Lots of "license acquired" spam despite license scanner not enabled #8159

sparrowt · 2024-12-23T10:16:25Z

sparrowt
Dec 23, 2024

Description

When using only the vuln scanner, for some reason trivy still outputs a whole bunch of log spam about "license acquired" like this:

$ ./trivy image --severity LOW,MEDIUM,HIGH,CRITICAL --exit-code 1 --scanners vuln myimage:mytag
2024-12-23T09:55:43Z    INFO    [vuln] Vulnerability scanning is enabled
2024-12-23T09:55:54Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="gpg" version="1.15.1"
2024-12-23T09:55:54Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="libcomps" version="0.1.20"
2024-12-23T09:55:57Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="APScheduler" version="3.10.4"
2024-12-23T09:55:57Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="Django" version="4.2.17"
2024-12-23T09:55:57Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="PyJWT" version="2.8.0"
2024-12-23T09:55:57Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="asgiref" version="3.8.1"
2024-12-23T09:55:57Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="boto3" version="1.34.130"
2024-12-23T09:55:57Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="botocore" version="1.34.130"
2024-12-23T09:55:57Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="certifi" version="2024.7.4"
...
<lots more of the same>
...
2024-12-23T09:55:58Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="tzdata" version="2024.1"
2024-12-23T09:55:58Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="tzlocal" version="4.3"
2024-12-23T09:55:58Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="wrapt" version="1.16.0"
2024-12-23T09:55:58Z    INFO    Detected OS     family="amazon" version="2023.6.20241209 (Amazon Linux)"
2024-12-23T09:55:58Z    INFO    [amazon] Detecting vulnerabilities...   os_version="2023" pkg_num=108
2024-12-23T09:55:58Z    INFO    Number of language-specific files       num=1
2024-12-23T09:55:58Z    INFO    [python-pkg] Detecting vulnerabilities...

I would expect the license scanner to be disabled (and indeed the full license output is not shown) so why is there all this spam about licenses during the vulnerability scan?

Interestingly on a subsequent run this is not repeated, but it reproduces again after trivy clean --scan-cache.

I realise it's possible to pass --quiet but I'd like to see the other INFO lines for example "Detected OS" rather than hiding everything.

Desired Behavior

Not to have 38 lines of license-related spam output to the console when I am only interested in vuln/secret scanners.

Actual Behavior

Received 38 lines of undesirable spam as above.

Reproduction Steps

1. Build a docker image with a bunch of python packages installed inside Amazon Linux 2023
2. Scan it with `trivy image --severity LOW,MEDIUM,HIGH,CRITICAL --exit-code 1 myimage:mytag`
3. Observe the spam as above

