@trustify-da/trustify-da-javascript-client 0.3.0-ea.62f6bc7 → 0.3.0-ea.6549d2a

package/dist/src/license/licenses_api.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Fetch license details by SPDX identifier from the backend GET /api/v5/licenses/{spdx}.
+ * Returns detailed information about a specific license including category, name, and text.
+ *
+ * @param {string} spdxId - SPDX identifier (e.g., "Apache-2.0", "MIT")
+ * @param {import('../index.js').Options} [opts={}] - options (proxy, token, TRUSTIFY_DA_BACKEND_URL, etc.)
+ * @returns {Promise<Object|null>} License details or null if not found
+ */
+export function getLicenseDetails(spdxId: string, opts?: import("../index.js").Options): Promise<any | null>;
+/**
+ * Normalize the LicensesResponse shape (array of LicenseProviderResult) into a map of purl -> license info.
+ * Each provider result has { status, summary, packages } where packages is { [purl]: { concluded, evidence } }.
+ * We merge the first successful provider's packages; concluded has identifiers[], category (PERMISSIVE | WEAK_COPYLEFT | STRONG_COPYLEFT | UNKNOWN).
+ *
+ * @param {unknown} data - LicensesResponse (array) or analysis report's licenses field
+ * @param {string[]} [purls] - optional list of purls to restrict to (for consistency with getLicensesByPurl)
+ * @returns {Map<string, { licenses: string[], category?: string }>}
+ */
+export function normalizeLicensesResponse(data: unknown, purls?: string[]): Map<string, {
+    licenses: string[];
+    category?: string;
+}>;
+/**
+ * Build license map from an analysis report that already includes license data (result.licenses).
+ * Use this when the dependency analysis response already contains the licenses array to avoid a second request.
+ *
+ * @param {import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport} analysisReport - full analysis JSON
+ * @param {string[]} [purls] - optional list of purls to restrict to
+ * @returns {Map<string, { licenses: string[], category?: string }>}
+ */
+export function licensesFromReport(analysisReport: import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport").AnalysisReport, purls?: string[]): Map<string, {
+    licenses: string[];
+    category?: string;
+}>;

