feat: Add license text as evidence

README.md

@@ -98,6 +98,8 @@ Options:
   --output-reproducible     Whether to go the extra mile and make the output reproducible.
                             This requires more resources, and might result in loss of time- and random-based-values.
                             (env: BOM_REPRODUCIBLE)
+  --gather-license-texts    Search for license files in components and include them as license evidence.
+                            This feature is experimental. (default: false)
   --output-format <format>  Which output format to use.
                             (choices: "JSON", "XML", default: "JSON")
   --output-file <file>      Path to the output file.

src/_helpers.ts

@@ -56,3 +56,18 @@ export function tryRemoveSecretsFromUrl (url: string): string {
     return url
   }
 }
+
+export const LICENSE_FILENAME_PATTERN = /^(?:UN)?LICEN[CS]E|.\.LICEN[CS]E$|^NOTICE$/i
+export const LICENSE_FILENAME_BASE = new Set(['licence', 'license'])
+export const LICENSE_FILENAME_EXT = new Set(['.apache', '.bsd', '.gpl', '.mit'])
+export const MAP_TEXT_EXTENSION_MIME = new Map([
+  ['', 'text/plain'],
+  ['.htm', 'text/html'],
+  ['.html', 'text/html'],
+  ['.md', 'text/markdown'],
+  ['.txt', 'text/plain'],
+  ['.rst', 'text/prs.fallenstein.rst'],
+  ['.xml', 'text/xml'],
+  ['.license', 'text/plain'],
+  ['.licence', 'text/plain']
+])

src/builders.ts

@@ -18,11 +18,18 @@ Copyright (c) OWASP Foundation. All Rights Reserved.
 */
 
 import { type Builders, Enums, type Factories, Models, Utils } from '@cyclonedx/cyclonedx-library'
-import { existsSync } from 'fs'
+import { existsSync, readdirSync, readFileSync } from 'fs'
 import * as normalizePackageData from 'normalize-package-data'
 import * as path from 'path'
-
-import { isString, loadJsonFile, tryRemoveSecretsFromUrl } from './_helpers'
+import { join, parse } from 'path'
+
+import {
+  isString,
+  LICENSE_FILENAME_BASE, LICENSE_FILENAME_EXT,
+  LICENSE_FILENAME_PATTERN,
+  loadJsonFile, MAP_TEXT_EXTENSION_MIME,
+  tryRemoveSecretsFromUrl
+} from './_helpers'
 import { makeNpmRunner, type runFunc } from './npmRunner'
 import { PropertyNames, PropertyValueBool } from './properties'
 import { versionCompare } from './versionCompare'
@@ -37,6 +44,7 @@ interface BomBuilderOptions {
   reproducible?: BomBuilder['reproducible']
   flattenComponents?: BomBuilder['flattenComponents']
   shortPURLs?: BomBuilder['shortPURLs']
+  gatherLicenseTexts?: BomBuilder['gatherLicenseTexts']
 }
 
 type cPath = string
@@ -47,6 +55,7 @@ export class BomBuilder {
   componentBuilder: Builders.FromNodePackageJson.ComponentBuilder
   treeBuilder: TreeBuilder
   purlFactory: Factories.FromNodePackageJson.PackageUrlFactory
+  licenseFetcher: LicenseFetcher
 
   ignoreNpmErrors: boolean
 
@@ -56,6 +65,7 @@ export class BomBuilder {
   reproducible: boolean
   flattenComponents: boolean
   shortPURLs: boolean
+  gatherLicenseTexts: boolean
 
   console: Console
 
@@ -71,6 +81,7 @@ export class BomBuilder {
     this.componentBuilder = componentBuilder
     this.treeBuilder = treeBuilder
     this.purlFactory = purlFactory
+    this.licenseFetcher = new LicenseFetcher()
 
     this.ignoreNpmErrors = options.ignoreNpmErrors ?? false
     this.metaComponentType = options.metaComponentType ?? Enums.ComponentType.Library
@@ -79,6 +90,7 @@ export class BomBuilder {
     this.reproducible = options.reproducible ?? false
     this.flattenComponents = options.flattenComponents ?? false
     this.shortPURLs = options.shortPURLs ?? false
+    this.gatherLicenseTexts = options.gatherLicenseTexts ?? false
 
     this.console = console_
   }
@@ -465,6 +477,23 @@ export class BomBuilder {
       l.acknowledgement = Enums.LicenseAcknowledgement.Declared
     })
 
+    if (this.gatherLicenseTexts) {
+      if (this.packageLockOnly) {
+        this.console.warn('WARN  | Adding license text is ignored (package-lock-only is configured!) for %j', data.name)
+      } else {
+        component.evidence = new Models.ComponentEvidence()
+        for (const license of this.licenseFetcher.fetchLicenseEvidence(data?.path as string)) {
+          if (license != null) {
+            // only create a evidence if a license attachment is found
+            if (component.evidence == null) {
+              component.evidence = new Models.ComponentEvidence()
+            }
+            component.evidence.licenses.add(license)
+          }
+        }
+      }
+    }
+
     if (isOptional || isDevOptional) {
       component.scope = Enums.ComponentScope.Optional
     }
@@ -668,3 +697,39 @@ export class TreeBuilder {
 const structuredClonePolyfill: <T>(value: T) => T = typeof structuredClone === 'function'
   ? structuredClone
   : function (value) { return JSON.parse(JSON.stringify(value)) }
+
+export class LicenseFetcher {
+  * fetchLicenseEvidence (path: string): Generator<Models.License | null, void, void> {
+    const files = readdirSync(path)
+    for (const file of files) {
+      if (!LICENSE_FILENAME_PATTERN.test(file)) {
+        continue
+      }
+
+      const contentType = this.getMimeForLicenseFile(file)
+      if (contentType === undefined) {
+        continue
+      }
+
+      const fp = join(path, file)
+      yield new Models.NamedLicense(
+        `file: ${file}`,
+        {
+          text: new Models.Attachment(
+            readFileSync(fp).toString('base64'),
+            {
+              contentType,
+              encoding: Enums.AttachmentEncoding.Base64
+            }
+          )
+        })
+    }
+  }
+
+  private getMimeForLicenseFile (filename: string): string | undefined {
+    const { name, ext } = parse(filename.toLowerCase())
+    return LICENSE_FILENAME_BASE.has(name) && LICENSE_FILENAME_EXT.has(ext)
+      ? 'text/plain'
+      : MAP_TEXT_EXTENSION_MIME.get(ext)
+  }
+}

src/cli.ts

@@ -47,6 +47,7 @@ interface CommandOptions {
   flattenComponents: boolean
   shortPURLs: boolean
   outputReproducible: boolean
+  gatherLicenseTexts: boolean
   outputFormat: OutputFormat
   outputFile: string
   validate: boolean | undefined
@@ -115,6 +116,12 @@ function makeCommand (process: NodeJS.Process): Command {
     ).env(
       'BOM_REPRODUCIBLE'
     )
+  ).addOption(
+    new Option(
+      '--gather-license-texts',
+      'Search for license files in components and include them as license evidence.\n' +
+      'This feature is experimental. (default: false)'
+    ).default(false)
   ).addOption(
     (function () {
       const o = new Option(
@@ -249,7 +256,8 @@ export async function run (process: NodeJS.Process): Promise<number> {
       omitDependencyTypes: options.omit,
       reproducible: options.outputReproducible,
       flattenComponents: options.flattenComponents,
-      shortPURLs: options.shortPURLs
+      shortPURLs: options.shortPURLs,
+      gatherLicenseTexts: options.gatherLicenseTexts
     },
     myConsole
   ).buildFromProjectDir(projectDir, process)