License Placement

[HesAnEasyCoder]

specification/schema/bom-1.7.schema.json

Line 1890 in 03bf599

"license",

Should this be included here? It feels like it could get lost.

[jkowalleck]

Please add some context, @HesAnEasyCoder

[HesAnEasyCoder]

I do not think this enum belongs here if included elsewhere within documentation (like the model card)

[jkowalleck]

I do not think this enum belongs here if included elsewhere within documentation (like the model card)

why do you think so?

[mrutkows]

@jkowalleck Hey Jan, I just assigned this to me and we will discuss at the ML work group and add the results to the discussion here.

[mrutkows]

Just wanted to add a quick thought or two...

• I do not believe for 1.x spec. that removing is an option and even for 2.0 I would like to see ext. refs. (re)used for license; however under the license object in some way with intentional purpose for when an ID is not present nor viable to actually copy the license inside the BOM.
• it would be great for 2.0 to provide an extension mech. to qualify licenses (perhaps using the prop. taxonomy) which I see is getting leveraged quite nicely in a few work groups for 2.0. In that way we could distinguish between multiple licenses relative to the domain of the associated component (e.g., cdx:license:data, cdx:license:commercial:eu, etc.).

[mrutkows]

Let's discuss and address for 2.0 as we really need to clean up the whole "license" object(s) to have one discernible path for filling in license information. To that end, I tagged for 2.0 discussion/consideration.