Syft's license not listed for Grype image

[egertoft]

The SBOM of the Grype image doesn't show Syft's Apache license, only a BSD-3-Cluase license, even though Grype depends on-/includes the Syft module.

$ docker run anchore/syft:latest -q --output syft-json anchore/grype:latest | jq -r '.artifacts[].licenses[].value' | sort -u
BSD-3-Clause

Similar when running on the Syft image, only the BSD-3-Clause license is listed.

Expected to see Grype's and Syft's Apache License plus several other licenses of the included modules.

Versions:

$ docker run anchore/syft:latest version
Application: syft
Version:    0.97.1
BuildDate:  2023-11-17T21:03:07Z
GitCommit:  7cfb5f630a7a2105d49d65eaaaa2e2c06e4eda73
GitDescription: v0.97.1
Platform:   linux/amd64
GoVersion:  go1.21.3
Compiler:   gc

$ docker run anchore/grype:latest version
Application:         grype
Version:             0.73.3
BuildDate:           2023-11-18T13:05:51Z
GitCommit:           dbe2a9515a99ef1c78e22ead0cbf17b29fb1b674
GitDescription:      v0.73.3
Platform:            linux/amd64
GoVersion:           go1.21.4
Compiler:            gc
Syft Version:        v0.97.1
Supported DB Schema: 5

[tgerla]

Hi @egertoft, can you make sure that the following Syft configuration options in the "golang" section are set to true? Like this:

golang:
  search-local-mod-cache-licenses: true
  search-remote-licenses: true

Syft by default doesn't reach out to external services for information, but the first setting will enable searching your local module cache, and the second option will have Syft reach out to golang.org for license information. Hope this helps!

[tgerla]

Since we haven't heard back, I'll go ahead and close this issue but please feel free to reopen it or open a new one if you need more help here. Thanks!