package/dist/src/license/licenses_api.js

@@ -0,0 +1,91 @@
+/**
+ * Client for the Trustify DA backend License Analysis API (POST /api/v5/licenses).
+ * The same license data shape is returned in the dependency analysis JSON report (result.licenses).
+ * @see https://github.com/guacsec/trustify-dependency-analytics#license-analysis-apiv5licenses
+ * @see https://github.com/guacsec/trustify-da-api-spec/blob/main/api/v5/openapi.yaml
+ */
+import { selectTrustifyDABackend } from '../index.js';
+import { addProxyAgent, getTokenHeaders } from '../tools.js';
+/**
+ * Fetch license details by SPDX identifier from the backend GET /api/v5/licenses/{spdx}.
+ * Returns detailed information about a specific license including category, name, and text.
+ *
+ * @param {string} spdxId - SPDX identifier (e.g., "Apache-2.0", "MIT")
+ * @param {import('../index.js').Options} [opts={}] - options (proxy, token, TRUSTIFY_DA_BACKEND_URL, etc.)
+ * @returns {Promise<Object|null>} License details or null if not found
+ */
+export async function getLicenseDetails(spdxId, opts = {}) {
+    if (!spdxId) {
+        return null;
+    }
+    const url = selectTrustifyDABackend(opts);
+    const finalUrl = new URL(`${url}/api/v5/licenses/${encodeURIComponent(spdxId)}`);
+    const fetchOptions = addProxyAgent({
+        method: 'GET',
+        headers: {
+            'Accept': 'application/json',
+            ...getTokenHeaders(opts)
+        },
+    }, opts);
+    try {
+        const resp = await fetch(finalUrl, fetchOptions);
+        if (!resp.ok) {
+            const errorText = await resp.text().catch(() => '');
+            throw new Error(`HTTP ${resp.status}: ${errorText || resp.statusText}`);
+        }
+        return await resp.json();
+    }
+    catch (err) {
+        throw new Error(`Failed to fetch license details: ${err.message}`);
+    }
+}
+/**
+ * Normalize the LicensesResponse shape (array of LicenseProviderResult) into a map of purl -> license info.
+ * Each provider result has { status, summary, packages } where packages is { [purl]: { concluded, evidence } }.
+ * We merge the first successful provider's packages; concluded has identifiers[], category (PERMISSIVE | WEAK_COPYLEFT | STRONG_COPYLEFT | UNKNOWN).
+ *
+ * @param {unknown} data - LicensesResponse (array) or analysis report's licenses field
+ * @param {string[]} [purls] - optional list of purls to restrict to (for consistency with getLicensesByPurl)
+ * @returns {Map<string, { licenses: string[], category?: string }>}
+ */
+export function normalizeLicensesResponse(data, purls = []) {
+    const map = new Map();
+    if (!data || !Array.isArray(data)) {
+        return map;
+    }
+    for (const providerResult of data) {
+        const packages = providerResult?.packages;
+        if (!packages || typeof packages !== 'object') {
+            continue;
+        }
+        for (const [purl, pkgLicense] of Object.entries(packages)) {
+            const concluded = pkgLicense?.concluded;
+            const identifiers = Array.isArray(concluded?.identifiers) ? concluded.identifiers : [];
+            const expression = concluded?.expression;
+            const licenses = identifiers.length > 0 ? identifiers : (expression ? [expression] : []);
+            const category = concluded?.category; // PERMISSIVE | WEAK_COPYLEFT | STRONG_COPYLEFT | UNKNOWN
+            if (purls.length === 0 || purls.includes(purl)) {
+                map.set(purl, { licenses: licenses.filter(Boolean), category });
+            }
+        }
+        // Use first provider that has packages; backend may return multiple (e.g. deps.dev)
+        if (map.size > 0) {
+            break;
+        }
+    }
+    return map;
+}
+/**
+ * Build license map from an analysis report that already includes license data (result.licenses).
+ * Use this when the dependency analysis response already contains the licenses array to avoid a second request.
+ *
+ * @param {import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport} analysisReport - full analysis JSON
+ * @param {string[]} [purls] - optional list of purls to restrict to
+ * @returns {Map<string, { licenses: string[], category?: string }>}
+ */
+export function licensesFromReport(analysisReport, purls = []) {
+    if (!analysisReport?.licenses) {
+        return new Map();
+    }
+    return normalizeLicensesResponse(analysisReport.licenses, purls);
+}

package/dist/src/license/project_license.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Resolve project license from manifest and from LICENSE / LICENSE.md in manifest dir or git root.
+ * Uses local pattern matching for LICENSE file identification (synchronous).
+ * For more accurate backend-based identification, use identifyLicense() separately.
+ * @param {string} manifestPath - path to manifest
+ * @returns {{ fromManifest: string|null, fromFile: string|null, mismatch: boolean }}
+ */
+export function getProjectLicense(manifestPath: string): {
+    fromManifest: string | null;
+    fromFile: string | null;
+    mismatch: boolean;
+};
+/**
+ * Find LICENSE file path in the same directory as the manifest.
+ * @param {string} manifestPath
+ * @returns {string|null} - path to LICENSE file or null if not found
+ */
+export function findLicenseFilePath(manifestPath: string): string | null;
+/**
+ * Call backend /licenses/identify endpoint to identify license from file.
+ * @param {string} licenseFilePath - path to LICENSE file
+ * @param {{}} [opts={}] - options (proxy, token, etc.)
+ * @returns {Promise<string|null>} - SPDX identifier or null
+ */
+export function identifyLicense(licenseFilePath: string, opts?: {}): Promise<string | null>;

