How to add license information?

[rdg]

I would like the sbom to contain the license information of the components.
I am not sure how to achieve that, the field is always empty - though pip-licenses shows the the licenses.
What is the recommended way to add the license information via cyclonedx-python?
Thank you for any hint or pointers!

[rdg]

oh - reading the release notes - looks like this only works if I use the -e flag?

[jkowalleck]

feel free to pull request documentation improvements.
the docs from https://github.com/CycloneDX/cyclonedx-python/tree/master/docs
get rendered to https://cyclonedx-bom-tool.readthedocs.io/en/latest/

[rdg]

To be fair - if I had scrolled down to the table I had seen this way earlier.
Thank you for this tool - I really like it!

[thbeu]

oh - reading the release notes - looks like this only works if I use the -e flag?

When asking for license information, we have the dilemma, that by using the -e flag all components of the environment are considered - including the one from cyclone-dx itself. I rather was expecting to only find the explicit components passed by the requirements input file. Hence, why is the input requirements file not considered as filter criterion?

Thank you!

[andy778]

Same challenge here, if one pick up all from pip it's much more than what the application have from requirements.txt
Or should one do some hack here
First generate a SBOM from -e and then and SBOM from -r. After that make a tool or something that lookups license info from -e SBOM file and appends licence data to -r SBOM file.

It's not a full merge, but only for the keys/components found in -r SBOM

[thbeu]

There now is #435 for this topic - including my proposed patch.