feat(java): detect JAR licenses from packaged LICENSE files

Author: nikpivkin

docs/guide/coverage/language/java.md

@@ -38,9 +38,15 @@ To find information about these JARs[^2], the same logic is used as for the base
 `table` format only contains the name of root JAR[^2] . To get the full path to inner JARs[^2] use the `json` format.
 
 ### Licenses
-Trivy detects licenses declared in the `<licenses>` block of the embedded `META-INF/maven/<groupId>/<artifactId>/pom.xml` and attaches them to the matching package.
+Trivy detects licenses for a JAR[^2] from two sources, in this order:
 
-Coverage is limited: many JARs declare a license only in a parent POM (which is not expanded in the embedded `pom.xml`) or ship no Maven descriptor at all.
+1. **Embedded POM** — the `<licenses>` block of the embedded `META-INF/maven/<groupId>/<artifactId>/pom.xml`, matched to the package by `groupId:artifactId`.
+2. **License files** — `LICENSE`, `LICENCE` or `COPYRIGHT` files (including variants like `LICENSE.txt`) located at the JAR[^2] root or directly under `META-INF/`. Their content is classified with the [license classifier](../../scanner/license.md). A license file carries no `groupId:artifactId`, so it is attached only when the JAR[^2] contains a single artifact; in uber/shaded JARs[^2] (multiple artifacts) the owner is ambiguous and such files are skipped.
+
+Notes and limitations:
+
+- Coverage is limited: many JARs[^2] declare a license only in a parent POM (which is not expanded in the embedded `pom.xml`) or ship no Maven descriptor at all.
+- A single license file may bundle the texts of third-party components (e.g. Spring or Tomcat artifacts), so a package can be reported with several licenses found in that file, not only its own.
 
 ## pom.xml
 Trivy parses your `pom.xml` file and tries to find files with dependencies from these local locations.

pkg/dependency/parser/java/jar/parse.go

@@ -17,15 +17,24 @@ import (
 	"strings"
 
 	mavenversion "github.com/masahiro331/go-mvn-version"
+	"github.com/samber/lo"
 	"golang.org/x/net/html/charset"
 	"golang.org/x/xerrors"
 
 	ftypes "github.com/aquasecurity/trivy/pkg/fanal/types"
+	"github.com/aquasecurity/trivy/pkg/licensing"
 	"github.com/aquasecurity/trivy/pkg/log"
+	"github.com/aquasecurity/trivy/pkg/set"
 	xio "github.com/aquasecurity/trivy/pkg/x/io"
 	xos "github.com/aquasecurity/trivy/pkg/x/os"
 )
 
+// licenseFileStems are the base names (without extension) of files treated as
+// license files inside a jar, matched case-insensitively. It mirrors the set used
+// by the standalone license file analyzer (its acceptedFileNames), but matching is
+// done on the stem so common variants like LICENSE.txt are also recognized.
+var licenseFileStems = set.NewCaseInsensitive("license", "licence", "copyright")
+
 var (
 	jarFileRegEx = regexp.MustCompile(`^([a-zA-Z0-9\._-]*[^-*])-(\d\S*(?:-SNAPSHOT)?).jar$`)
 )
@@ -41,6 +50,9 @@ type Parser struct {
 	rootFilePath string
 	offline      bool
 	size         int64
+	// licenseConfidenceLevel is the confidence threshold for classifying
+	// LICENSE files packed in a jar.
+	licenseConfidenceLevel float64
 
 	client Client
 }
@@ -65,6 +77,12 @@ func WithSize(size int64) Option {
 	}
 }
 
+func WithLicenseClassifierConfidenceLevel(level float64) Option {
+	return func(p *Parser) {
+		p.licenseConfidenceLevel = level
+	}
+}
+
 func NewParser(c Client, opts ...Option) *Parser {
 	p := &Parser{
 		logger: log.WithPrefix("jar"),
@@ -93,15 +111,16 @@ func (p *Parser) parseArtifact(filePath string, size int64, r xio.ReadSeekerAt)
 	// e.g. spring-core-5.3.4-SNAPSHOT.jar => sprint-core, 5.3.4-SNAPSHOT
 	fileProps := parseFileName(filePath)
 
