don't generate invalid SBOM on blank license: ignore instead

[fupgang]

Ignoring license information with empty name and url (in pom.xml), for example:

    <licenses>
        <license>
            <name/>
            <url/>
            <distribution/>
        </license>
    </licenses>

As #382 states, processing such incomplete license information produced invalid SBOMs.

[hboutemy]

thank you

[fupgang]

@hboutemy, did you already schedule a release containing this fix?

As said in #382 (comment), using the openapi-generator we unfortunately produce a lot of invalid SBOMs at the moment.

[crimsonvspurple]

I tested v2.9.1 and empty licenses line is still there.

  <!-- https://mvnrepository.com/artifact/net.jcip/jcip-annotations -->
        <dependency>
            <groupId>net.jcip</groupId>
            <artifactId>jcip-annotations</artifactId>
            <version>1.0</version>
        </dependency>

[fupgang]

I tried the following example which looks good to me:

A simple pom.xml:

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>

  <groupId>com.example</groupId>
  <artifactId>my-artifact</artifactId>
  <version>0.1.0</version>

  <dependencies>
          <dependency>
            <groupId>net.jcip</groupId>
            <artifactId>jcip-annotations</artifactId>
            <version>1.0</version>
        </dependency>
  </dependencies>
</project>

I created sboms with the latest (2.9.1) and former version (2.9.0) of the cyclonedx-maven-plugin:

mvn org.cyclonedx:cyclonedx-maven-plugin:2.9.1:makeBom -DoutputName=bom-2.9.1
mvn org.cyclonedx:cyclonedx-maven-plugin:2.9.0:makeBom -DoutputName=bom-2.9.0

The BOMs differ concerning the license:

[crimsonvspurple]

@fupgang You are right. I made an oopsie when testing on my end. Thank you for your hard work.