Skip to content

Conversation

@mering
Copy link
Contributor

@mering mering commented Sep 14, 2023

Add tool to expand the JSON with the actual license text.

This allows copying a self-containing JSON with all relevant information to some other machine or tool without access to Bazel for further processing (e.g. embedding it into an app or other frontend, posting it to legal for review, ...).

This is currently based on top of #116

@aiuto
Copy link
Collaborator

aiuto commented Oct 17, 2023

Can you put a high level overview of the intent in the PR description.
It seems this is on the right track, but it's hard to say without a clear goal.

@mering
Copy link
Contributor Author

mering commented Oct 17, 2023

Can you put a high level overview of the intent in the PR description. It seems this is on the right track, but it's hard to say without a clear goal.

Sure, done.

@aiuto
Copy link
Collaborator

aiuto commented Oct 19, 2023

I like the general idea, but I think we should tweak it a bit and not do it early, but rather do it at SBOM generation time.
That is,

  • produce raw graph data with paths in it
  • sbom generator pulls in raw package data and adds license text while generating the SBOM

I've got to run for a while, but I'll take a deeper look tonight.

@aiuto aiuto added the P1 label Oct 26, 2023
@mering
Copy link
Contributor Author

mering commented Nov 13, 2023

Isn't what you are describing already the case currently?

Maybe rules_license should provide different SBOM formats out of the box (txt, json, html, ...)? Maybe all of them could use the same SBOM generator but providing different templates?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants