Licenses not reported along with list of libraries

[jmvaswani]

Hey, I think it would be really great if it were possible to list out the licenses of each package as well, It is supported in the CycloneDX BOM format and there are ways to obtain the licenses using the package name like shown here : https://pypi.org/project/pip-licenses/ Just one issue that I see here is if the package is not installed, then it could be troublesome.

[madpah]

Thanks for the suggestion @jmvaswani - we'll take a look and come back shortly.

[madpah]

@jmvaswani - we've added support for licenses when using the Environment as a the parser source.

New release should be available in a few minutes.

Please let us know if this doesn't solve your request.

[jmvaswani]

Thanks for the speedy update! However I am facing an issue while generating the bom file from environment.
It works fine while generating from a requirements.txt, but not an environment
Here is the stacktrace for the command "cyclonedx-py -e -o output.json --format json"

Traceback (most recent call last):
File "/home/jai/.local/bin/cyclonedx-py", line 8, in
sys.exit(main())
File "/home/jai/.local/lib/python3.8/site-packages/cyclonedx_py/client.py", line 232, in main
CycloneDxCmd(args).execute()
File "/home/jai/.local/lib/python3.8/site-packages/cyclonedx_py/client.py", line 87, in execute
output = self.get_output()
File "/home/jai/.local/lib/python3.8/site-packages/cyclonedx_py/client.py", line 51, in get_output
parser = self._get_input_parser()
File "/home/jai/.local/lib/python3.8/site-packages/cyclonedx_py/client.py", line 195, in _get_input_parser
return EnvironmentParser()
File "/home/jai/.local/lib/python3.8/site-packages/cyclonedx/parser/environment.py", line 66, in init
for classifier in i_metadata.get_all('Classifier'):
TypeError: 'NoneType' object is not iterable

Please do let me know if I am doing anything wrong or missing out on any info

[madpah]

Thanks @jmvaswani - will take a look and update shortly.

[madpah]

@jmvaswani - can you check again please with 0.9.1?

[jmvaswani]

I apologize I'm not too sure what you mean. I tried using pip to install version 0.9.1 but it failed

ERROR: Could not find a version that satisfies the requirement cyclonedx-bom==0.9.1 (from versions: 0.1.0, 0.2.0, 0.3.0, 0.3.1, 0.3.2, 0.3.3, 0.3.4, 0.3.5, 0.4.0, 0.4.1, 0.4.2, 0.4.3, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.1.0, 1.2.0, 1.3.0)
ERROR: No matching distribution found for cyclonedx-bom==0.9.1

[madpah]

My apologises @jmvaswani - I jumped the gun.

The core functionality lives in a library (which is where the fix was needed, and that was just built and released as 0.9.1).

Just re-building and publishing this main app (which should get 1.3.1). Should be there now: https://pypi.org/project/cyclonedx-bom/1.3.1/.

Too many plates spinning :-)

[jmvaswani]

No issues, it works perfectly now, thanks a lot!

[madpah]

Good news - thanks for confirming @jmvaswani !