We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
What happened: When inspecting the SBOM for syft -o json alpine:latest I noticed that ca-certificates-bundle had the following licenses
syft -o json alpine:latest
ca-certificates-bundle
"licenses": [ { "value": "AND", "spdxExpression": "", "type": "declared", "url": [], "locations": [ { "path": "/lib/apk/db/installed", "layerID": "sha256:bb01bd7e32b58b6694c8c3622c230171f1cec24001a82068a8d30d338f420d6c", "annotations": { "evidence": "primary" } } ] }, { "value": "MIT", "spdxExpression": "MIT", "type": "declared", "url": [], "locations": [ { "path": "/lib/apk/db/installed", "layerID": "sha256:bb01bd7e32b58b6694c8c3622c230171f1cec24001a82068a8d30d338f420d6c", "annotations": { "evidence": "primary" } } ] }, { "value": "MPL-2.0", "spdxExpression": "MPL-2.0", "type": "declared", "url": [], "locations": [ { "path": "/lib/apk/db/installed", "layerID": "sha256:bb01bd7e32b58b6694c8c3622c230171f1cec24001a82068a8d30d338f420d6c", "annotations": { "evidence": "primary" } } ] } ],
What you expected to happen: WIth the new changes to licenses I expected a single license:
"licenses": [ { "value": "MIT AND MPL-2.0", "spdxExpression": "MIT AND MPL-2.0", "type": "declared", "url": [], "locations": [ { "path": "/lib/apk/db/installed", "layerID": "sha256:bb01bd7e32b58b6694c8c3622c230171f1cec24001a82068a8d30d338f420d6c", "annotations": { "evidence": "primary" } } ] } ],
Steps to reproduce the issue: Command included above with package name.
Environment:
syft version
main
cat /etc/os-release
The text was updated successfully, but these errors were encountered:
spiffcs
Successfully merging a pull request may close this issue.
What happened:
When inspecting the SBOM for
syft -o json alpine:latest
I noticed thatca-certificates-bundle
had the following licensesWhat you expected to happen:
WIth the new changes to licenses I expected a single license:
Steps to reproduce the issue:
Command included above with package name.
Environment:
syft version
:main
cat /etc/os-release
or similar): macOS Ventura 13.3.1The text was updated successfully, but these errors were encountered: