Make Cargo targets inherit package licenses

Signed-off-by: Peter Bestler <peter.bestler@liebherr.com>

Author: pbestler

cargo-cyclonedx/CHANGELOG.md

@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## Unreleased
+
+### Fixed
+
+ - Cargo target subcomponents now inherit the license of their package, including licenses inherited from the workspace.
+
 ## 0.5.9 - 2026-03-19
 
 ### Added

cargo-cyclonedx/src/generator.rs

@@ -306,6 +306,7 @@ impl SbomGenerator {
                 &package.version.to_string(),
                 Some(bom_ref),
             );
+            subcomponent.licenses.clone_from(&top_component.licenses);
 
             // PURL subpaths are computed relative to the directory with the `Cargo.toml`
             // *for this specific package*, not the workspace root.

cargo-cyclonedx/src/main.rs

@@ -192,7 +192,47 @@ fn get_metadata(
 
 #[cfg(test)]
 mod tests {
+    use crate::{cli, generate_sboms};
+    use clap::Parser;
+    use cyclonedx_bom::models::{component::Component, license::Licenses};
     use cyclonedx_bom::prelude::NormalizedString;
+    use std::path::PathBuf;
+
+    fn generate_fixture_package(fixture: &str) -> Component {
+        let manifest = PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+            .join("tests/fixtures")
+            .join(fixture)
+            .join("Cargo.toml");
+        let path_arg = format!("--manifest-path={}", manifest.display());
+        let args = cli::Args::parse_from(["cyclonedx", &path_arg]);
+
+        let mut sboms = generate_sboms(&args).unwrap();
+        assert_eq!(sboms.len(), 1, "fixture {fixture} must generate one SBOM");
+        sboms
+            .pop()
+            .unwrap()
+            .bom
+            .metadata
+            .unwrap()
+            .component
+            .unwrap()
+    }
+
+    fn assert_fixture_license_is_inherited(fixture: &str, expected: Licenses) {
+        let package = generate_fixture_package(fixture);
+        assert_eq!(package.licenses.as_ref(), Some(&expected));
+
+        let targets = &package.components.as_ref().unwrap().0;
+        assert_eq!(targets.len(), 2);
+        for target in targets {
+            assert_eq!(
+                target.licenses.as_ref(),
+                Some(&expected),
+                "target {:?} did not inherit its package license",
+                target.name,
+            );
+        }
+    }
 
     #[test]
     fn parse_toml_only_normal() {
@@ -216,6 +256,53 @@ mod tests {
             .0
             .iter()
             .all(|f| f.scope == Some(Scope::Required)));
+
+        let targets = &sboms[0]
+            .bom
+            .metadata
+            .as_ref()
+            .unwrap()
+            .component
+            .as_ref()
+            .unwrap()
+            .components
+            .as_ref()
+            .unwrap()
+            .0;
+        assert!(targets.iter().all(|target| target.licenses.is_none()));
+    }
+
+    #[test]
+    fn workspace_license_is_inherited_by_all_cargo_targets() {
+        use cyclonedx_bom::models::license::LicenseChoice;
+
+        assert_fixture_license_is_inherited(
+            "workspace_license",
+            Licenses(vec![LicenseChoice::expression("LicenseRef-Proprietary")]),
+        );
+    }
+
+    #[test]
+    fn package_license_is_inherited_by_all_cargo_targets() {
+        use cyclonedx_bom::models::license::LicenseChoice;
+
+        assert_fixture_license_is_inherited(
+            "package_license",
+            Licenses(vec![LicenseChoice::expression("MIT")]),
+        );
+    }
+
+    #[test]
+    fn package_license_file_is_inherited_by_all_cargo_targets() {
+        use cyclonedx_bom::models::attached_text::AttachedText;
+        use cyclonedx_bom::models::license::{License, LicenseChoice};
+        let mut expected_license = License::named_license("Unknown");
+        expected_license.text = Some(AttachedText::new(None, "Test license text.\n"));
+
+        assert_fixture_license_is_inherited(
+            "package_license_file",
+            Licenses(vec![LicenseChoice::License(expected_license)]),
+        );
     }
 
     #[test]

cargo-cyclonedx/tests/fixtures/package_license/Cargo.lock

@@ -0,0 +1,7 @@
+[package]
+name = "package-license"
+version = "0.1.0"
+edition = "2021"
+license = "MIT"
+
+[workspace]

cargo-cyclonedx/tests/fixtures/package_license/Cargo.toml

@@ -0,0 +1 @@
+pub fn library_target() {}

cargo-cyclonedx/tests/fixtures/package_license/src/lib.rs

@@ -0,0 +1 @@
+fn main() {}

cargo-cyclonedx/tests/fixtures/package_license/src/main.rs

@@ -0,0 +1,7 @@
+[package]
+name = "package-license-file"
+version = "0.1.0"
+edition = "2021"
+license-file = "LICENSE"
+
+[workspace]

cargo-cyclonedx/tests/fixtures/package_license_file/Cargo.lock

@@ -0,0 +1 @@
+Test license text.