Comments (3)
Hi @DatGameh, thanks for the request. This sounds like a reasonable feature (that would probably be disabled by default). Is it something you're interested in working on yourself? We would be happy to give you some pointers. In any case, we will put this in the backlog for the future.
from syft.
Thank you for considering my request @tgerla !
As far as contributions go... I'm curious to know what pointers you have in mind!
I've never made contributions to OSS, and I'm currently discussing if the requirement is really necessary.
But if I do get the chance to contribute, I'd like to know what ideas you have for this.
Edit:
Reading the code, I found the functions responsible for getting the licenses.
If I were to make code changes, would it be done here?
from syft.
That section you linked is just for golang. Each ecosystem has different mechanisms (some undefined) for how to search for and associate licenses to discovered packages.
Enhancing the license struct
The first enhancement would likely be here:
Lines 17 to 32 in 5061b90
This is the core license model shared among syft packages. It currently does not have a field for LicenseText
as Value
and SPDXExpression
are used as the current identifying fields.
Value
is used when the identified license is found to NOT be a valid SPDX Expression.
Making it configurable
Including the full license text is not something we want as a default behavior so it should be turned off for all default runs of syft. Users should be given the option via configuration to toggle this feature on.
Which ecosystem
Given your issue said you need to extract licenses from software in a docker image I imagine multiple ecosystems are required. This directory structure is a rough list of the different cataloger(ecosystem/specifications) that syft supports:
https://github.com/anchore/syft/tree/main/syft/pkg/cataloger
from syft.
Related Issues (20)
- Add ability to use distributed ruleset HOT 1
- Show dependencies for Github Actions
- Issue scanning Poetry Project with Syft 1.6 and cataloger=python-package-cataloger HOT 5
- Nondeterministic SBOM generation HOT 4
- Include repository_url information in PURLs for non-default repository packages
- `License` field in Python package metadata could be name or full text HOT 2
- Python libraries licenses are not gathered HOT 5
- Add CycloneDX 1.6 Support HOT 3
- Add support for java "kar" files
- Syft reports the wrong version of the go package from binary (F/P findings on Grype result) HOT 2
- CycloneDX group field not symmetrically handled by encoder/decoders
- Syft tries to create the cache directory at a location that has no permission HOT 3
- linux-kernel-module cataloger doesn't extract version HOT 7
- "none" under file selection in configuration doesn't work as expected HOT 1
- Use VirtualPath to build Dependencies section HOT 1
- No Supplier for each component within SBOM HOT 2
- Nix cataloger should use find by glob instead of iterating over all files HOT 1
- Control resolver parameters without indexing twice HOT 4
- Supply "depth" information when including relationships
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from syft.