Information on how to generate a nodejs license scan using SBOMs

invoke.sh

npm i --production
npx -p @cyclonedx/bom cyclonedx-node -o bom.json
python ../license-scan.py

license-scan.py

#!/usr/bin/env python3

import json
from collections import defaultdict

f = open('./bom.json')
j = ''.join(f.readlines())
data = json.loads(j)

licenses = defaultdict(list)

for component in data['components']:
    if 'licenses' not in component:
        licenses['unknown'].append(component['bom-ref'])
        continue
    try:
        all_licenses = [x['license'].get('id') or x['license'].get('name') for x in component['licenses']]
        for l in all_licenses:
            licenses[l].append(component['bom-ref'])
    except:
        import pdb; pdb.set_trace()


for l, pkgs in licenses.items():
    print(f"{l}:{', '.join(pkgs)}")