Missing License Info in SBOMs

[tetzla]

Description

I'm creating SBOMs for diverse images and directories (via rootfs). These SBOMs contain only license info for Redhat components. For all other components (e.g. JARs), there is no license info. The behavior is identical for CycloneDX and SPDX. The option license-full option does not help.

Desired Behavior

License infos are contained in SBOMs.

Actual Behavior

License infos are not contained in SBOMs (except Redhat).

Reproduction Steps

1. Create an SBOM (e.g. for the image jboss/wildfly:latest) and search for license info in the generated file.

Target

SBOM

Scanner

License

Output Format

CycloneDX

Mode

None

Debug Output

-

Operating System

Windows and Linux

Version

0.58.0

Checklist

• Run trivy clean --all
• Read the troubleshooting

[DmitriyLewen]

Hello @tetzla
Thanks for your interest to Trivy!

Trivy doesn't support detecting licenses for any language files.
e.g., Trivy doesn't detect licenses for jar files (see https://trivy.dev/latest/docs/coverage/language/java/#java).

You can check the supported language files on the language pages - https://trivy.dev/latest/docs/coverage/language/

e.g. Trivy detects license for package.json files:

➜  co cat package.json | grep license             
  "license": "MIT",
➜  co trivy -q rootfs -f cyclonedx ./package.json  | grep '"license"' -A 1
          "license": {
            "name": "MIT"

Regards, Dmitriy

[tetzla]

Hello,

many thanks for your quick response.

Is the license detection for jar/war/ear archives planned for future releases? Does it make sense to submit a feature request?

I find it a bit surprising that license detection is supported for pom files but not for jar/war/ear archives, since these archives usually contain a pom file.

Regards, Aline

[DmitriyLewen]

Issue about licenses for jar files - #4734

since these archives usually contain a pom file.

This is not always correct.

1. IIUC JAR files built with gradle may not have POM files
2. The license from the POM file may be overwritten during the build of the JAR file.

[tetzla]

Thank's a lot. I'll be waiting for #4734.