Hey there,

I needed something very similar, just with a few more columns in the final report, so I took your package as a basis and extended it. I wonder if you might be inclined to incorporate the changes. Let me know if that sounds like an option, I'd probably would need to add some test cases before this should be merged.

New attributes:

• license version (for licenses that are versioned, like Apache-1.0 vs
  Apache-2.0),
• SPDX ID without the version suffix,
• link to license file,
• copyright holder,
• copyright year

All mentioned attributes are computed in a best effort, that is, there
is no guarantee that the implementation will find the respective values
even if it might be available in the package metadata or license file.

Also:

• add safeguard around read-package-tree
• sort packages by name and version before printing the report