# In syft generated sbom we see license as links https://www.apache.org/licenses/LICENSE-2.0.txt

**URL:** <https://anchorecommunity.discourse.group/t/in-syft-generated-sbom-we-see-license-as-links-https-www-apache-org-licenses-license-2-0-txt/112>\
**Category:** General\
**Created:** [September 1, 2024, 1:28pm UTC](https://anchorecommunity.discourse.group/t/in-syft-generated-sbom-we-see-license-as-links-https-www-apache-org-licenses-license-2-0-txt/112 "2024-09-01T13:28:47Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![anvitha\_haviligi](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/anvitha_haviligi/32/75_2.png) [@anvitha\_haviligi](https://anchorecommunity.discourse.group/u/anvitha_haviligi)\
**Post date:** [September 1, 2024, 1:28pm UTC](https://anchorecommunity.discourse.group/t/in-syft-generated-sbom-we-see-license-as-links-https-www-apache-org-licenses-license-2-0-txt/112/1 "2024-09-01T13:28:47Z")

</div>

Hi All,

Observed URLs in below format for maven components, is this valid ?, so user has to click on the link to know the license ?

```json
{
      "cpe": "cpe:2.3:a:byte-buddy:byte-buddy:1.14.11:*:*:*:*:*:*:*",
      "name": "byte-buddy",
      "purl": "pkg:maven/net.bytebuddy/byte-buddy@1.14.11",
      "type": "library",
      "group": "net.bytebuddy",
      "bom-ref": "pkg:maven/net.bytebuddy/byte-buddy@1.14.11?package-id=da0d5c43d15755fc",
      "version": "1.14.11",
      "licenses": [
        {
          "license": {
            "name": "https://www.apache.org/licenses/LICENSE-2.0.txt"
          }
        }

```

Thanks in advance, Anvitha

---

<div class="post-metadata">

**Author:** ![popey](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/popey/32/429_2.png) [@popey](https://anchorecommunity.discourse.group/u/popey)\
**Post date:** [September 2, 2024, 11:41am UTC](https://anchorecommunity.discourse.group/t/in-syft-generated-sbom-we-see-license-as-links-https-www-apache-org-licenses-license-2-0-txt/112/2 "2024-09-02T11:41:28Z")

</div>

Thanks for the question.

Looking at the [Maven Repository](https://mvnrepository.com/artifact/net.bytebuddy/byte-buddy/1.14.11) entry for byte-buddy, I see this:

 ![image](https://global.discourse-cdn.com/free1/uploads/anchorecommunity/original/1X/03307fef5466ace4ef2ba902cdd1f524e7e936c0.png)

Further, on the upstream repo for [byte-buddy](https://github.com/raphw/byte-buddy) I note the [licenses section](https://github.com/raphw/byte-buddy/blob/master/pom.xml#L129) has the following:

```xml
    <licenses>
        <license>
            <name>Apache License, Version 2.0</name>
            <url>https://www.apache.org/licenses/LICENSE-2.0.txt</url>
            <distribution>repo</distribution>
            <comments>A business-friendly OSS license</comments>
        </license>
    </licenses>

```

So it looks like we’re pulling the URL from the package. I don’t know if that’s intentional or not, and will let a Syft developer speak to that.

---

<div class="post-metadata">

**Author:** ![anvitha\_haviligi](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/anvitha_haviligi/32/75_2.png) [@anvitha\_haviligi](https://anchorecommunity.discourse.group/u/anvitha_haviligi)\
**Post date:** [September 3, 2024, 5:10am UTC](https://anchorecommunity.discourse.group/t/in-syft-generated-sbom-we-see-license-as-links-https-www-apache-org-licenses-license-2-0-txt/112/3 "2024-09-03T05:10:07Z")

</div>

Can anyone from developement team please look into this issue

---

<div class="post-metadata">

**Author:** ![willmurphy](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/willmurphy/32/12_2.png) [@willmurphy](https://anchorecommunity.discourse.group/u/willmurphy)\
**Post date:** [September 3, 2024, 12:11pm UTC](https://anchorecommunity.discourse.group/t/in-syft-generated-sbom-we-see-license-as-links-https-www-apache-org-licenses-license-2-0-txt/112/4 "2024-09-03T12:11:40Z")

</div>

The same issue seems to be present in Syft JSON. I downloaded a few JARs into a test directory and ran the following command:

```sh
syft dir:. -o json | jq '.artifacts[] | { name: .name, licenses: .licenses }'