-	pkgs, m, foundPomProps, licenses, err := p.traverseZip(filePath, size, r, fileProps)
+	ac, err := p.traverseZip(filePath, size, r, fileProps)
 	if err != nil {
 		return nil, nil, xerrors.Errorf("zip error: %w", err)
 	}
+	pkgs := ac.pkgs
 
 	// If pom.properties is found, it should be preferred than MANIFEST.MF.
 	// Otherwise, resolve the artifact of the jar itself from MANIFEST.MF / SHA-1 / file name.
-	if !foundPomProps {
-		props, found, err := p.resolveArtifact(filePath, r, m, fileProps)
+	if !ac.foundPomProps {
+		props, found, err := p.resolveArtifact(filePath, r, ac.manifest, fileProps)
 		if err != nil {
 			return nil, nil, err
 		}
@@ -110,19 +129,55 @@ func (p *Parser) parseArtifact(filePath string, size int64, r xio.ReadSeekerAt)
 		}
 	}
 
-	// Attach licenses from embedded pom.xml, matched by "groupID:artifactID".
+	// Attach licenses declared in the embedded pom.xml, matched by "groupID:artifactID".
+	attachPomLicenses(pkgs, ac.pomLicenses)
+
+	// Attach licenses classified from LICENSE files.
+	attachFileLicenses(pkgs, filePath, ac.fileLicenses)
+
+	return pkgs, nil, nil
+}
+
+// attachPomLicenses attaches licenses declared in embedded pom.xml files to packages,
+// matched by "groupID:artifactID". Packages that already have a license (e.g. set by a
+// nested jar from its own pom.xml) are left untouched.
+func attachPomLicenses(pkgs []ftypes.Package, pomLicenses map[string][]string) {
 	for i := range pkgs {
 		pkg := &pkgs[i]
-		// Keep licenses already set by a nested jar from its own pom.xml.
 		if len(pkg.Licenses) > 0 {
 			continue
 		}
-		if names, ok := licenses[pkg.Name]; ok {
+		if names, ok := pomLicenses[pkg.Name]; ok {
 			pkg.Licenses = names
 		}
 	}
+}
+
+// attachFileLicenses attaches licenses classified from LICENSE files to the jar's
+// own package, but only when the jar contains a single artifact and that package
+// has no license yet.
+func attachFileLicenses(pkgs []ftypes.Package, filePath string, fileLicenses []string) {
+	if len(fileLicenses) == 0 {
+		return
+	}
+
+	var own []int
+	for i := range pkgs {
+		if pkgs[i].FilePath == filePath {
+			own = append(own, i)
+		}
+	}
 
-	return pkgs, nil, nil
+	if len(own) != 1 {
+		// Zero (nothing to attribute) or multiple (uber/shaded: the LICENSE owner
+		// is ambiguous) packages belong to this jar.
+		return
+	}
+
+	pkg := &pkgs[own[0]]
+	if len(pkg.Licenses) == 0 {
+		pkg.Licenses = lo.Uniq(fileLicenses)
+	}
 }
 
 // resolveArtifact determines the artifact of the jar itself when pom.properties is absent,
@@ -178,20 +233,29 @@ func (p *Parser) resolveArtifact(filePath string, r xio.ReadSeekerAt, m manifest
 	return Properties{}, false, nil
 }
 
-func (p *Parser) traverseZip(filePath string, size int64, r xio.ReadSeekerAt, fileProps Properties) (
-	[]ftypes.Package, manifest, bool, map[string][]string, error) {
-	var pkgs []ftypes.Package
-	var m manifest
-	var foundPomProps bool
+// artifactContents holds everything extracted from a single jar in one zip traversal.
+type artifactContents struct {
+	pkgs     []ftypes.Package
+	manifest manifest
+	// foundPomProps is true when a pom.properties for the jar itself was found.
+	foundPomProps bool
+	// pomLicenses holds licenses declared in embedded META-INF/maven/<g>/<a>/pom.xml,
+	// keyed by "groupID:artifactID". The path carries no version, so packages are
+	// matched by G:A after the traversal (file order in the zip is not guaranteed).
+	pomLicenses map[string][]string
+	// fileLicenses holds licenses classified from LICENSE files at the jar root and
+	// top-level META-INF/. They are attributed only when the jar has a single artifact.
+	fileLicenses []string
+}
 
-	// Licenses declared in embedded META-INF/maven/<g>/<a>/pom.xml, keyed by "groupID:artifactID".
-	// The path carries no version, so packages are matched by G:A after the loop
-	// (file order in the zip is not guaranteed).
-	licenses := make(map[string][]string)
+func (p *Parser) traverseZip(filePath string, size int64, r xio.ReadSeekerAt, fileProps Properties) (artifactContents, error) {
+	ac := artifactContents{
+		pomLicenses: make(map[string][]string),
+	}
 
 	zr, err := zip.NewReader(r, size)
 	if err != nil {
-		return nil, manifest{}, false, nil, xerrors.Errorf("zip error: %w", err)
+		return artifactContents{}, xerrors.Errorf("zip error: %w", err)
 	}
 
 	for _, fileInJar := range zr.File {
@@ -203,41 +267,52 @@ func (p *Parser) traverseZip(filePath string, size int64, r xio.ReadSeekerAt, fi
 				continue
 			}
 			if len(names) > 0 {
-				licenses[packageName(groupID, artifactID)] = names
+				ac.pomLicenses[packageName(groupID, artifactID)] = names
 			}
 			continue
 		}
 
+		// Collect licenses classified from a LICENSE file.
+		if isJarLicenseFile(fileInJar.Name) {
+			names, err := p.classifyPackedLicense(fileInJar)
+			if err != nil {
+				p.logger.Debug("Failed to classify license file", log.String("file", fileInJar.Name), log.Err(err))
+				continue
+			}
+			ac.fileLicenses = append(ac.fileLicenses, names...)
+			continue
+		}
+
 		switch {
 		case filepath.Base(fileInJar.Name) == "pom.properties":
 			props, err := parsePomProperties(fileInJar, filePath)
 			if err != nil {
-				return nil, manifest{}, false, nil, xerrors.Errorf("failed to parse %s: %w", fileInJar.Name, err)
+				return artifactContents{}, xerrors.Errorf("failed to parse %s: %w", fileInJar.Name, err)
 			}
 			// Validation of props to avoid getting packages with empty Name/Version
 			if props.Valid() {
-				pkgs = append(pkgs, props.Package())
+				ac.pkgs = append(ac.pkgs, props.Package())
 
 				// Check if the pom.properties is for the original JAR/WAR/EAR
 				if fileProps.ArtifactID == props.ArtifactID && fileProps.Version == props.Version {
-					foundPomProps = true
+					ac.foundPomProps = true
 				}
 			}
 		case filepath.Base(fileInJar.Name) == "MANIFEST.MF":
-			m, err = parseManifest(fileInJar)
+			ac.manifest, err = parseManifest(fileInJar)
 			if err != nil {
-				return nil, manifest{}, false, nil, xerrors.Errorf("failed to parse MANIFEST.MF: %w", err)
+				return artifactContents{}, xerrors.Errorf("failed to parse MANIFEST.MF: %w", err)
 			}
 		case isArtifact(fileInJar.Name):
 			innerPkgs, _, err := p.parseInnerJar(fileInJar, filePath) // TODO process inner deps
 			if err != nil {
 				p.logger.Debug("Failed to parse", log.String("file", fileInJar.Name), log.Err(err))
 				continue
 			}
-			pkgs = append(pkgs, innerPkgs...)
+			ac.pkgs = append(ac.pkgs, innerPkgs...)
 		}
 	}
-	return pkgs, m, foundPomProps, licenses, nil
+	return ac, nil
 }
 
 func (p *Parser) parseInnerJar(zf *zip.File, rootPath string) ([]ftypes.Package, []ftypes.Dependency, error) {
@@ -404,6 +479,40 @@ func decodePomLicenses(r io.Reader) ([]string, error) {
 	return names, nil
 }
 
+// isJarLicenseFile reports whether a zip entry is a license file eligible for
+// classification: located at the jar root or directly under META-INF/ (not in a subdirectory),
+// with a base name whose stem is license/licence/copyright (e.g. LICENSE, LICENSE.txt).
+// Vendored licenses use prefixed names (e.g. FastDoubleParser-LICENSE) or nested
+// paths, so they are intentionally excluded.
+func isJarLicenseFile(name string) bool {
+	dir := path.Dir(name)
+	if dir != "." && dir != "META-INF" {
+		return false
+	}
+	base := path.Base(name)
+	stem := strings.TrimSuffix(base, path.Ext(base))
+	return licenseFileStems.Contains(stem)
+}
+
+// classifyPackedLicense classifies a LICENSE file packed in a jar and returns the
+// detected license names.
+func (p *Parser) classifyPackedLicense(f *zip.File) ([]string, error) {
+	file, err := f.Open()
+	if err != nil {
+		return nil, xerrors.Errorf("unable to open %s: %w", f.Name, err)
+	}
+	defer file.Close()
+
+	lf, err := licensing.Classify(f.Name, file, p.licenseConfidenceLevel)
+	if err != nil {
+		return nil, xerrors.Errorf("license classification error: %w", err)
+	}
+	if lf == nil {
+		return nil, nil
+	}
+	return lf.Findings.Names(), nil
+}
+
 type manifest struct {
 	implementationVersion  string
 	implementationTitle    string

