DependencyTrack / DependencyTrack/dependency-track

Multiple licenses are not shown

Open
#3,184 5 comments 3 reactions 0 assignees View on GitHub
defect in triage
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

With a license list in the input SBOM like this:

` "licenses": [
{
"license": {
"id": "Apache-1.0"
}
},
{
"license": {
"id": "BSD-2-Clause"
}
},
{
"license": {
"id": "BSD-3-Clause"
}
},
{
"license": {
"name": "Expat"
}
},
{
"license": {
"id": "GPL-2.0-only"
}
},
{
"license": {
"id": "GPL-2.0-or-later"
}
},
{
"license": {
"id": "GPL-2.0-or-later"
}
},
{
"license": {
"id": "ISC"
}
},
{
"license": {
"id": "MIT"
}
},
{
"license": {
"id": "OpenSSL"
}
},
{
"license": {
"name": "RSA-MD5"
}
},
{
"license": {
"name": "public-domain"
}
}
],
`
Dependency-track only shows the "openssl" license in the UI. When exporting, only the "openssl" license remains.

### Steps to Reproduce

1.Full component:
` {
"bom-ref": "pkg:deb/debian/kamailio@5.3.9+bpo10?arch=amd64&distro=debian-10&package-id=5f2965b05f718253",
"type": "library",
"publisher": "Debian VoIP Team ",
"name": "kamailio",
"version": "5.3.9+bpo10",
"licenses": [
{
"license": {
"id": "Apache-1.0"
}
},
{
"license": {
"id": "BSD-2-Clause"
}
},
{
"license": {
"id": "BSD-3-Clause"
}
},
{
"license": {
"name": "Expat"
}
},
{
"license": {
"id": "GPL-2.0-only"
}
},
{
"license": {
"id": "GPL-2.0-or-later"
}
},
{
"license": {
"id": "GPL-2.0-or-later"
}
},
{
"license": {
"id": "ISC"
}
},
{
"license": {
"id": "MIT"
}
},
{
"license": {
"id": "OpenSSL"
}
},
{
"license": {
"name": "RSA-MD5"
}
},
{
"license": {
"name": "public-domain"
}
}
],
"cpe": "cpe:2.3:a:kamailio:kamailio:5.3.9\\+bpo10:*:*:*:*:*:*:*",
"purl": "pkg:deb/debian/kamailio@5.3.9+bpo10?arch=amd64&distro=debian-10",
"properties": [
{
"name": "syft:package:foundBy",
"value": "dpkgdb-cataloger"
},
{
"name": "syft:package:metadataType",
"value": "DpkgMetadata"
},
{
"name": "syft:package:type",
"value": "deb"
},
{
"name": "syft:location:0:path",
"value": "/usr/share/doc/kamailio/copyright"
},
{
"name": "syft:location:1:path",
"value": "/var/lib/dpkg/info/kamailio.conffiles"
},
{
"name": "syft:location:2:path",
"value": "/var/lib/dpkg/info/kamailio.md5sums"
},
{
"name": "syft:location:3:path",
"value": "/var/lib/dpkg/status"
},
{
"name": "syft:metadata:installedSize",
"value": "29095"
}
]
},`

### Expected Behavior

List all licenses, keep all licenses in DB

### Dependency-Track Version

4.8.x

### Dependency-Track Distribution

Executable WAR

### Database Server

PostgreSQL

### Database Server Version

_No response_

### Browser

Apple Safari

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.