Capture licenses for all packages

[kzantow]

Syft should be able to include license information for packages it finds. Sometimes this information is present in the metadata on disk, other times it is only available by some remote source. This is an uber-issue about capturing licenses for all packages. Each ecosystem will likely have a different mechanism of capturing license information.

Ecosystems:

• Apk
• Dpkg
• ALPM
• binary (License not pickedup for binaries like java (openjdk), node (nodejs) #2765)
• Conan (conan.lock)
• Conan (conanfile.txt)
• Dart (pubspec.lock)
• .NET (deps.json) Get licenses for NuGet packages #1227
• .NET (from binary)
• Elixir (mix.lock)
• Erlang (rebar.lock)
• Github actions workflows (workflows using actions)
• Golang (go.mod)
• Golang (binary)
• Haskell (stack.yaml)
• Haskell (stack.yaml.lock)
• Haskell (cabal.project.freeze)
• Java (nested jars)
• Java (pom.xml)
• Java (gradle.lockfile)
• Javascript (package.json) Syft cannot get license from package.json in nested node_modules dir #2330
• Javascript (package-lock.json)
• Javascript (yarn.lock)
• Javascript (pnpm-lock.yaml)
• Kernel modules
• Nix (store)
• PHP (installed.json)
• PHP (composer.lock)
• Portage (contents file)
• Python (poetry.lock)
• Python (setup.py)
• Python (requirements.txt)
• Python (Pipfile.lock)
• Python (egg/wheel metadata)
• R (description file)
• RPM (db)
• RPM (rpm file)
• Ruby (gemfile.lock)
• Ruby (specifications gemspec)
• Rust (cargo.lock)
• Rust (binary)
• SBOM
• Swift (package.resolved)
• Swift (Podfile.lock)

Some related issues:

• Invoke known tools to gather build-time dependency information #1562
• Classify licenses based on file contents #656
• Can not have license ID #1964

[mykaul]

@kzantow - why is Go marked as checked? How do we get the license of Go modules?

[tgerla]

@mykaul check out the golang section of the Syft configuration file: https://github.com/anchore/syft/wiki/configuration -- there are two settings, search-local-mod-cache-licenses and search-remote-licenses that can be enabled to retrieve license data.

[mykaul]

@mykaul check out the golang section of the Syft configuration file: https://github.com/anchore/syft/wiki/configuration -- there are two settings, search-local-mod-cache-licenses and search-remote-licenses that can be enabled to retrieve license data.

Thanks! I think what tricked me is that by default (syft-text?) you do not see the license, so I did not even bother to look further. Very helpful, thanks again.