Description

Java packages often declare their license only as a URL — in the OSGi Bundle-License manifest header or in the pom.xml <license><url> — instead of a name or an SPDX ID.
Until now such URLs were not usable, so these packages carried no license.

This PR builds a reverse "license URL → SPDX ID" index from the seeAlso field of the SPDX license list and uses it to resolve those URLs.

SPDX index (magefiles/spdx.go, pkg/licensing)

• The generator now keeps seeAlso and embeds a normalized URL → SPDX-ID map; licenses.json maps each license ID to its normalized URLs and still doubles as the SPDX license ID list used for validation.
• licensing.NormalizeLicenseURL canonicalizes a URL (scheme, www., trailing slash, document extension, opensource.org /licenses/ vs /license/, case) and unwraps web.archive.org snapshots down to the embedded URL.
• A URL shared by different licenses is dropped as ambiguous; a URL shared only by +/-only/-or-later variants of one family is kept for the lexicographically smallest of those license IDs (which is the bare base when it is present, e.g. GPL-2.0), so the choice is deterministic and always a license that actually lists the URL.
• expression.SPDXLicenseIDByURL performs the lookup and expects an already-normalized URL, mirroring SPDXLicenseID.

Java parsers

• pom.xml: when a <license> has no <name>, fall back to its <url> resolved to an SPDX ID — for both the standalone pom parser and the pom.xml embedded in a JAR.
• OSGi Bundle-License manifest header: unfold wrapped continuation lines (per the JAR File Specification / java.util.jar.Manifest), then for each comma-separated entry resolve its name as an SPDX ID and as a URL, and its ;link= attribute as a URL; entries that resolve to neither (free text, <<EXTERNAL>>) are skipped.
• Unresolved URLs are skipped so a packed LICENSE file is still classified.
• License priority for a JAR's own artifact: pom <name> → pom <url> → Bundle-License → packed LICENSE file.

The expression.SPDXLicenseIDByURL mapping is data-driven from SPDX upstream, so it needs no hand-maintained dictionary.

Before / after

jackson-core declares its license only as a URL in the OSGi Bundle-License manifest header:

$ unzip -p jackson-core-2.9.10.jar META-INF/MANIFEST.MF | grep Bundle-License
Bundle-License: http://www.apache.org/licenses/LICENSE-2.0.txt

Before — the URL is ignored, so no license is reported:

$ trivy rootfs --format json jackson-core-2.9.10.jar \
    | jq -c '.Results[].Packages[] | {Name, Licenses}'
{"Name":"com.fasterxml.jackson.core:jackson-core","Licenses":null}

After — the URL is resolved to its SPDX ID:

$ trivy rootfs --format json jackson-core-2.9.10.jar \
    | jq -c '.Results[].Packages[] | {Name, Licenses}'
{"Name":"com.fasterxml.jackson.core:jackson-core","Licenses":["Apache-2.0"]}

Binary size

The embedded SPDX seeAlso data and the new code add ~81 KiB (+0.04%) to the release binary.

Related issues

• feat(java): add license support for jar files #4734

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options).
• I've included a "before" and "after" example to the description.