package/dist/src/license/project_license.js

@@ -0,0 +1,139 @@
+/**
+ * Resolves the project license from the manifest and from a LICENSE / LICENSE.md file.
+ * Used to report manifest-vs-file mismatch and as the baseline for dependency license compatibility.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { selectTrustifyDABackend } from '../index.js';
+import { matchForLicense, availableProviders } from '../provider.js';
+import { addProxyAgent, getTokenHeaders } from '../tools.js';
+const LICENSE_FILES = ['LICENSE', 'LICENSE.md', 'LICENSE.txt'];
+/**
+ * Resolve project license from manifest and from LICENSE / LICENSE.md in manifest dir or git root.
+ * Uses local pattern matching for LICENSE file identification (synchronous).
+ * For more accurate backend-based identification, use identifyLicense() separately.
+ * @param {string} manifestPath - path to manifest
+ * @returns {{ fromManifest: string|null, fromFile: string|null, mismatch: boolean }}
+ */
+export function getProjectLicense(manifestPath) {
+    const resolved = path.resolve(manifestPath);
+    const provider = matchForLicense(resolved, availableProviders);
+    const fromManifest = provider.readLicenseFromManifest(resolved);
+    const fromFile = readLicenseFromFile(resolved);
+    const mismatch = Boolean(fromManifest && fromFile && normalizeSpdx(fromManifest) !== normalizeSpdx(fromFile));
+    return {
+        fromManifest: fromManifest || null,
+        fromFile: fromFile || null,
+        mismatch
+    };
+}
+/**
+ * Find LICENSE file path in the same directory as the manifest.
+ * @param {string} manifestPath
+ * @returns {string|null} - path to LICENSE file or null if not found
+ */
+export function findLicenseFilePath(manifestPath) {
+    const manifestDir = path.dirname(path.resolve(manifestPath));
+    for (const name of LICENSE_FILES) {
+        const filePath = path.join(manifestDir, name);
+        try {
+            if (fs.statSync(filePath).isFile()) {
+                return filePath;
+            }
+        }
+        catch {
+            // skip
+        }
+    }
+    return null;
+}
+/**
+ * Call backend /licenses/identify endpoint to identify license from file.
+ * @param {string} licenseFilePath - path to LICENSE file
+ * @param {{}} [opts={}] - options (proxy, token, etc.)
+ * @returns {Promise<string|null>} - SPDX identifier or null
+ */
+export async function identifyLicense(licenseFilePath, opts = {}) {
+    try {
+        const fileContent = fs.readFileSync(licenseFilePath);
+        const backendUrl = selectTrustifyDABackend(opts);
+        const url = new URL(`${backendUrl}/licenses/identify`);
+        const tokenHeaders = getTokenHeaders(opts);
+        const fetchOptions = addProxyAgent({
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/octet-stream',
+                ...tokenHeaders,
+            },
+            body: fileContent,
+        }, opts);
+        const resp = await fetch(url, fetchOptions);
+        if (!resp.ok) {
+            return null; // Fallback to local detection on error
+        }
+        const data = await resp.json();
+        // Extract SPDX identifier from backend response
+        return data?.license?.id || data?.spdx_id || data?.identifier || null;
+    }
+    catch {
+        return null; // Fallback to local detection on error
+    }
+}
+/**
+ * Find and read LICENSE or LICENSE.md; use local pattern matching for identification.
+ * @param {string} manifestPath
+ * @returns {string|null}
+ */
+function readLicenseFromFile(manifestPath) {
+    const licenseFilePath = findLicenseFilePath(manifestPath);
+    if (!licenseFilePath) {
+        return null;
+    }
+    try {
+        const content = fs.readFileSync(licenseFilePath, 'utf-8');
+        return detectSpdxFromText(content) || content.split('\n')[0]?.trim() || null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Very simple SPDX detection from common license text (first ~500 chars).
+ * @param {string} text
+ * @returns {string|null}
+ */
+function detectSpdxFromText(text) {
+    const head = text.slice(0, 500);
+    if (/Apache License,?\s*Version 2\.0/i.test(head)) {
+        return 'Apache-2.0';
+    }
+    if (/MIT License/i.test(head) && /Permission is hereby granted/i.test(head)) {
+        return 'MIT';
+    }
+    if (/GNU GENERAL PUBLIC LICENSE\s+Version 2/i.test(head)) {
+        return 'GPL-2.0-only';
+    }
+    if (/GNU GENERAL PUBLIC LICENSE\s+Version 3/i.test(head)) {
+        return 'GPL-3.0-only';
+    }
+    if (/BSD 2-Clause/i.test(head)) {
+        return 'BSD-2-Clause';
+    }
+    if (/BSD 3-Clause/i.test(head)) {
+        return 'BSD-3-Clause';
+    }
+    return null;
+}
+/**
+ * Normalize for comparison (lowercase, strip common suffixes).
+ * @param {string} spdxOrName
+ * @returns {string}
+ */
+function normalizeSpdx(spdxOrName) {
+    const s = String(spdxOrName).trim().toLowerCase();
+    // e.g. "MIT" vs "MIT License"
+    if (s.endsWith(' license')) {
+        return s.slice(0, -8);
+    }
+    return s;
+}

