feat: update licenses to including license content when SPDX expressions are unable to be determined (#3366)

---------
Signed-off-by: HeyeOpenSource <opensource@heye-international.com>
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

syft/format/internal/cyclonedxutil/helpers/licenses.go

@@ -1,10 +1,12 @@
 package helpers
 
 import (
+	"encoding/base64"
 	"strings"
 
 	"github.com/CycloneDX/cyclonedx-go"
 
+	"github.com/anchore/syft/internal/licenses"
 	"github.com/anchore/syft/internal/spdxlicense"
 	"github.com/anchore/syft/syft/pkg"
 )
@@ -110,7 +112,7 @@ func separateLicenses(p pkg.Package) (spdx, other cyclonedx.Licenses, expression
 			continue
 		}
 
-		if l.SPDXExpression != "" {
+		if l.SPDXExpression != "" && !strings.HasPrefix(l.SPDXExpression, licenses.UnknownLicensePrefix) {
 			// COMPLEX EXPRESSION CASE
 			ex = append(ex, l.SPDXExpression)
 			continue
@@ -118,17 +120,43 @@ func separateLicenses(p pkg.Package) (spdx, other cyclonedx.Licenses, expression
 
 		// license string that are not valid spdx expressions or ids
 		// we only use license Name here since we cannot guarantee that the license is a valid SPDX expression
-		if len(l.URLs) > 0 {
+		if len(l.URLs) > 0 && !strings.HasPrefix(l.SPDXExpression, licenses.UnknownLicensePrefix) {
 			processLicenseURLs(l, "", &otherc)
 			continue
 		}
-		otherc = append(otherc, cyclonedx.LicenseChoice{
+
+		otherc = append(otherc, processCustomLicense(l)...)
+	}
+	return spdxc, otherc, ex
+}
+
+func processCustomLicense(l pkg.License) cyclonedx.Licenses {
+	result := cyclonedx.Licenses{}
+	if strings.HasPrefix(l.SPDXExpression, licenses.UnknownLicensePrefix) {
+		cyclonedxLicense := &cyclonedx.License{
+			Name: l.SPDXExpression,
+		}
+		if len(l.URLs) > 0 {
+			cyclonedxLicense.URL = l.URLs[0]
+		}
+		if len(l.Contents) > 0 {
+			cyclonedxLicense.Text = &cyclonedx.AttachedText{
+				Content: base64.StdEncoding.EncodeToString([]byte(l.Contents)),
+			}
+			cyclonedxLicense.Text.ContentType = "text/plain"
+			cyclonedxLicense.Text.Encoding = "base64"
+		}
+		result = append(result, cyclonedx.LicenseChoice{
+			License: cyclonedxLicense,
+		})
+	} else {
+		result = append(result, cyclonedx.LicenseChoice{
 			License: &cyclonedx.License{
 				Name: l.Value,
 			},
 		})
 	}
-	return spdxc, otherc, ex
+	return result
 }
 
 func processLicenseURLs(l pkg.License, spdxID string, populate *cyclonedx.Licenses) {

syft/format/internal/spdxutil/helpers/license.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"strings"
 
+	"github.com/anchore/syft/internal/licenses"
 	"github.com/anchore/syft/internal/spdxlicense"
 	"github.com/anchore/syft/syft/license"
 	"github.com/anchore/syft/syft/pkg"
@@ -69,19 +70,26 @@ func ParseLicenses(raw []pkg.License) (concluded, declared []SPDXLicense) {
 		}
 
 		candidate := SPDXLicense{}
-		if l.SPDXExpression != "" {
+		if l.SPDXExpression != "" && !strings.HasPrefix(l.SPDXExpression, licenses.UnknownLicensePrefix) {
 			candidate.ID = l.SPDXExpression
 		} else {
-			// we did not find a valid SPDX license ID so treat as separate license
-			if len(l.Value) <= 64 {
-				// if the license text is less than the size of the hash,
-				// just use it directly so the id is more readable
-				candidate.ID = spdxlicense.LicenseRefPrefix + SanitizeElementID(l.Value)
-			} else {
-				hash := sha256.Sum256([]byte(l.Value))
-				candidate.ID = fmt.Sprintf("%s%x", spdxlicense.LicenseRefPrefix, hash)
-			}
 			candidate.Value = l.Value
+			// we did not find a valid SPDX license ID so treat as separate license
+			if strings.HasPrefix(l.SPDXExpression, licenses.UnknownLicensePrefix) {
+				candidate.ID = spdxlicense.LicenseRefPrefix + SanitizeElementID(l.SPDXExpression)
+				if len(l.Contents) > 0 {
+					candidate.Value = l.Contents
+				}
+			} else {
+				if len(l.Value) <= 64 {
+					// if the license text is less than the size of the hash,
+					// just use it directly so the id is more readable
+					candidate.ID = spdxlicense.LicenseRefPrefix + SanitizeElementID(l.Value)
+				} else {
+					hash := sha256.Sum256([]byte(l.Value))
+					candidate.ID = fmt.Sprintf("%s%x", spdxlicense.LicenseRefPrefix, hash)
+				}
+			}
 		}
 
 		switch l.Type {