Docs: Clarify which languages support license scanning

[carlpett]

Description

Currently, the docs state that

By default, Trivy scans licenses for packages installed by apk, apt-get, dnf, npm, pip, gem, etc.

The "etc" would be great to have clarified. What package managers exactly are supported? Right now it's a game of testing and troubleshooting if I'm doing something wrong. For example, Maven/pom.xml projects do not seem to work, neither do Python projects for either requirements.txt nor poetry.lock. Maybe they should? trivy fs --scanners license . takes longer time on bigger projects, and running under strace I can at least see that the dependency files are accessed, but nothing more than License scanning is enabled is output.

So, I would suggest adding a table with package managers with supported license scanning, or supported with file scanning (this also appears to be restricted by file extensions, if my quick dives into the source is correct).

Target

Filesystem

Scanner

License

[itaysk]

#4362

[knqyf263]

@carlpett We have language-specific pages. Isn't it what you need? We need to update Java, though.
https://aquasecurity.github.io/trivy/v0.41/docs/scanner/vulnerability/language/golang/

[carlpett]

Hi @knqyf263,
Thanks! I'd say it partially covers it. Two comments, though:

• It is nested under the "Vulnerability" scanner, so unlikely to be found in the way it is structured now (eg that is why I did not find it)
• The License scanner docs would still need to mention OS package managers, right? It'd be good to at least have it reference a place to find which languages are supported directly, to have a single clear place to check

[knqyf263]

Thanks for your comments. We'll take them into consideration.

[itaysk]

maybe related to #3859