Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

FEAT: Option to add copyright to SBOM result #1310

Open
Frozen-byte opened this issue Oct 4, 2024 · 2 comments · May be fixed by #1338
Open

FEAT: Option to add copyright to SBOM result #1310

Frozen-byte opened this issue Oct 4, 2024 · 2 comments · May be fixed by #1338
Assignees
@Frozen-byte
Labels
enhancement New feature or request help wanted Extra attention is needed

Comments

@Frozen-byte
Copy link
Contributor

Is your feature request related to a problem? Please describe.

For legal documentation, I need the copyright holder for components.

Describe the solution you'd like

An option to enable integration of the copyright holder

Additional context

from discussion #1309 (comment)

For this feature it is necessary to scan the license-text for a copyright notice. This is already done by the license-scanner written in go and may become handy while implementing.
@Frozen-byte Frozen-byte added the enhancement New feature or request label Oct 4, 2024
@Frozen-byte Frozen-byte mentioned this issue Oct 4, 2024
Merged
@Frozen-byte
Copy link
Contributor Author

I want to implement this feature.

My plan is to include checking for copyright evidences to the collectEvidence option.

Any Legal stuff I need to know for attaching a proper evidence?

I would scan LICENSE and NOTICE like files for a line that starts with copyright and add this Line as an evidence.
Some smart filtering that will exclude false positives from i.E. Apache 2.0 licenses that include lines starting with "copyright".
I do not know if it's necessary to check every file, sometimes binaries/sources also have a copyright included as a header.

@jkowalleck jkowalleck mentioned this issue Oct 7, 2024
Merged
jkowalleck added a commit that referenced this issue Oct 8, 2024
@jkowalleck
fix: pollish evidence gathering (#1312)
8eb1cba 
followup of #1309

- fixed some false-positives for license evidences.
- refactored some functionality, so that it is much easier to add #1310
later

Signed-off-by: Jan Kowalleck <[email protected]>
@jkowalleck jkowalleck changed the title FEAT: Option to add copyright to BOM output FEAT: Option to add copyright to SBOM result Oct 8, 2024
@jkowalleck jkowalleck added the help wanted Extra attention is needed label Oct 23, 2024
@jkowalleck
Copy link
Member

jkowalleck commented Oct 23, 2024 •
edited
Loading

I want to implement this feature.

I've assigned the ticket to you and flagged it as "need help" to signal that others are welcome to participate and discuss.

Any Legal stuff I need to know for attaching a proper evidence?

Basically nothing. I'd suggest connecting with other pears from the CycloneDX community and discuss expectations and requirements.

I would expect this feature to be discussed on a broader basis, not webpack-only, and implemented dedicated to webpack, then. You may go with a minimal-viable-product approach at first, and follow with improvements via additional pull requests later.

Please join the community slack (invite) to find others and experts in the field.

Frozen-byte added a commit to Frozen-byte/cyclonedx-webpack-plugin that referenced this issue Dec 3, 2024
@Frozen-byte
feat(Extractor): add copyright to evidence collection
84c258a 
closes: CycloneDX#1310
Signed-off-by: frozen_byte <[email protected]>
@Frozen-byte Frozen-byte linked a pull request Dec 3, 2024 that will close this issue
Draft
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@Frozen-byte Frozen-byte

Labels
enhancement New feature or request help wanted Extra attention is needed
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

feat: add copyright to evidence collection Frozen-byte/cyclonedx-webpack-plugin
2 participants
@jkowalleck @Frozen-byte