Add NPM License Support from Package-Lock v2+ (#577)

* Add NPM License Support from Package-Lock v2+

Package-lock, starting in version 2, optionally provides package licenses
that should be incorporated into BOM generation.

Signed-off-by: ansonallard <[email protected]>

* Conditionally Override License When Getting Remote

If FETCH_LICENSE is enabled, we do not want to override packages
that already have licenses. Therefore, fetching remote package metadata
will only add the license metadata if not present.

Signed-off-by: ansonallard <[email protected]>

* Revert "Conditionally Override License When ..."

This reverts commit 0748812.

Signed-off-by: ansonallard <[email protected]>

---------

Signed-off-by: ansonallard <[email protected]>

test/data/package-json/v2-workspace/package.json

@@ -4,6 +4,7 @@
   "private": true,
   "packageManager": "[email protected]",
   "type": "module",
+  "license": "MIT",
   "workspaces": [
     "app",
     "edge",

utils.js

@@ -513,6 +513,11 @@ export const parsePkgLock = async (pkgLockFile, options = {}) => {
         "bom-ref": purlString
       };
     }
+    const packageLicense = node.package.license;
+    if (packageLicense) {
+      // License will be overridden if FETCH_LICENSE is enabled
+      pkg.license = packageLicense;
+    }
     pkgList.push(pkg);
 
     // retrieve workspace node pkglists

utils.test.js

@@ -1533,11 +1533,13 @@ test("parsePkgLock v2", async () => {
   expect(deps[1]._integrity).toEqual(
     "sha512-x9yaMvEh5BEaZKeVQC4vp3l+QoFj3BXcd4aYfuKSzIIyihjdVARAadYy3SMNIz0WCCdS2vB9JL/U6GQk5PaxQw=="
   );
+  expect(deps[1].license).toEqual("Apache-2.0");
   expect(deps[0]).toEqual({
     "bom-ref": "pkg:npm/[email protected]",
     author: "Wessel van Ree <[email protected]>",
     group: "",
     name: "shopify-theme-tailwindcss",
+    license: "MIT",
     type: "application",
     version: "2.2.1"
   });
@@ -1568,6 +1570,7 @@ test("parsePkgLock v2 workspace", async () => {
   let pkgs = parsedList.pkgList;
   let deps = parsedList.dependenciesList;
   expect(pkgs.length).toEqual(1032);
+  expect(pkgs[0].license).toEqual("MIT");
   let hasAppWorkspacePkg = pkgs.some(
     (obj) => obj["bom-ref"] === "pkg:npm/[email protected]"
   );
@@ -1605,6 +1608,7 @@ test("parsePkgLock v3", async () => {
     "bom-ref": "pkg:npm/cdxgen@latest",
     group: "",
     author: "",
+    license: "ISC",
     name: "cdxgen",
     type: "application",
     version: "latest"