Full license scan only returns results when --format not set

[srowe]

Description

Scanning source code repository without defining any output format produces correct output

bash-4.4$ trivy repo --scanners license --license-full --license-confidence-level 0.8 <dir>
2024-11-25T15:31:40Z	INFO	[license] Full license scanning is enabled

Loose File License(s) (license)

Total: 2598 (UNKNOWN: 3, LOW: 821, MEDIUM: 0, HIGH: 1774, CRITICAL: 0)
...
table follows

However adding --format spdx-json results in output that contains no license information.

Desired Behavior

JSON file containing packages with licenseDeclared entries.

Actual Behavior

$ trivy repo --scanners license --license-full --license-confidence-level 0.8 --format spdx-json <dir>
2024-11-25T15:45:42Z	INFO	[license] Full license scanning is enabled
2024-11-25T15:46:39Z	INFO	Number of language-specific files	num=0
{
  "spdxVersion": "SPDX-2.3",
  "dataLicense": "CC0-1.0",
  "SPDXID": "SPDXRef-DOCUMENT",
  "name": "<dir>",
  "documentNamespace": "http://aquasecurity.github.io/trivy/repository/<dir>-9bd394ef-35d8-4c27-879a-1f942cfce5b8",
  "creationInfo": {
    "creators": [
      "Organization: aquasecurity",
      "Tool: trivy-0.57.1"
    ],
    "created": "2024-11-25T15:46:39Z"
  },
  "packages": [
    {
      "name": "<dir>",
      "SPDXID": "SPDXRef-Repository-cf8f3f5613dd3e43",
      "downloadLocation": "git+<dir>",
      "filesAnalyzed": false,
      "primaryPackagePurpose": "SOURCE",
      "annotations": [
        {
          "annotator": "Tool: trivy-0.57.1",
          "annotationDate": "2024-11-25T15:46:39Z",
          "annotationType": "OTHER",
          "comment": "SchemaVersion: 2"
        }
      ]
    }
  ],
  "relationships": [
    {
      "spdxElementId": "SPDXRef-DOCUMENT",
      "relatedSpdxElement": "SPDXRef-Repository-cf8f3f5613dd3e43",
      "relationshipType": "DESCRIBES"
    }
  ]
}

Reproduction Steps

1. run scanner
2. check results

Target

Git Repository

Scanner

License

Output Format

JSON

Mode

Standalone

Debug Output

$ trivy repo --scanners license --license-full --license-confidence-level 0.8 --format spdx-json --debug <dir>
2024-11-25T15:57:07Z    DEBUG   No plugins loaded
2024-11-25T15:57:07Z    DEBUG   Default config file "file_path=trivy.yaml" not found, using built in values
2024-11-25T15:57:07Z    DEBUG   Cache dir       dir="/kvm/build/.cache/trivy"
2024-11-25T15:57:07Z    DEBUG   Cache dir       dir="/kvm/build/.cache/trivy"
2024-11-25T15:57:07Z    DEBUG   Parsed severities       severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2024-11-25T15:57:07Z    DEBUG   Ignore statuses statuses=[]
2024-11-25T15:57:07Z    DEBUG   [pkg] Package types     types=[library]
2024-11-25T15:57:07Z    DEBUG   [pkg] Package relationships     relationships=[unknown root direct indirect]
2024-11-25T15:57:07Z    INFO    [license] Full license scanning is enabled
2024-11-25T15:57:07Z    DEBUG   Enabling misconfiguration scanners      scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2024-11-25T15:57:07Z    DEBUG   Initializing scan cache...      type="memory"
2024-11-25T15:57:07Z    DEBUG   [license] License scanning      file_path=".gitlab-ci.d/check-dco.py"
2024-11-25T15:57:07Z    DEBUG   [license] License scanning      file_path=".gitlab/issue_templates/bug.md"
2024-11-25T15:57:07Z    DEBUG   Loading the default license classifier...
2024-11-25T15:57:07Z    DEBUG   [license] License scanning      file_path=".gitlab-ci.d/check-patch.py"
2024-11-25T15:57:07Z    DEBUG   [license] License scanning      file_path=".gitlab/issue_templates/feature_request.md"
2024-11-25T15:57:07Z    DEBUG   [license] License scanning      file_path="LICENSE"
2024-11-25T15:57:08Z    DEBUG   [license] License scanning      file_path="accel/accel-blocker.c"
...
2024-11-25T15:58:04Z    DEBUG   [license] License scanning      file_path="util/yank.c"
2024-11-25T15:58:04Z    DEBUG   OS is not detected.
2024-11-25T15:58:04Z    INFO    Number of language-specific files       num=0
2024-11-25T15:58:04Z    DEBUG   [vex] VEX filtering is disabled
{
  "spdxVersion": "SPDX-2.3",
  "dataLicense": "CC0-1.0",
  "SPDXID": "SPDXRef-DOCUMENT",
  "name": "<dir>",
  "documentNamespace": "http://aquasecurity.github.io/trivy/repository/<dir>-8c4862c5-7fef-4bcb-81b8-b9ccd2bf1d27",
  "creationInfo": {
    "creators": [
      "Organization: aquasecurity",
      "Tool: trivy-0.57.1"
    ],
    "created": "2024-11-25T15:58:04Z"
  },
  "packages": [
    {
      "name": "<dir>",
      "SPDXID": "SPDXRef-Repository-cf8f3f5613dd3e43",
      "downloadLocation": "git+<dir>",
      "filesAnalyzed": false,
      "primaryPackagePurpose": "SOURCE",
      "annotations": [
        {
          "annotator": "Tool: trivy-0.57.1",
          "annotationDate": "2024-11-25T15:58:04Z",
          "annotationType": "OTHER",
          "comment": "SchemaVersion: 2"
        }
      ]
    }
  ],
  "relationships": [
    {
      "spdxElementId": "SPDXRef-DOCUMENT",
      "relatedSpdxElement": "SPDXRef-Repository-cf8f3f5613dd3e43",
      "relationshipType": "DESCRIBES"
    }
  ]
}

Operating System

Rocky Linux 8

Version

$ trivy --version
Version: 0.57.1

Checklist

• Run trivy clean --all
• Read the troubleshooting

[DmitriyLewen]

Hello @srowe
Thanks for your report!

Trivy currently uses Packages to generate reports in SBOM formats and doesn't support generating SBOM formats for licenses from license files.
You can use table or json formats to get list licenses got from --license-full flag.

Regards, Dmitriy