Fetch license from custom repo

[sebastianvoss]

Hi,

Thanks for the great tool! Is there a way to fetch the maven license info from a custom repository? We are using Nexus OSS in our Bazel projects to proxy the fetching of all deps.

[prabhu]

@sebastianvoss, thank you for your kind words. Could you share any further info on this? Is there an endpoint or an API to retrieve the pom file or the license from Nexus?

[sebastianvoss]

Thanks @prabhu for your super fast reply.

Here are some details:

In Bazel WORKSPACE we have this declaration:

maven_install(
    artifacts = [
      "org.apache.logging.log4j:log4j-api:2.20.0",
      ...
    ],
    repositories = [
      "https://repo.example.com/repository/maven-public"
    ]
)

Nexus is serving the POM at:

https://repo.example.com/repository/maven-public/org/apache/logging/log4j/log4j-core/2.19.0/log4j-core-2.19.0.pom

cdxgen tries to fetch from:

Querying https://repo1.maven.org/maven2/repository/maven-public/org/apache/logging/log4j/log4j-core/2.20.0/log4j-core-2.20.0.pom
Unable to find metadata for repository.maven-public.org.apache.logging.log4j log4j-core 2.20.0 https://repo1.maven.org/maven2/repository/maven-public/org/apache/logging/log4j/log4j-core/2.20.0/log4j-core-2.20.0.pom

[prabhu]

@sebastianvoss, Thanks for sharing. Could you send a pull request based on below instructions?

https://github.com/CycloneDX/cdxgen/blob/master/utils.js#L2010

const MAVEN_CENTRAL_URL = process.env.MAVEN_CENTRAL_URL || "https://repo1.maven.org/maven2/";

This way you can set the environment variable MAVEN_CENTRAL_URL=https://repo.example.com/repository/maven-public/

[sebastianvoss]

@prabhu PR is ready: #513