package/dist/src/provider.d.ts

@@ -1,3 +1,11 @@
+/**
+ * Match a provider by manifest type only (no lock file check). Used for license reading.
+ * @param {string} manifestPath - path or name of the manifest
+ * @param {[Provider]} providers - list of providers to iterate over
+ * @returns {Provider}
+ * @throws {Error} when the manifest is not supported and no provider was matched
+ */
+export function matchForLicense(manifestPath: string, providers: [Provider]): Provider;
 /**
  * Match a provider from a list or providers based on file type.
  * Each provider MUST export 'isSupported' taking a file name-type and returning true if supported.
@@ -10,7 +18,7 @@
  */
 export function match(manifest: string, providers: [Provider]): Provider;
 /** @typedef {{ecosystem: string, contentType: string, content: string}} Provided */
-/** @typedef {{isSupported: function(string): boolean, validateLockFile: function(string): void, provideComponent: function(string, {}): Provided, provideStack: function(string, {}): Provided}} Provider */
+/** @typedef {{isSupported: function(string): boolean, validateLockFile: function(string): void, provideComponent: function(string, {}): Provided | Promise<Provided>, provideStack: function(string, {}): Provided | Promise<Provided>, readLicenseFromManifest: function(string): string | null}} Provider */
 /**
  * MUST include all providers here.
  * @type {[Provider]}
@@ -24,6 +32,7 @@ export type Provided = {
 export type Provider = {
     isSupported: (arg0: string) => boolean;
     validateLockFile: (arg0: string) => void;
-    provideComponent: (arg0: string, arg1: {}) => Provided;
-    provideStack: (arg0: string, arg1: {}) => Provided;
+    provideComponent: (arg0: string, arg1: {}) => Provided | Promise<Provided>;
+    provideStack: (arg0: string, arg1: {}) => Provided | Promise<Provided>;
+    readLicenseFromManifest: (arg0: string) => string | null;
 };

