Failing to retrieve licenses about cyclonedx-gradle-plugin HOT 2 OPEN

Hi,

Would I be right in thinking this plugin makes use of MVN repo's API to search for dependency information? As comparing the API's JSON response for a dependency that the CycloneDX Gradle plugin can get license information for and one that it can't I can see that license info isn't returned all the time I.e.

org.skyscreamer:jsonassert:1.5.0 https://search.maven.org/artifact/org.skyscreamer/jsonassert/1.5.0/jar - this has license information in its JSON return and the CycloneDX plugin populates the license information in the SBOM

com.google.guava:guava:28.2-jre https://search.maven.org/artifact/com.google.guava/guava/28.2-jre/bundle - this doesn't have license information in its JSON return and the CycloneDX plugin doesn't populate the license information in the SBOM

from cyclonedx-gradle-plugin.

The plugin use the Maven API, it does not use the Maven Central REST API. Therefore it only looks at pom.xml and walks up to parent poms is resolved. This is similar to how the Maven plugin operates.

from cyclonedx-gradle-plugin.