bug(license): 许可证扫描器会默默丢弃无法通过 SPDX 解析的许可证

□ 说明

如果一个包许可证名称不能被解析为SPDX表达式(例如"CDDL + GPLv2,类路径例外"或"Apache License (2.0) 有Commons Clause"),Trivy不会将这个许可证报告为结论. 表格中缺少“结果”。 JSON报告中的许可证,来自SARIF和总数,甚至有 -- 严重UNKNOWN ' 的许可证,对此没有任何记录。 可解释但未经分类的名字作为未知 ' /`UNKNOWN'报告。

最初在11250号报道.

□再现.

`sbom.cdx.json':

贾森 { "bomFormat":"CycloneDX","CycloneDX","CycloneDX","CycloneDX","CycloneDX","CycloneDX","CycloneDX","CycloneDX","CycloneDX","CycloneDX","CycloneDX","CycloneDX","CycloneDX","CycloneDX","C. "谱":"1.6". "版本": 1, version. "组件":[ { "类型":"图书馆", "姓名":"pkg-valid-spdx","p". "版本":"一.0.0","0.0". "purl":"pkg:maven/example/[email protected]",". "许可证": [{"许可证":{"id":"MIT"}}}] {\fn华文楷体\fs16\1cHE0E0E0} { "类型":"图书馆", "姓名":"pkg-cddl-gpl","p". "版本":"一.0.0","0.0". "purl":"pkg:maven/example/[email protected]". "许可证": [{"许可证":{"姓名":"CDDL + GPLv2 有阶级路径例外"}}} {\fn华文楷体\fs16\1cHE0E0E0} { "类型":"图书馆", "名字":"pkg-commons-clause","Pkg-commons-clause","Pkg-commons-clause","Pkg-commons-clause","Pkg-commons-clause","Pkg-commons-clause","Pkg-commons-clause","Pkg-commons-clause","Pkg-commons-Clause","Pkg-C-Clause","Pkg-","Pkg-","Pkg-","Pkg-","Pkg-","Pkg-","",","Pgggg-",","",",",",",",",",",",",",",",",",",",",",",",",","," "版本":"一.0.0","0.0". "purl":"pkg:maven/example/[email protected]";". "许可证": [{"许可证":{"姓名":"有"共同条款"的Apache许可证(2.0)"}} {\fn黑体\fs22\bord1\shad0\3aHBE\4aH00\fscx67\fscy66\2cHFFFFFF\3cH808080}你觉得呢? [ . ] {\fn黑体\fs22\bord1\shad0\3aHBE\4aH00\fscx67\fscy66\2cHFFFFFF\3cH808080}你觉得呢?

控制台
3美元 sbom -- -- 扫描机许可证 -- -- q sbom.cdx.json

实际结果

据报告,3份许可证中只有1份:

页:1 Java (许可证)

总计:1(韩国:0;低:1;中:0;高:0;极地:0)

┌────────────────────────┬─────────┬────────────────┬──────────┐

• 包件 * 许可证 * 分类 * ├────────────────────────┼─────────┼────────────────┼──────────┤ 校对:Soup └────────────────────────┴─────────┴────────────────┴──────────┘

预期成果

无法解析的名字被报告为`未知 ' /`UNKNOWN':

页:1
Java (许可证)
==============
总计:3起(韩国:2起,低:1起,中:0起,高:0起,重:0起)

┌────────────────────────────┬──────────────────────────────────────────┬────────────────┬──────────┐
* 包件 * 许可证 * 分类 *
├────────────────────────────┼──────────────────────────────────────────┼────────────────┼──────────┤
例如:pkg-cddl-gpl + CDDL + GPLv2 类路径例外 + 未知 + UNKNOWN + +
{\fn黑体\fs22\bord1\shad0\3aHBE\4aH00\fscx67\fscy66\2cHFFFFFF\3cH808080}你觉得呢?
例如:pkg-commons-clause QQ Apache 许可证(2.0) 带有Commons Clause QQQQQQQ
├────────────────────────────┼──────────────────────────────────────────┼────────────────┼──────────┤
校对:Soup
└────────────────────────────┴──────────────────────────────────────────┴────────────────┴──────────┘

□ 根源

若为 . . . . . . .