package/dist/src/provider.js

@@ -8,7 +8,7 @@ import Javascript_pnpm from './providers/javascript_pnpm.js';
 import Javascript_yarn from './providers/javascript_yarn.js';
 import pythonPipProvider from './providers/python_pip.js';
 /** @typedef {{ecosystem: string, contentType: string, content: string}} Provided */
-/** @typedef {{isSupported: function(string): boolean, validateLockFile: function(string): void, provideComponent: function(string, {}): Provided, provideStack: function(string, {}): Provided}} Provider */
+/** @typedef {{isSupported: function(string): boolean, validateLockFile: function(string): void, provideComponent: function(string, {}): Provided | Promise<Provided>, provideStack: function(string, {}): Provided | Promise<Provided>, readLicenseFromManifest: function(string): string | null}} Provider */
 /**
  * MUST include all providers here.
  * @type {[Provider]}
@@ -23,6 +23,21 @@ export const availableProviders = [
     golangGomodulesProvider,
     pythonPipProvider
 ];
+/**
+ * Match a provider by manifest type only (no lock file check). Used for license reading.
+ * @param {string} manifestPath - path or name of the manifest
+ * @param {[Provider]} providers - list of providers to iterate over
+ * @returns {Provider}
+ * @throws {Error} when the manifest is not supported and no provider was matched
+ */
+export function matchForLicense(manifestPath, providers) {
+    const base = path.parse(manifestPath).base;
+    const provider = providers.find(prov => prov.isSupported(base));
+    if (!provider) {
+        throw new Error(`${base} is not supported`);
+    }
+    return provider;
+}
 /**
  * Match a provider from a list or providers based on file type.
  * Each provider MUST export 'isSupported' taking a file name-type and returning true if supported.

package/dist/src/providers/base_javascript.d.ts

@@ -1,5 +1,6 @@
-/** @typedef {import('../provider.js').Provider} Provider */
-/** @typedef {import('../provider.js').Provided} Provided */
+export type purlType = import("../provider").Provider;
+/** @typedef {import('../provider').Provider} */
+/** @typedef {import('../provider').Provided} Provided */
 /**
  * The ecosystem identifier for JavaScript/npm packages
  * @type {string}
@@ -85,6 +86,12 @@ export default class Base_javascript {
    * @returns {Provided} The provided data for component analysis
    */
     provideComponent(manifestPath: string, opts?: any): Provided;
+    /**
+     * Read license from manifest (package.json). Reused by npm, pnpm, yarn.
+     * @param {string} manifestPath - path to package.json
+     * @returns {string|null}
+     */
+    readLicenseFromManifest(manifestPath: string): string | null;
     /**
    * Builds the dependency tree for the project
    * @param {boolean} includeTransitive - Whether to include transitive dependencies
@@ -121,7 +128,6 @@ export default class Base_javascript {
     protected _parseDepTreeOutput(output: string): string;
     #private;
 }
-export type Provider = import("../provider.js").Provider;
-export type Provided = import("../provider.js").Provided;
+export type Provided = import("../provider").Provided;
 import Manifest from './manifest.js';
 import Sbom from '../sbom.js';

