feat(cargo): incorporate crate licenses

[tbshrst]

Description

It would be great to also have licenses of all external dependencies at hand.
I know this would require fetching from crates.io, but basically the information is available.

Target

SBOM

Scanner

License

[DmitriyLewen]

Hello @tbshrst

Downloading licenses from crates.io is not good because we need to make queries for each dependency.
Perhaps you have information about saved licenses on your local computer (for example, in a cache directory)?

Regards, Dmitriy

[tbshrst]

Hi!

Sure, I could use separate tools to create SBOMs of my rust code that contain licenses, but I'd end up using multiple tools that create multiple SBOMs. I could then somehow merge them together into a single SBOM. This whole process makes things more tedious than they could be (there could also be duplicate entries, etc.). So far, trivy has been my swiss knife for these tasks, and it would be nice if it could stay that way.

On the other hand, I understand your concerns. In case of rust, there is only one (and trusted) source for retrieving information, crates.io, which could simplify things.

[tbshrst]

The discussion can be closed as there are proposals for doing SBOM things in cargo itself, which is probably a better solution.

Pre-RFC discussion: https://internals.rust-lang.org/t/pre-rfc-cargo-sbom/19842/58
RFC cargo-sbom: rust-lang/rfcs#3553