or PR as rotten with /lifecycle rotten
Close this issue or PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

Jun 13 '22 16:06 k8s-triage-robot

/remove-lifecycle stale

Jun 13 '22 16:06 puerco

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Mark this issue or PR as fresh with /remove-lifecycle stale
Mark this issue or PR as rotten with /lifecycle rotten
Close this issue or PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

Sep 11 '22 16:09 k8s-triage-robot

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Mark this issue or PR as fresh with /remove-lifecycle rotten
Close this issue or PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

Oct 11 '22 17:10 k8s-triage-robot

/remove-lifecycle rotten

Nov 07 '22 04:11 puerco

/assign

Nov 07 '22 05:11 sbs2001

@developer-guy I'd like to take a shot at this, if that's cool with you.

Nov 07 '22 05:11 sbs2001

Awesome, go for it! :tada:

Nov 07 '22 05:11 puerco

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Mark this issue or PR as fresh with /remove-lifecycle stale
Mark this issue or PR as rotten with /lifecycle rotten
Close this issue or PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

Feb 05 '23 06:02 k8s-triage-robot

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Mark this issue as fresh with /remove-lifecycle rotten
Close this issue with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

Mar 07 '23 06:03 k8s-triage-robot

/remove-lifecycle rotten

Mar 15 '23 00:03 puerco