package/dist/src/providers/base_javascript.js

@@ -4,8 +4,8 @@ import path from 'node:path';
 import Sbom from '../sbom.js';
 import { getCustom, getCustomPath, invokeCommand, toPurl, toPurlFromString } from "../tools.js";
 import Manifest from './manifest.js';
-/** @typedef {import('../provider.js').Provider} Provider */
-/** @typedef {import('../provider.js').Provided} Provided */
+/** @typedef {import('../provider').Provider} */
+/** @typedef {import('../provider').Provided} Provided */
 /**
  * The ecosystem identifier for JavaScript/npm packages
  * @type {string}
@@ -132,6 +132,28 @@ export default class Base_javascript {
             contentType: 'application/vnd.cyclonedx+json'
         };
     }
+    /**
+     * Read license from manifest (package.json). Reused by npm, pnpm, yarn.
+     * @param {string} manifestPath - path to package.json
+     * @returns {string|null}
+     */
+    readLicenseFromManifest(manifestPath) {
+        try {
+            const content = JSON.parse(fs.readFileSync(manifestPath, 'utf-8'));
+            if (typeof content.license === 'string') {
+                return content.license.trim() || null;
+            }
+            if (Array.isArray(content.licenses) && content.licenses.length > 0) {
+                const first = content.licenses[0];
+                const name = first.type || first.name;
+                return typeof name === 'string' ? name.trim() : null;
+            }
+            return null;
+        }
+        catch {
+            return null;
+        }
+    }
     /**
    * Builds the dependency tree for the project
    * @param {boolean} includeTransitive - Whether to include transitive dependencies
@@ -155,8 +177,9 @@ export default class Base_javascript {
     #getSBOM(opts = {}) {
         const depsObject = this._buildDependencyTree(true);
         let mainComponent = toPurl(purlType, this.#manifest.name, this.#manifest.version);
+        const license = this.readLicenseFromManifest(this.#manifest.manifestPath);
         let sbom = new Sbom();
-        sbom.addRoot(mainComponent);
+        sbom.addRoot(mainComponent, license);
         this._addDependenciesToSbom(sbom, depsObject);
         sbom.filterIgnoredDeps(this.#manifest.ignored);
         return sbom.getAsJsonString(opts);
@@ -206,8 +229,9 @@ export default class Base_javascript {
     #getDirectDependencySbom(opts = {}) {
         const depTree = this._buildDependencyTree(false);
         let mainComponent = toPurl(purlType, this.#manifest.name, this.#manifest.version);
+        const license = this.readLicenseFromManifest(this.#manifest.manifestPath);
         let sbom = new Sbom();
-        sbom.addRoot(mainComponent);
+        sbom.addRoot(mainComponent, license);
         const rootDeps = this._getRootDependencies(depTree);
         const sortedDepsKeys = Array
             .from(rootDeps.keys())

package/dist/src/providers/golang_gomodules.d.ts

@@ -3,6 +3,7 @@ declare namespace _default {
     export { validateLockFile };
     export { provideComponent };
     export { provideStack };
+    export { readLicenseFromManifest };
 }
 export default _default;
 export type Provided = import("../provider").Provided;
@@ -20,7 +21,7 @@ export type Dependency = {
 /**
  * @param {string} manifestName - the subject manifest name-type
  * @returns {boolean} - return true if `pom.xml` is the manifest name-type
- */
+*/
 declare function isSupported(manifestName: string): boolean;
 /**
  * @param {string} manifestDir - the directory where the manifest lies
@@ -40,3 +41,9 @@ declare function provideComponent(manifest: string, opts?: {}): Provided;
  * @returns {Provided}
  */
 declare function provideStack(manifest: string, opts?: {}): Provided;
+/**
+ * Go modules have no standard license field in go.mod
+ * @param {string} manifestPath - path to go.mod
+ * @returns {string|null}
+*/
+declare function readLicenseFromManifest(manifestPath: string): string | null;

package/dist/src/providers/golang_gomodules.js

@@ -4,7 +4,7 @@ import { EOL } from "os";
 import { PackageURL } from 'packageurl-js';
 import Sbom from '../sbom.js';
 import { getCustom, getCustomPath, invokeCommand } from "../tools.js";
-export default { isSupported, validateLockFile, provideComponent, provideStack };
+export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest };
 /** @typedef {import('../provider').Provider} */
 /** @typedef {import('../provider').Provided} Provided */
 /** @typedef {{name: string, version: string}} Package */
@@ -12,16 +12,23 @@ export default { isSupported, validateLockFile, provideComponent, provideStack }
 /**
  * @type {string} ecosystem for npm-npm is 'maven'
  * @private
- */
+*/
 const ecosystem = 'golang';
 const defaultMainModuleVersion = "v0.0.0";
 /**
  * @param {string} manifestName - the subject manifest name-type
  * @returns {boolean} - return true if `pom.xml` is the manifest name-type
- */
+*/
 function isSupported(manifestName) {
     return 'go.mod' === manifestName;
 }
+/**
+ * Go modules have no standard license field in go.mod
+ * @param {string} manifestPath - path to go.mod
+ * @returns {string|null}
+*/
+// eslint-disable-next-line no-unused-vars
+function readLicenseFromManifest(manifestPath) { return null; }
 /**
  * @param {string} manifestDir - the directory where the manifest lies
  */
@@ -250,7 +257,8 @@ function getSBOM(manifest, opts = {}, includeTransitive) {
         performManifestVersionsCheck(root, rows, manifest);
     }
     const mainModule = toPurl(root, "@");
-    sbom.addRoot(mainModule);
+    const license = readLicenseFromManifest(manifest);
+    sbom.addRoot(mainModule, license);
     const exhortGoMvsLogicEnabled = getCustom("TRUSTIFY_DA_GO_MVS_LOGIC_ENABLED", "true", opts);
     if (includeTransitive && exhortGoMvsLogicEnabled === "true") {
         rows = getFinalPackagesVersionsForModule(rows, manifest, goBin);

