Invalid license with the shape text:--*** generating the spdx

[javierfreire]

Description

The SPDX includes invalid licenses with the shape text:--*** like text:--IBM-as-is or text:--BSD-4-clause.

Desired Behavior

This licenses should be avoided or written without the prefix text:--

Actual Behavior

The SPDX includes invalid licenses with the shape text:--***.

Reproduction Steps

1. trivy image bitnami/wordpress:6.6.2-debian-12-r14 --format spdx-json --output spdx.json
2. grep "text:--" spdx.json

      "licenseConcluded": "BSD-4-Clause AND OpenSSL AND SSLeay AND BSD-3-Clause AND BSD-2-Clause AND GPL-3.0-or-later AND GPL-3.0-only AND BSD-4-Clause-UC AND RSA-MD AND BSD-4-clause-KTH AND text:--BSD-4-clause AND IBM-as-is AND BSD-3-clause-JANET AND BSD-3-clause-PADL AND MIT-OpenVision AND OpenLDAP AND FSFULLR AND MIT-CMU AND MIT-Export AND BSD-2.2-clause AND text:--IBM-as-is",
...

Target

None

Scanner

None

Output Format

None

Mode

None

Debug Output

$ trivy image bitnami/wordpress:6.6.2-debian-12-r14 --format spdx-json --output spdx.json --debug

2024-10-30T15:21:14+01:00	DEBUG	No plugins loaded
2024-10-30T15:21:14+01:00	DEBUG	Default config file "file_path=trivy.yaml" not found, using built in values
2024-10-30T15:21:14+01:00	DEBUG	Cache dir	dir="/home/fjavier/.cache/trivy"
2024-10-30T15:21:14+01:00	DEBUG	Cache dir	dir="/home/fjavier/.cache/trivy"
2024-10-30T15:21:14+01:00	DEBUG	Parsed severities	severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2024-10-30T15:21:14+01:00	DEBUG	Ignore statuses	statuses=[]
2024-10-30T15:21:14+01:00	INFO	"--format spdx-json" disables security scanning. Specify "--scanners vuln" explicitly if you want to include vulnerabilities in the "spdx-json" report.
2024-10-30T15:21:14+01:00	DEBUG	[pkg] Package types	types=[os library]
2024-10-30T15:21:14+01:00	DEBUG	[pkg] Package relationships	relationships=[unknown root direct indirect]
2024-10-30T15:21:14+01:00	DEBUG	Enabling misconfiguration scanners	scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2024-10-30T15:21:14+01:00	DEBUG	Initializing scan cache...	type="fs"
2024-10-30T15:21:16+01:00	DEBUG	[image] Detected image ID	image_id="sha256:517d8276ff957c33aca74699431c3267a531da200b3fd74925c6dde56ae4b05d"
2024-10-30T15:21:16+01:00	DEBUG	[image] Detected diff ID	diff_ids=[sha256:3a0e5234a91211976991c4a9898dcb904aaa8de2b8f45e6aad4e9f5afe212e6f]
2024-10-30T15:21:16+01:00	DEBUG	[image] Detected base layers	diff_ids=[]
2024-10-30T15:21:16+01:00	INFO	Detected OS	family="debian" version="12.7"
2024-10-30T15:21:16+01:00	INFO	Number of language-specific files	num=13
2024-10-30T15:21:16+01:00	DEBUG	[vex] VEX filtering is disabled

Operating System

Ubuntu 23.04

Version

Version: 0.56.2
Vulnerability DB:
  Version: 2
  UpdatedAt: 2024-10-30 12:18:34.152287976 +0000 UTC
  NextUpdate: 2024-10-31 12:18:34.152287826 +0000 UTC
  DownloadedAt: 2024-10-30 14:13:00.201034821 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[knqyf263]

@DmitriyLewen Do you know where text:-- comes from?

[DmitriyLewen]

I found reason:
NormalizeForSPDX function overwrites / to - from text:// prefix.

We have #7721 and we need to work on that case in that issue.
I think we need to use that prefix to create the LicenseRef-* component and remove that prefix.

[knqyf263]

OK, thanks for finding it out. Are we closing this discussion and tracking the problem in #7721?

[DmitriyLewen]

I think so.
Because if we just remove the test:// prefix - it will still be incorrect, since we use text in the license field only from the SPDX license list.

[DmitriyLewen]

related issue - #7721