pkg/dependency/parser/java/jar/parse_test.go

@@ -65,6 +65,7 @@ var (
 			Name:     "org.apache.commons:commons-lang3",
 			Version:  "3.11",
 			FilePath: "testdata/maven.war/WEB-INF/lib/commons-lang3-3.11.jar",
+			Licenses: []string{"Apache-2.0"},
 		},
 	}
 
@@ -77,11 +78,13 @@ var (
 			Name:     "commons-dbcp:commons-dbcp",
 			Version:  "1.4",
 			FilePath: "testdata/gradle.war/WEB-INF/lib/commons-dbcp-1.4.jar",
+			Licenses: []string{"Apache-2.0"},
 		},
 		{
 			Name:     "commons-pool:commons-pool",
 			Version:  "1.6",
 			FilePath: "testdata/gradle.war/WEB-INF/lib/commons-pool-1.6.jar",
+			Licenses: []string{"Apache-2.0"},
 		},
 		{
 			Name:     "log4j:log4j",
@@ -93,6 +96,7 @@ var (
 			Name:     "org.apache.commons:commons-compress",
 			Version:  "1.19",
 			FilePath: "testdata/gradle.war/WEB-INF/lib/commons-compress-1.19.jar",
+			Licenses: []string{"Apache-2.0"},
 		},
 	}
 

pkg/fanal/analyzer/language/java/jar/jar.go

@@ -33,12 +33,14 @@ var requiredExtensions = []string{
 
 // javaLibraryAnalyzer analyzes jar/war/ear/par files
 type javaLibraryAnalyzer struct {
-	parallel int
+	parallel                         int
+	licenseClassifierConfidenceLevel float64
 }
 
 func newJavaLibraryAnalyzer(options analyzer.AnalyzerOptions) (analyzer.PostAnalyzer, error) {
 	return &javaLibraryAnalyzer{
-		parallel: options.Parallel,
+		parallel:                         options.Parallel,
+		licenseClassifierConfidenceLevel: options.LicenseScannerOption.ClassifierConfidenceLevel,
 	}, nil
 }
 
@@ -57,7 +59,8 @@ func (a *javaLibraryAnalyzer) PostAnalyze(ctx context.Context, input analyzer.Po
 
 	// It will be called on each JAR file
 	onFile := func(path string, info fs.FileInfo, r xio.ReadSeekerAt) (*types.Application, error) {
-		p := jar.NewParser(client, jar.WithSize(info.Size()), jar.WithFilePath(path))
+		p := jar.NewParser(client, jar.WithSize(info.Size()), jar.WithFilePath(path),
+			jar.WithLicenseClassifierConfidenceLevel(a.licenseClassifierConfidenceLevel))
 		return language.ParsePackage(ctx, types.Jar, path, r, p, input.Options.FileChecksum)
 	}
 

pkg/fanal/analyzer/language/java/jar/jar_test.go

@@ -69,6 +69,7 @@ func Test_javaLibraryAnalyzer_Analyze(t *testing.T) {
 								Name:     "org.apache.commons:commons-lang3",
 								FilePath: "testdata/test.war/WEB-INF/lib/commons-lang3-3.11.jar",
 								Version:  "3.11",
+								Licenses: []string{"Apache-2.0"},
 							},
 							{
 								Name:     "com.example:web-app",
@@ -114,6 +115,7 @@ func Test_javaLibraryAnalyzer_Analyze(t *testing.T) {
 								Name:     "org.apache.tomcat.embed:tomcat-embed-websocket",
 								FilePath: "testdata/test.jar",
 								Version:  "9.0.65",
+								Licenses: []string{"Apache-2.0"},
 							},
 						},
 					},