package/dist/src/providers/java_gradle.d.ts

@@ -15,6 +15,12 @@ export default class Java_gradle extends Base_java {
      * @param {string} manifestDir - the directory where the manifest lies
      */
     validateLockFile(): boolean;
+    /**
+     * Gradle manifests (build.gradle, build.gradle.kts) have no standard license field.
+     * @param {string} manifestPath - path to manifest
+     * @returns {null}
+     */
+    readLicenseFromManifest(manifestPath: string): null;
     /**
      * Provide content and content type for stack analysis.
      * @param {string} manifest - the manifest path or name

package/dist/src/providers/java_gradle.js

@@ -49,6 +49,13 @@ export default class Java_gradle extends Base_java {
      * @param {string} manifestDir - the directory where the manifest lies
      */
     validateLockFile() { return true; }
+    /**
+     * Gradle manifests (build.gradle, build.gradle.kts) have no standard license field.
+     * @param {string} manifestPath - path to manifest
+     * @returns {null}
+     */
+    // eslint-disable-next-line no-unused-vars
+    readLicenseFromManifest(manifestPath) { return null; }
     /**
      * Provide content and content type for stack analysis.
      * @param {string} manifest - the manifest path or name
@@ -158,7 +165,8 @@ export default class Java_gradle extends Base_java {
         let sbom = new Sbom();
         let root = `${properties.group}:${properties[ROOT_PROJECT_KEY_NAME].match(/Root project '(.+)'/)[1]}:jar:${properties.version}`;
         let rootPurl = this.parseDep(root);
-        sbom.addRoot(rootPurl);
+        const license = this.readLicenseFromManifest(manifestPath);
+        sbom.addRoot(rootPurl, license);
         let ignoredDeps = this.#getIgnoredDeps(manifestPath);
         const [runtimeConfig, compileConfig] = this.#extractConfigurations(content);
         const processedDeps = new Set();
@@ -298,7 +306,8 @@ export default class Java_gradle extends Base_java {
         let sbom = new Sbom();
         let root = `${properties.group}:${properties[ROOT_PROJECT_KEY_NAME].match(/Root project '(.+)'/)[1]}:jar:${properties.version}`;
         let rootPurl = this.parseDep(root);
-        sbom.addRoot(rootPurl);
+        const license = this.readLicenseFromManifest(manifestPath);
+        sbom.addRoot(rootPurl, license);
         let ignoredDeps = this.#getIgnoredDeps(manifestPath);
         const [runtimeConfig, compileConfig] = this.#extractConfigurations(content);
         let directDependencies = new Map();

package/dist/src/providers/java_maven.d.ts

@@ -27,13 +27,20 @@ export default class Java_maven extends Base_java {
      * @returns {Provided}
      */
     provideComponent(manifest: string, opts?: {}): Provided;
+    /**
+     * Read license from pom.xml manifest
+     * @param {string} manifestPath - path to pom.xml
+     * @returns {string|null}
+     */
+    readLicenseFromManifest(manifestPath: string): string | null;
     /**
      *
      * @param {String} textGraphList Text graph String of the manifest
      * @param {[String]} ignoredDeps List of ignored dependencies to be omitted from sbom
+     * @param {String} manifestPath Path to the pom.xml manifest
      * @return {String} formatted sbom Json String with all dependencies
      */
-    createSbomFileFromTextFormat(textGraphList: string, ignoredDeps: [string], opts: any): string;
+    createSbomFileFromTextFormat(textGraphList: string, ignoredDeps: [string], opts: any, manifestPath: string): string;
     #private;
 }
 export type Java_maven = import("../provider").Provider;

