anchore / anchore/grant

File-based detection does not work

Open
#411 4 comments 2 reactions 0 assignees View on GitHub
bug
Dominant language
Go
Stars
183
Forks
18
Avg merge
3d 7h
Merged PRs (30d)
7

Description

**What happened**:
grant does not return any result for `LICENSE` file in directory

**What you expected to happen**:
grant should find license in `LICENSE` file and list data

**Steps to reproduce the issue**:
1. Clone grant github repository
2. Run: `grant list dir:`
3. Copy `LICENSE` to another empty directory
4. Run: `grant list dir:`

**Anything else we need to know?**:

(2) For v0.1.1 grant returns:
```
* src/
* Apache License 2.0
* Apache-2.0
* BSD 2-Clause "Simplified" License
* BSD 3-Clause "New" or "Revised" License
* BSD-2-Clause
* BSD-3-Clause
* GNU General Public License v2.0 only
* GNU General Public License v2.0 or later
* GPL-2.0-only
* GPL-2.0-or-later
* GPL-3.0
* MIT
* MIT License
* MPL-2.0
* Mozilla Public License 2.0
* Zlib
* zlib License
```

(4) For v0.1.1 grant returns:
```
* repo/
* Apache-2.0
```

---

grant v0.6.2 returns:

(2)
```
grant list dir:src/grant/
✔ Loaded dir:src/grant/ image
✔ License listing
✔ Cataloged contents
├── ✔ Packages [319 packages]
├── ✔ Licenses [0 unique]
└── ✔ File metadata [319 locations]
✔ Aggregated licenses [grouped by license, desc by count]

LICENSE PACKAGES RISK
(no licenses found) 309 Unknown
```

(4)
```
grant list dir:repo/
✔ Loaded dir:repo/ image
✔ License listing
✔ Cataloged contents
├── ✔ Packages [0 packages]
├── ✔ Licenses [0 unique]
└── ✔ File metadata [0 locations]
✔ Aggregated licenses [grouped by license, desc by count]

LICENSE PACKAGES RISK
```

**Environment**:
- Output of `grant version`:
- OS (e.g: `cat /etc/os-release` or similar): RHEL9

Contributor guide

Open the contributing guide

Research direction

Reproduce the issue with `grant list dir:` and with a directory containing only `LICENSE`, comparing the v0.6.2 output shown here. Trace the file-based license detection path for directories and verify that a standalone LICENSE file is discovered and its license data appears in the listing. Done means both reproduction cases report the expected license rather than no licenses found.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.