```

In order to get Syft’s raw JSON output on what licenses it found. Here’s the output:

```json
{
  "name": "byte-buddy",
  "licenses": [
    {
      "value": "https://www.apache.org/licenses/LICENSE-2.0.txt",
      "spdxExpression": "",
      "type": "declared",
      "urls": [],
      "locations": [
        {
          "path": "/byte-buddy-1.14.11.jar",
          "accessPath": "/byte-buddy-1.14.11.jar",
          "annotations": {
            "evidence": "primary"
          }
        }
      ]
    }
  ]
}
{
  "name": "commons-io",
  "licenses": [
    {
      "value": "https://www.apache.org/licenses/LICENSE-2.0.txt",
      "spdxExpression": "",
      "type": "declared",
      "urls": [],
      "locations": [
        {
          "path": "/commons-io-2.16.1.jar",
          "accessPath": "/commons-io-2.16.1.jar",
          "annotations": {
            "evidence": "primary"
          }
        }
      ]
    }
  ]
}
{
  "name": "rxjava",
  "licenses": [
    {
      "value": "Apache-2.0",
      "spdxExpression": "Apache-2.0",
      "type": "concluded",
      "urls": [],
      "locations": [
        {
          "path": "/rxjava-3.1.9.jar",
          "accessPath": "/rxjava-3.1.9.jar",
          "annotations": {
            "evidence": "primary"
          }
        }
      ]
    }
  ]
}

```

It seems like the first two JARS, [`byte-buddy`](https://mvnrepository.com/artifact/net.bytebuddy/byte-buddy/1.14.11) and [`commons-io`](https://mvnrepository.com/artifact/commons-io/commons-io/2.16.1) both have a URL in the `value` field, whereas [`rxjava`](https://mvnrepository.com/artifact/io.reactivex.rxjava3/rxjava/3.1.9) looks like it has `Apache-2.0` in the value field, which seems more correct.

There’s quite a bit of variation in how different JARs represent metadata like licenses internally; it seems likely that we’re mixing up URL and Value fields on some JARs. We will investigate and see if we can improve Syft’s behavior here.

---

<div class="post-metadata">

**Author:** ![willmurphy](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/willmurphy/32/12_2.png) [@willmurphy](https://anchorecommunity.discourse.group/u/willmurphy)\
**Post date:** [September 3, 2024, 12:38pm UTC](https://anchorecommunity.discourse.group/t/in-syft-generated-sbom-we-see-license-as-links-https-www-apache-org-licenses-license-2-0-txt/112/5 "2024-09-03T12:38:05Z")

</div>

I think I’ve found what’s different about these JARs.

In `byte-buddy` and in `commons-io`, we see the following line in the `meta-inf/manifest.mf` file:

```auto
Bundle-License: https://www.apache.org/licenses/LICENSE-2.0.txt

```

But [Syft expects that field to be the license name](https://github.com/anchore/syft/blob/6107e5e2ad6e60f3f74ff4d3b2ca2ccffbed26ed/syft/pkg/cataloger/java/parse_java_manifest.go#L258).

In `rxjava`, we see that there is no such field in the manifest. Because there is no `Bundle-License` field in the manifest (`unzip -p rxjava-3.1.9.jar META-INF/MANIFEST.MF` doesn’t print any `Bundle-License`), so Syft falls back to parsing the license from `META-INF/LICENSE`, which is a copy of the Apache 2.0 license and Syft parses it correctly.

Since this is happening for a few JARs, I’ll open an issue to enhance this parsing.

---

<div class="post-metadata">

**Author:** ![willmurphy](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/willmurphy/32/12_2.png) [@willmurphy](https://anchorecommunity.discourse.group/u/willmurphy)\
**Post date:** [September 3, 2024, 12:51pm UTC](https://anchorecommunity.discourse.group/t/in-syft-generated-sbom-we-see-license-as-links-https-www-apache-org-licenses-license-2-0-txt/112/6 "2024-09-03T12:51:44Z")

</div>

Hi @anvitha_haviligi I’ve filed a bug report for this: [Syft sometimes reports URL for license value when scanning JARs with a URL in `Bundle-License` field of manifest · Issue #3186 · anchore/syft · GitHub](https://github.com/anchore/syft/issues/3186)

You can use that GitHub issue to see when this is resolved.

---

<div class="post-metadata">

**Author:** ![popey](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/popey/32/429_2.png) [@popey](https://anchorecommunity.discourse.group/u/popey)\
**Post date:** [September 3, 2024, 1:41pm UTC](https://anchorecommunity.discourse.group/t/in-syft-generated-sbom-we-see-license-as-links-https-www-apache-org-licenses-license-2-0-txt/112/7 "2024-09-03T13:41:56Z")

</div>

Thanks @willmurphy !

I’ll close this thread here, so conversation can carry on in the issue, now we have one.

Thank you for reporting @anvitha_haviligi

---

<div class="post-metadata">

**Author:** ![popey](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/popey/32/429_2.png) [@popey](https://anchorecommunity.discourse.group/u/popey)\
**Post date:** [September 3, 2024, 1:42pm UTC](https://anchorecommunity.discourse.group/t/in-syft-generated-sbom-we-see-license-as-links-https-www-apache-org-licenses-license-2-0-txt/112/8 "2024-09-03T13:42:02Z")

</div>