Find license by embedded license text

[coheigea]

For Java archives, we have the option of retrieving licenses either directly from the META-INF/MANIFEST.MF if Bundle-License is defined (OSGi) or from the pom.xml if it's build with Maven (#2115). However many projects are built with Gradle and are not OSGi bundles. Instead, these projects typically might include a license in the META-INF directory (for example the Spring framework includes the ASLv2 in META-INF/license.txt).

So what I'd like to do would be for Java archives to check for either a LICENSE or LICENSE.txt (case insensitive) in either the root directory or in META-INF and parse it for a license. I'm happy to contribute this - but do we have any existing code which can detect what license is in a license text file?

[kzantow]

Hi @coheigea -- take a look at the Go cataloger: https://github.com/anchore/syft/blob/main/syft/pkg/cataloger/golang/licenses.go#L178 how we parse text files to identify the appropriate license

[coheigea]

Thanks @kzantow that's helpful, I got something working locally. I'll wait for contributing it until @spiffcs has updated #2115