bug(cyclonedx): incorrect field for licenses

[DmitriyLewen]

Description

CycloneDX supports 3 possible fields for licenses:

1. multiple licenses by ID - https://cyclonedx.org/docs/1.6/json/#tab-pane_components_items_licenses_oneOf_i0_items_license_oneOf_i0
2. multiple licenses by Name - https://cyclonedx.org/docs/1.6/json/#tab-pane_components_items_licenses_oneOf_i0_items_license_oneOf_i1
3. SPDX license expression - https://cyclonedx.org/docs/1.6/json/#tab-pane_components_items_licenses_oneOf_i1

We added handaling for SPDX licenses - #8077.
But we don't use similar logic for CycloneDX reports.
We use 2 way (licenses by Name) for all licenses:

trivy/pkg/sbom/cyclonedx/marshal.go

Lines 290 to 292 in 454b894

	License: &cdx.License{
	Name: license,
	},

But there are case when this is incorrect:

1. when license is SPDX license ID, but we use name instead of id
2. when license is SPDX expression (see Unofficial License Names in CycloneDX SBOMs #9033).

Solution

We need to parse each got license before insert in in CycloneDX report:

1. for single license:
   1.2. check that this is SPDX license. Use ID field for SPDX license and name for another license.
2. for multiple licenses
   2.1. Use SPDX expression for valid SPDX expression
   2.2.for other cases split licenses and use name/id field for each license

Discussed in #9033

[villaflaminio]

Thank you for helping!
When using Trivy version 0.66.0 on a Python project, I am not 100% sure of the result about typing_extensions==4.15.0 package scanning:

{
   "bom-ref":"pkg:pypi/typing-extensions@4.15.0",
   "type":"library",
   "name":"typing_extensions",
   "version":"4.15.0",
   "hashes":[
      {
         "alg":"SHA-1",
         "content":"c5c2ce18351f8f2ae0f4a6f7c84c523f342010ee"
      }
   ],
   "licenses":[
      {
         "license":{
            "name":"PSF-2.0"
         }
      }
   ],
   "purl":"pkg:pypi/typing-extensions@4.15.0",
   "properties":[
      {
         "name":"aquasecurity:trivy:FilePath",
         "value":"lib/python3.11/site-packages/typing_extensions-4.15.0.dist-info/METADATA"
      },
      {
         "name":"aquasecurity:trivy:PkgType",
         "value":"python-pkg"
      }
   ]
}

I would have expected ‘id’:‘PSF-2.0’ and not name, since PSF-2.0 appears to be an SPDX licence ID (https://spdx.org/licenses/PSF-2.0.html).

Steps to reproduce:

python3 -m venv venv_dependencies
source venv_dependencies/bin/activate
pip install typing_extensions==4.15.0
deactivate

docker pull aquasec/trivy:0.66.0
docker run -v $PWD:/app -w /app aquasec/trivy:0.66.0 rootfs --scanners license --license-full --format cyclonedx -o report-python.json venv_dependencies

Does anyone have any idea what I'm doing wrong or what's going wrong?

[DmitriyLewen]

Hello @villaflaminio
Thanks for your report!
Created #9491