package/dist/src/providers/java_maven.js

@@ -51,6 +51,30 @@ export default class Java_maven extends Base_java {
             contentType: 'application/vnd.cyclonedx+json'
         };
     }
+    /**
+     * Read license from pom.xml manifest
+     * @param {string} manifestPath - path to pom.xml
+     * @returns {string|null}
+     */
+    readLicenseFromManifest(manifestPath) {
+        try {
+            const xml = fs.readFileSync(manifestPath, 'utf-8');
+            const parser = new XMLParser({ ignoreAttributes: false });
+            const obj = parser.parse(xml);
+            const project = obj?.project;
+            if (!project?.licenses?.license) {
+                return null;
+            }
+            const license = Array.isArray(project.licenses.license)
+                ? project.licenses.license[0]
+                : project.licenses.license;
+            const name = (license?.name && license.name.trim()) || null;
+            return name || null;
+        }
+        catch {
+            return null;
+        }
+    }
     /**
      * Create a Dot Graph dependency tree for a manifest path.
      * @param {string} manifest - path for pom.xml
@@ -105,7 +129,7 @@ export default class Java_maven extends Base_java {
         if (process.env["TRUSTIFY_DA_DEBUG"] === "true") {
             console.error("Dependency tree that will be used as input for creating the BOM =>" + EOL + EOL + content.toString());
         }
-        let sbom = this.createSbomFileFromTextFormat(content.toString(), ignoredDeps, opts);
+        let sbom = this.createSbomFileFromTextFormat(content.toString(), ignoredDeps, opts, manifest);
         // delete temp file and directory
         fs.rmSync(tmpDir, { recursive: true, force: true });
         // return dependency graph as string
@@ -115,15 +139,17 @@ export default class Java_maven extends Base_java {
      *
      * @param {String} textGraphList Text graph String of the manifest
      * @param {[String]} ignoredDeps List of ignored dependencies to be omitted from sbom
+     * @param {String} manifestPath Path to the pom.xml manifest
      * @return {String} formatted sbom Json String with all dependencies
      */
-    createSbomFileFromTextFormat(textGraphList, ignoredDeps, opts) {
+    createSbomFileFromTextFormat(textGraphList, ignoredDeps, opts, manifestPath) {
         let lines = textGraphList.split(EOL);
         // get root component
         let root = lines[0];
         let rootPurl = this.parseDep(root);
+        const license = this.readLicenseFromManifest(manifestPath);
         let sbom = new Sbom();
-        sbom.addRoot(rootPurl);
+        sbom.addRoot(rootPurl, license);
         this.parseDependencyTree(root, 0, lines.slice(1), sbom);
         return sbom.filterIgnoredDeps(ignoredDeps).getAsJsonString(opts);
     }
@@ -156,7 +182,8 @@ export default class Java_maven extends Base_java {
         let sbom = new Sbom();
         let rootDependency = this.#getRootFromPom(tmpEffectivePom, manifestPath);
         let purlRoot = this.toPurl(rootDependency.groupId, rootDependency.artifactId, rootDependency.version);
-        sbom.addRoot(purlRoot);
+        const license = this.readLicenseFromManifest(manifestPath);
+        sbom.addRoot(purlRoot, license);
         dependencies.forEach(dep => {
             let currentPurl = this.toPurl(dep.groupId, dep.artifactId, dep.version);
             sbom.addDependency(purlRoot, currentPurl);