Add licenses from internal libraries on private repositories like gitlab

[fotto1]

Thanks for cyclonedx-gomod! 😄

The tool works well for open-source dependencies, but we're experiencing some issues when using it with internal project libraries.

Our setup:

• We use internal libraries from a private GitLab instance
• GOPATH contains the related packages

When running:

cyclonedx-gomod mod -assert-licenses -json -licenses -output-version 1.6 -output sbom.json

We observe warnings that no licenses are detected for our internal libraries from the private GitLab instance. However, we can see the license files (LICENSE.md) in the GOPATH for these packages.

Expected behavior:

• License files should be identified for internal libraries
• For non-standard licenses (unlike Apache 2.0), the license name and content should be added in base64 format

I plan to share this feedback with the community since I believe other users might face similar issues when working with internal libraries in their projects.

[nscuro]

For standard licenses not being detected, is it that the files are not recognized at all, or that detection confidence is too low?

You can confirm the latter by passing the -verbose flag and observing the output for messages like this:

cyclonedx-gomod/pkg/licensedetect/local/detector.go

Lines 88 to 93 in 7a093d9

	d.logger.Debug().
	Str("module", fmt.Sprintf("%s@%s", path, version)).
	Str("license", detectedLicense).
	Float32("confidence", detectedLicenseConfidence).
	Float32("minConfidence", minDetectionConfidence).
	Msg("detection confidence for license is too low")

[fotto1]

For standard licenses not being detected, is it that the files are not recognized at all, or that detection confidence is too low?

@nscuro I spent time on debugging. Files are recognized over vendor directory. But it seems that the custom license get not recognized by the underlying go-license-validator see https://github.com/go-enry/go-license-detector/blob/v4.3.0/licensedb/licensedb.go#L41

If license is not part of license db its skipped.

You can confirm the latter by passing the -verbose flag and observing the output for messages like this:

cyclonedx-gomod/pkg/licensedetect/local/detector.go

Lines 88 to 93 in 7a093d9

d.logger.Debug().
Str("module", fmt.Sprintf("%s@%s", path, version)).
Str("license", detectedLicense).
Float32("confidence", detectedLicenseConfidence).
Float32("minConfidence", minDetectionConfidence).
Msg("detection confidence for license is too low")

3:42PM DBG converting module to component module=<server-name>/<namespace>/<project-name>.git@v1.0.4
3:42PM WRN no licenses detected module=<server-name>/<namespace>/<project-name>@v1.0.4