fix: add support for licenses not found on list (#1540)

Signed-off-by: Avi Deitcher <avi@deitcher.net>

syft/formats/common/cyclonedxhelpers/licenses.go

@@ -10,10 +10,11 @@ import (
 func encodeLicenses(p pkg.Package) *cyclonedx.Licenses {
 	lc := cyclonedx.Licenses{}
 	for _, licenseName := range p.Licenses {
-		if value, exists := spdxlicense.ID(licenseName); exists {
+		if value, other, exists := spdxlicense.ID(licenseName); exists {
 			lc = append(lc, cyclonedx.LicenseChoice{
 				License: &cyclonedx.License{
-					ID: value,
+					ID:   value,
+					Name: other,
 				},
 			})
 		}
@@ -28,7 +29,16 @@ func decodeLicenses(c *cyclonedx.Component) (out []string) {
 	if c.Licenses != nil {
 		for _, l := range *c.Licenses {
 			if l.License != nil {
-				out = append(out, l.License.ID)
+				var lic string
+				switch {
+				case l.License.ID != "":
+					lic = l.License.ID
+				case l.License.Name != "":
+					lic = l.License.Name
+				default:
+					continue
+				}
+				out = append(out, lic)
 			}
 		}
 	}

syft/formats/common/cyclonedxhelpers/licenses_test.go

@@ -27,7 +27,9 @@ func Test_encodeLicense(t *testing.T) {
 					"made-up",
 				},
 			},
-			expected: nil,
+			expected: &cyclonedx.Licenses{
+				{License: &cyclonedx.License{Name: "made-up"}},
+			},
 		},
 		{
 			name: "with SPDX license",

syft/formats/common/spdxhelpers/license.go

@@ -22,12 +22,7 @@ func License(p pkg.Package) string {
 	}
 
 	// take all licenses and assume an AND expression; for information about license expressions see https://spdx.github.io/spdx-spec/appendix-IV-SPDX-license-expressions/
-	var parsedLicenses []string
-	for _, l := range p.Licenses {
-		if value, exists := spdxlicense.ID(l); exists {
-			parsedLicenses = append(parsedLicenses, value)
-		}
-	}
+	parsedLicenses := parseLicenses(p.Licenses)
 
 	if len(parsedLicenses) == 0 {
 		return NOASSERTION
@@ -35,3 +30,16 @@ func License(p pkg.Package) string {
 
 	return strings.Join(parsedLicenses, " AND ")
 }
+
+func parseLicenses(raw []string) (parsedLicenses []string) {
+	for _, l := range raw {
+		if value, other, exists := spdxlicense.ID(l); exists {
+			parsed := value
+			if other != "" {
+				parsed = spdxlicense.LicenseRefPrefix + other
+			}
+			parsedLicenses = append(parsedLicenses, parsed)
+		}
+	}
+	return
+}

syft/formats/common/spdxhelpers/license_test.go

@@ -26,7 +26,7 @@ func Test_License(t *testing.T) {
 					"made-up",
 				},
 			},
-			expected: NOASSERTION,
+			expected: "LicenseRef-made-up",
 		},
 		{
 			name: "with SPDX license",

syft/formats/common/spdxhelpers/to_format_model.go

@@ -124,6 +124,7 @@ func ToFormatModel(s sbom.SBOM) *spdx.Document {
 		Packages:      toPackages(s.Artifacts.PackageCatalog, s),
 		Files:         toFiles(s),
 		Relationships: relationships,
+		OtherLicenses: toOtherLicenses(s.Artifacts.PackageCatalog),
 	}
 }
 
@@ -511,6 +512,28 @@ func toFileTypes(metadata *source.FileMetadata) (ty []string) {
 	return ty
 }
 
+func toOtherLicenses(catalog *pkg.Catalog) []*spdx.OtherLicense {
+	licenses := map[string]bool{}
+	for _, pkg := range catalog.Sorted() {
+		for _, license := range parseLicenses(pkg.Licenses) {
+			if strings.HasPrefix(license, spdxlicense.LicenseRefPrefix) {
+				licenses[license] = true
+			}
+		}
+	}
+	var result []*spdx.OtherLicense
+	for license := range licenses {
+		// separate the actual ID from the prefix
+		name := strings.TrimPrefix(license, spdxlicense.LicenseRefPrefix)
+		result = append(result, &spdx.OtherLicense{
+			LicenseIdentifier: license,
+			LicenseName:       name,
+			ExtractedText:     NONE, // we probably should have some extracted text here, but this is good enough for now
+		})
+	}
+	return result
+}
+
 // TODO: handle SPDX excludes file case
 // f file is an "excludes" file, skip it /* exclude SPDX analysis file(s) */
 // see: https://spdx.github.io/spdx-spec/v2.3/package-information/#79-package-verification-code-field