Full license scan only returns results when --format not set

[srowe]

Description

Scanning source code repository without defining any output format produces correct output

bash-4.4$ trivy repo --scanners license --license-full --license-confidence-level 0.8 <dir>
2024-11-25T15:31:40Z	INFO	[license] Full license scanning is enabled

Loose File License(s) (license)

Total: 2598 (UNKNOWN: 3, LOW: 821, MEDIUM: 0, HIGH: 1774, CRITICAL: 0)
...
table follows

However adding --format spdx-json results in output that contains no license information.

Desired Behavior

JSON file containing packages with licenseDeclared entries.

Actual Behavior

$ trivy repo --scanners license --license-full --license-confidence-level 0.8 --format spdx-json <dir>
2024-11-25T15:45:42Z	INFO	[license] Full license scanning is enabled
2024-11-25T15:46:39Z	INFO	Number of language-specific files	num=0
{
  "spdxVersion": "SPDX-2.3",
  "dataLicense": "CC0-1.0",
  "SPDXID": "SPDXRef-DOCUMENT",
  "name": "<dir>",
  "documentNamespace": "http://aquasecurity.github.io/trivy/repository/<dir>-9bd394ef-35d8-4c27-879a-1f942cfce5b8",
  "creationInfo": {
    "creators": [
      "Organization: aquasecurity",
      "Tool: trivy-0.57.1"
    ],
    "created": "2024-11-25T15:46:39Z"
  },
  "packages": [
    {
      "name": "<dir>",
      "SPDXID": "SPDXRef-Repository-cf8f3f5613dd3e43",
      "downloadLocation": "git+<dir>",
      "filesAnalyzed": false,
      "primaryPackagePurpose": "SOURCE",
      "annotations": [
        {
          "annotator": "Tool: trivy-0.57.1",
          "annotationDate": "2024-11-25T15:46:39Z",
          "annotationType": "OTHER",
          "comment": "SchemaVersion: 2"
        }
      ]
    }
  ],
  "relationships": [
    {
      "spdxElementId": "SPDXRef-DOCUMENT",
      "relatedSpdxElement": "SPDXRef-Repository-cf8f3f5613dd3e43",
      "relationshipType": "DESCRIBES"
    }
  ]
}

Reproduction Steps

1. run scanner
2. check results

Target

Git Repository

Scanner

License

Output Format

JSON

Mode

Standalone

Debug Output

$ trivy repo --scanners license --license-full --license-confidence-level 0.8 --format spdx-json --debug <dir>
2024-11-25T15:57:07Z    DEBUG   No plugins loaded
2024-11-25T15:57:07Z    DEBUG   Default config file "file_path=trivy.yaml" not found, using built in values
2024-11-25T15:57:07Z    DEBUG   Cache dir       dir="/kvm/build/.cache/trivy"
2024-11-25T15:57:07Z    DEBUG   Cache dir       dir="/kvm/build/.cache/trivy"
2024-11-25T15:57:07Z    DEBUG   Parsed severities       severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2024-11-25T15:57:07Z    DEBUG   Ignore statuses statuses=[]
2024-11-25T15:57:07Z    DEBUG   [pkg] Package types     types=[library]
2024-11-25T15:57:07Z    DEBUG   [pkg] Package relationships     relationships=[unknown root direct indirect]
2024-11-25T15:57:07Z    INFO    [license] Full license scanning is enabled
2024-11-25T15:57:07Z    DEBUG   Enabling misconfiguration scanners      scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2024-11-25T15:57:07Z    DEBUG   Initializing scan cache...      type="memory"
2024-11-25T15:57:07Z    DEBUG   [license] License scanning      file_path=".gitlab-ci.d/check-dco.py"
2024-11-25T15:57:07Z    DEBUG   [license] License scanning      file_path=".gitlab/issue_templates/bug.md"
2024-11-25T15:57:07Z    DEBUG   Loading the default license classifier...
2024-11-25T15:57:07Z    DEBUG   [license] License scanning      file_path=".gitlab-ci.d/check-patch.py"
2024-11-25T15:57:07Z    DEBUG   [license] License scanning      file_path=".gitlab/issue_templates/feature_request.md"
2024-11-25T15:57:07Z    DEBUG   [license] License scanning      file_path="LICENSE"
2024-11-25T15:57:08Z    DEBUG   [license] License scanning      file_path="accel/accel-blocker.c"
...
2024-11-25T15:58:04Z    DEBUG   [license] License scanning      file_path="util/yank.c"
2024-11-25T15:58:04Z    DEBUG   OS is not detected.
2024-11-25T15:58:04Z    INFO    Number of language-specific files       num=0
2024-11-25T15:58:04Z    DEBUG   [vex] VEX filtering is disabled
{
  "spdxVersion": "SPDX-2.3",
  "dataLicense": "CC0-1.0",
  "SPDXID": "SPDXRef-DOCUMENT",
  "name": "<dir>",
  "documentNamespace": "http://aquasecurity.github.io/trivy/repository/<dir>-8c4862c5-7fef-4bcb-81b8-b9ccd2bf1d27",
  "creationInfo": {
    "creators": [
      "Organization: aquasecurity",
      "Tool: trivy-0.57.1"
    ],
    "created": "2024-11-25T15:58:04Z"
  },
  "packages": [
    {
      "name": "<dir>",
      "SPDXID": "SPDXRef-Repository-cf8f3f5613dd3e43",
      "downloadLocation": "git+<dir>",
      "filesAnalyzed": false,
      "primaryPackagePurpose": "SOURCE",
      "annotations": [
        {
          "annotator": "Tool: trivy-0.57.1",
          "annotationDate": "2024-11-25T15:58:04Z",
          "annotationType": "OTHER",
          "comment": "SchemaVersion: 2"
        }
      ]
    }
  ],
  "relationships": [
    {
      "spdxElementId": "SPDXRef-DOCUMENT",
      "relatedSpdxElement": "SPDXRef-Repository-cf8f3f5613dd3e43",
      "relationshipType": "DESCRIBES"
    }
  ]
}

Operating System

Rocky Linux 8

Version

$ trivy --version
Version: 0.57.1

Checklist

• Run trivy clean --all
• Read the troubleshooting