feat: Create bill of materials instead of only extracted comments

[susnux]

Summary

Do not extract comments (that depends on regex) but correctly export BOM from packages used.

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included
• Screenshots before/after for front-end changes
• Documentation (manuals or wiki) has been updated or is not required
• Backports requested where applicable (ex: critical bugfixes)

[st3iny]

Does that also include license headers from our own source code or just from the packages used?

[susnux]

Does that also include license headers from our own source code or just from the packages used

No but all other licenses we depend on, as all of our code is licensed under AGPL-3.0 (some parts even AGPL-3.0+ but at least AGPL-3.0 and compatible so that we can publish it under AGPL-3.0)

[AndyScherzinger]

No but all other licenses we depend on, as all of our code is licensed under AGPL-3.0 (some parts even AGPL-3.0+ but at least AGPL-3.0 and compatible so that we can publish it under AGPL-3.0)

Well, this might not be absolutely true in 100% of all cases while true for most. Some files do have MIT or Apache or else, while always compatible. However for any file not shipping a license header we need to have an entry in the dep5 file which is rather complicated for generated files where a wildcard would catch all files, also the ones that aren't the default license.

Do we have a chance to also generate .license files for our own files living right next to them? In that case we would have the best way to achieve reuse compliance without relying on the dep5 file. So at least for these we could then generate the files lice today but for SPDX, no?

Happy to sit-down during the Berlin week 😃

[susnux]

But relying on extracted comments also is not the best solution as it will likely not contain 3rdparty licenses from code bundled in. Because often 3rdparty has removed all comments from code.

Happy to sit-down during the Berlin week 😃

Sure :)