-
Notifications
You must be signed in to change notification settings - Fork 2.7k
Labels
kind/bugCategorizes issue or PR as related to a bug.Categorizes issue or PR as related to a bug.scan/licenseIssues relating to license scanningIssues relating to license scanning
Milestone
Description
Description
Trivy checks licenses that include WITH
separator as multiple licenses when determining license category:
➜ cat trivy-full.yaml
license:
notice:
- Similar to Apache License but with the acknowledgment clause removed
- "Similar to Apache License but with the acknowledgment clause removed" ➜ trivy -q fs ./pom.xml --scanners license --table-mode detailed --config ./trivy-full.yaml
pom.xml (license)
Total: 1 (UNKNOWN: 1, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)
┌───────────────┬──────────────────────────────────────────────────────────────┬────────────────┬──────────┐
│ Package │ License │ Classification │ Severity │
├───────────────┼──────────────────────────────────────────────────────────────┼────────────────┼──────────┤
│ org.jdom:jdom │ Similar to Apache License but with the acknowledgment clause │ Non Standard │ UNKNOWN │
│ │ removed │ │ │
└───────────────┴──────────────────────────────────────────────────────────────┴────────────────┴──────────┘
➜ cat trivy-separated.yaml
license:
notice:
- Similar to Apache License but
- the acknowledgment clause removed
➜ trivy -q fs ./pom.xml --scanners license --table-mode detailed --config ./trivy-separated.yaml
pom.xml (license)
Total: 1 (UNKNOWN: 0, LOW: 1, MEDIUM: 0, HIGH: 0, CRITICAL: 0)
┌───────────────┬──────────────────────────────────────────────────────────────┬────────────────┬──────────┐
│ Package │ License │ Classification │ Severity │
├───────────────┼──────────────────────────────────────────────────────────────┼────────────────┼──────────┤
│ org.jdom:jdom │ Similar to Apache License but with the acknowledgment clause │ Notice │ LOW │
│ │ removed │ │ │
└───────────────┴──────────────────────────────────────────────────────────────┴────────────────┴──────────┘
Discussed in #9371
Metadata
Metadata
Assignees
Labels
kind/bugCategorizes issue or PR as related to a bug.Categorizes issue or PR as related to a bug.scan/licenseIssues relating to license scanningIssues relating to license scanning