Replies: 2 comments 4 replies
-
|
Hi @namandf ! It seems that you have already created a discussion with a similar problem: #4236 |
Beta Was this translation helpful? Give feedback.
-
|
Hi @nikpivkin , #4236 is now focussed on license detection for image scans. For filesystem scans, trivy seems to have added support some time back wherein, pom.xml is parsed to extract license information. There seems to be an issue with the same. When maven is being referred to fetch child POM dependencies, the expected behaviour is to analyze pom to extract GAV + license. But looks like license is not being parsed or may be it is parsed, but not processed or lost in translation |
Beta Was this translation helpful? Give feedback.
-
|
Trivy extracts licenses from pom.xml which are stored directly in the file system. At the moment, Trivy cannot get information about dependency licenses, since licenses are not stored in |
Beta Was this translation helpful? Give feedback.
-
|
Trivy is anyways making maven calls to fetch POM dependencies if I am not wrong. Won't it be straightforward to extract licenses as well? I assumed , we are already doing that as part of the recent change. https://github.com/aquasecurity/go-dep-parser/blob/main/pkg/java/pom/parse.go#L541 Even if its a local repository instead of maven, it is processing the local pom.xml . We should be able to extract license information from the same. https://github.com/aquasecurity/go-dep-parser/blob/main/pkg/java/pom/parse.go#L534 |
Beta Was this translation helpful? Give feedback.
-
This isn't the current approach anyways right i.e we don't refer java db in case of pom.xml (filesystem scans)? We directly call maven https://repo.maven.apache.org/maven2 or refer local maven repository if available to get all child packages . |
Beta Was this translation helpful? Give feedback.
-
|
Yes, you're right, I think I'm a little confused. I created an issue. #5028 |
Beta Was this translation helpful? Give feedback.
-
Description
Performed a trivy filesystem scan on https://github.com/WebGoat/WebGoat .
Only see license captured in root pom.xml.
Desired Behavior
Was expecting license information for a bunch of packages detected.
Eg.
License: MIT
License: Apache 2.0
Actual Behavior
Only see license captured in root pom.xml.
Reproduction Steps
Target
Filesystem
Scanner
Vulnerability
Output Format
JSON
Mode
Standalone
Debug Output
Operating System
macOS
Version
Checklist
trivy image --resetBeta Was this translation helpful? Give feedback.
All reactions