License exceptions with a plus sign

[javierfreire]

Description

Trivy returns license expressions that contain exceptions with a plus sign. This is invalid according to the spec. The plus sign can be used with a license identifier, not an exception identifier.

Desired Behavior

The SPDX includes licenses with valid expressions

Actual Behavior

Some licenses generated are invalid, like:
MIT AND all-permissive AND GPL-3.0-only WITH autoconf-exception+ AND BSD-2-Clause AND GPL-3.0-only

Reproduction Steps

1. trivy image bitnami/wordpress --format spdx-json | grep autoconf-exception+

Target

None

Scanner

None

Output Format

SPDX

Mode

None

Debug Output

$ trivy image bitnami/wordpress --format spdx-json --debug

2024-10-30T17:05:00+01:00       DEBUG   No plugins loaded
2024-10-30T17:05:00+01:00       DEBUG   Default config file "file_path=trivy.yaml" not found, using built in values
2024-10-30T17:05:00+01:00       DEBUG   Cache dir       dir="/home/fjavier/.cache/trivy"
2024-10-30T17:05:00+01:00       DEBUG   Cache dir       dir="/home/fjavier/.cache/trivy"
2024-10-30T17:05:00+01:00       DEBUG   Parsed severities       severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2024-10-30T17:05:00+01:00       DEBUG   Ignore statuses statuses=[]
2024-10-30T17:05:00+01:00       INFO    "--format spdx-json" disables security scanning. Specify "--scanners vuln" explicitly if you want to include vulnerabilities in the "spdx-json" report.
2024-10-30T17:05:00+01:00       DEBUG   [pkg] Package types     types=[os library]
2024-10-30T17:05:00+01:00       DEBUG   [pkg] Package relationships     relationships=[unknown root direct indirect]
2024-10-30T17:05:00+01:00       DEBUG   Enabling misconfiguration scanners      scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2024-10-30T17:05:00+01:00       DEBUG   Initializing scan cache...      type="fs"
2024-10-30T17:05:00+01:00       DEBUG   [image] Detected image ID       image_id="sha256:ec82e5c090c19016f8008c6fef63b8a9ca70a35727405d1df1c7ccdebee80fbe"
2024-10-30T17:05:00+01:00       DEBUG   [image] Detected diff ID        diff_ids=[sha256:55ae727ef0f5d6fc99c7fc6a2671e522c9038734b17c1eaf6736491393bc4091]
2024-10-30T17:05:00+01:00       DEBUG   [image] Detected base layers    diff_ids=[]
2024-10-30T17:05:00+01:00       INFO    Detected OS     family="debian" version="12.7"
2024-10-30T17:05:00+01:00       INFO    Number of language-specific files       num=13
2024-10-30T17:05:00+01:00       DEBUG   [vex] VEX filtering is disabled

Operating System

Ubuntu 23.04

Version

Version: 0.56.2

Checklist

• Run trivy clean --all
• Read the troubleshooting

[knqyf263]

Thanks. Track #7838