jdaugherty commented on PR #15087: URL: https://github.com/apache/grails-core/pull/15087#issuecomment-3320759316
> > I'm not sure if I understand this - are you proposing we don't include the text or are you asking us to? > > > > > > The SPDX code is what identifies the license text. The cyclonedx is a json standard, so we're simply including what the upstream authors have published. Most of the licenses are included via a base64 encoding. We could technically strip the text and ensure the id is present. I'm inclined to use what the standard does by default since this is meant for security review. > > > > I'm wondering if there is any downside to set the `includeLicenseText` property to `false` (https://github.com/CycloneDX/cyclonedx-gradle-plugin?tab=readme-ov-file#configuration-properties). One downside is there isn't an SPDX code for the sitemesh license. The actual standard only requires id or name though. https://cyclonedx.org/docs/1.6/json/#tab-pane_components_items_licenses_oneOf_i0_items_license_oneOf_i0 Why would you want to not include the license text? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
