DependencyTrack / DependencyTrack/dependency-track
Multiple licenses are not shown
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
With a license list in the input SBOM like this:
` "licenses": [
{
"license": {
"id": "Apache-1.0"
}
},
{
"license": {
"id": "BSD-2-Clause"
}
},
{
"license": {
"id": "BSD-3-Clause"
}
},
{
"license": {
"name": "Expat"
}
},
{
"license": {
"id": "GPL-2.0-only"
}
},
{
"license": {
"id": "GPL-2.0-or-later"
}
},
{
"license": {
"id": "GPL-2.0-or-later"
}
},
{
"license": {
"id": "ISC"
}
},
{
"license": {
"id": "MIT"
}
},
{
"license": {
"id": "OpenSSL"
}
},
{
"license": {
"name": "RSA-MD5"
}
},
{
"license": {
"name": "public-domain"
}
}
],
`
Dependency-track only shows the "openssl" license in the UI. When exporting, only the "openssl" license remains.
### Steps to Reproduce
1.Full component:
` {
"bom-ref": "pkg:deb/debian/kamailio@5.3.9+bpo10?arch=amd64&distro=debian-10&package-id=5f2965b05f718253",
"type": "library",
"publisher": "Debian VoIP Team ",
"name": "kamailio",
"version": "5.3.9+bpo10",
"licenses": [
{
"license": {
"id": "Apache-1.0"
}
},
{
"license": {
"id": "BSD-2-Clause"
}
},
{
"license": {
"id": "BSD-3-Clause"
}
},
{
"license": {
"name": "Expat"
}
},
{
"license": {
"id": "GPL-2.0-only"
}
},
{
"license": {
"id": "GPL-2.0-or-later"
}
},
{
"license": {
"id": "GPL-2.0-or-later"
}
},
{
"license": {
"id": "ISC"
}
},
{
"license": {
"id": "MIT"
}
},
{
"license": {
"id": "OpenSSL"
}
},
{
"license": {
"name": "RSA-MD5"
}
},
{
"license": {
"name": "public-domain"
}
}
],
"cpe": "cpe:2.3:a:kamailio:kamailio:5.3.9\\+bpo10:*:*:*:*:*:*:*",
"purl": "pkg:deb/debian/kamailio@5.3.9+bpo10?arch=amd64&distro=debian-10",
"properties": [
{
"name": "syft:package:foundBy",
"value": "dpkgdb-cataloger"
},
{
"name": "syft:package:metadataType",
"value": "DpkgMetadata"
},
{
"name": "syft:package:type",
"value": "deb"
},
{
"name": "syft:location:0:path",
"value": "/usr/share/doc/kamailio/copyright"
},
{
"name": "syft:location:1:path",
"value": "/var/lib/dpkg/info/kamailio.conffiles"
},
{
"name": "syft:location:2:path",
"value": "/var/lib/dpkg/info/kamailio.md5sums"
},
{
"name": "syft:location:3:path",
"value": "/var/lib/dpkg/status"
},
{
"name": "syft:metadata:installedSize",
"value": "29095"
}
]
},`
### Expected Behavior
List all licenses, keep all licenses in DB
### Dependency-Track Version
4.8.x
### Dependency-Track Distribution
Executable WAR
### Database Server
PostgreSQL
### Database Server Version
_No response_
### Browser
Apple Safari
### Checklist
- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Assessment
This issue has not been assessed yet.