Target

Container Image

Scanner

Vulnerability

Output Format

Table

Mode

Standalone

Debug Output

2024-12-23T10:09:59Z    DEBUG   No plugins loaded
2024-12-23T10:09:59Z    DEBUG   Default config file "file_path=trivy.yaml" not found, using built in values
2024-12-23T10:09:59Z    DEBUG   Cache dir       dir="/home/myuser/.cache/trivy"
2024-12-23T10:09:59Z    DEBUG   Cache dir       dir="/home/myuser/.cache/trivy"
2024-12-23T10:09:59Z    DEBUG   Parsed severities       severities=[LOW MEDIUM HIGH CRITICAL]
2024-12-23T10:09:59Z    DEBUG   Ignore statuses statuses=[]
2024-12-23T10:09:59Z    DEBUG   DB update was skipped because the local DB is the latest
2024-12-23T10:09:59Z    DEBUG   DB info schema=2 updated_at=2024-12-23T06:17:41.732111911Z next_update=2024-12-24T06:17:41.732111471Z downloaded_at=2024-12-23T09:34:10.732772026Z
2024-12-23T10:09:59Z    DEBUG   [pkg] Package types     types=[os library]
2024-12-23T10:09:59Z    DEBUG   [pkg] Package relationships     relationships=[unknown root workspace direct indirect]
2024-12-23T10:09:59Z    INFO    [vuln] Vulnerability scanning is enabled
2024-12-23T10:09:59Z    DEBUG   Enabling misconfiguration scanners      scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2024-12-23T10:09:59Z    DEBUG   Initializing scan cache...      type="fs"
2024-12-23T10:09:59Z    DEBUG   [image] Detected image ID       image_id="sha256:8f4c9baf49e84f365d6d8426b3cb5e32a1a5774ac8675457fdca11ada980aba0"
2024-12-23T10:09:59Z    DEBUG   [image] Detected diff ID        diff_ids=[sha256:57b846d5add8173c1ed2dca93bff3bce0fcffa1a832c46dea10bb946bdfe8946 sha256:68c80f582ffb9a1b57bfaf68376ea23af210f8c7c268b2d9448a28c7b016f43c sha256:07cc49e016e391ed2771c85e1d02e09849d0a70519b353f00710c9eecbca197b sha256:cf208c4bf799ee105161048793a42a223e8f68e77f7aae69d39fb40b6a84cb74 sha256:fcc59c6bd513b792912dfa9270ff54d5180731748689691e0949a66e2d9a08cf sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef sha256:d16e3b1ab06b4fdf5ff5c4455bd7fa102c4b21141cfc4068927d8e1a6f3d6f5d sha256:85a16bd9c22bbbaa8d6170ad0e7eaede9b4720f33616f4b185c429c650af8dd8 sha256:7a761c834a8ef197f2d9c79a71dc75df47cd9738c0c4f2fc318a7d1a42e2988f]
2024-12-23T10:09:59Z    DEBUG   [image] Detected base layers    diff_ids=[sha256:57b846d5add8173c1ed2dca93bff3bce0fcffa1a832c46dea10bb946bdfe8946]
2024-12-23T10:09:59Z    DEBUG   [image] Missing image ID in cache       image_id="sha256:8f4c9baf49e84f365d6d8426b3cb5e32a1a5774ac8675457fdca11ada980aba0"
2024-12-23T10:09:59Z    DEBUG   [image] Missing diff ID in cache        diff_id="sha256:07cc49e016e391ed2771c85e1d02e09849d0a70519b353f00710c9eecbca197b"
2024-12-23T10:09:59Z    DEBUG   [image] Missing diff ID in cache        diff_id="sha256:68c80f582ffb9a1b57bfaf68376ea23af210f8c7c268b2d9448a28c7b016f43c"
2024-12-23T10:09:59Z    DEBUG   [image] Missing diff ID in cache        diff_id="sha256:cf208c4bf799ee105161048793a42a223e8f68e77f7aae69d39fb40b6a84cb74"
2024-12-23T10:09:59Z    DEBUG   [image] Missing diff ID in cache        diff_id="sha256:fcc59c6bd513b792912dfa9270ff54d5180731748689691e0949a66e2d9a08cf"
2024-12-23T10:09:59Z    DEBUG   [image] Missing diff ID in cache        diff_id="sha256:57b846d5add8173c1ed2dca93bff3bce0fcffa1a832c46dea10bb946bdfe8946"
2024-12-23T10:10:09Z    DEBUG   [image] Missing diff ID in cache        diff_id="sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef"
2024-12-23T10:10:09Z    DEBUG   [image] Missing diff ID in cache        diff_id="sha256:d16e3b1ab06b4fdf5ff5c4455bd7fa102c4b21141cfc4068927d8e1a6f3d6f5d"
2024-12-23T10:10:09Z    DEBUG   [image] Missing diff ID in cache        diff_id="sha256:85a16bd9c22bbbaa8d6170ad0e7eaede9b4720f33616f4b185c429c650af8dd8"
2024-12-23T10:10:09Z    DEBUG   [image] Missing diff ID in cache        diff_id="sha256:7a761c834a8ef197f2d9c79a71dc75df47cd9738c0c4f2fc318a7d1a42e2988f"
2024-12-23T10:10:09Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="gpg" version="1.15.1"
2024-12-23T10:10:09Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="libcomps" version="0.1.20"
2024-12-23T10:10:09Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="APScheduler" version="3.10.4"
2024-12-23T10:10:09Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="Django" version="4.2.17"
2024-12-23T10:10:09Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="PyJWT" version="2.8.0"
2024-12-23T10:10:09Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="asgiref" version="3.8.1"
2024-12-23T10:10:09Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="boto3" version="1.34.130"
2024-12-23T10:10:09Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="botocore" version="1.34.130"
2024-12-23T10:10:09Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="certifi" version="2024.7.4"
2024-12-23T10:10:09Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="cffi" version="1.16.0"
2024-12-23T10:10:09Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="charset-normalizer" version="3.3.2"
2024-12-23T10:10:09Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="cryptography" version="43.0.1"
2024-12-23T10:10:09Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="django-apscheduler" version="0.6.2"
2024-12-23T10:10:09Z    DEBUG   Loading the default license classifier...
2024-12-23T10:10:10Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="django-model-utils" version="5.0.0"
2024-12-23T10:10:10Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="dramatiq" version="1.14.1"
2024-12-23T10:10:10Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="elastic-apm" version="6.23.0"
2024-12-23T10:10:10Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="gunicorn" version="22.0.0"
2024-12-23T10:10:10Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="jmespath" version="1.0.1"
2024-12-23T10:10:10Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="jsonpatch" version="1.33"
2024-12-23T10:10:10Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="jsonpointer" version="3.0.0"
2024-12-23T10:10:10Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="jsonschema" version="4.22.0"
2024-12-23T10:10:10Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="jsonschema-specifications" version="2023.12.1"
2024-12-23T10:10:10Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="msgpack" version="1.0.8"
2024-12-23T10:10:10Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="prometheus_client" version="0.21.0"
2024-12-23T10:10:10Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="psycopg2-binary" version="2.9.9"
2024-12-23T10:10:10Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="pycparser" version="2.22"
2024-12-23T10:10:10Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="pydantic_core" version="2.20.1"
2024-12-23T10:10:10Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="python-dateutil" version="2.9.0.post0"
2024-12-23T10:10:10Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="pytz" version="2024.1"
2024-12-23T10:10:10Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="pytz-deprecation-shim" version="0.1.0.post0"
2024-12-23T10:10:10Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="referencing" version="0.31.1"
2024-12-23T10:10:10Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="requests" version="2.32.3"
2024-12-23T10:10:10Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="rpds-py" version="0.18.1"
2024-12-23T10:10:10Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="s3transfer" version="0.10.1"
2024-12-23T10:10:10Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="six" version="1.16.0"
2024-12-23T10:10:10Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="tzdata" version="2024.1"
2024-12-23T10:10:10Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="tzlocal" version="4.3"
2024-12-23T10:10:10Z    INFO    [python] License acquired from METADATA classifiers may be subject to additional terms  name="wrapt" version="1.16.0"
2024-12-23T10:10:10Z    DEBUG   No secrets found in container image config
2024-12-23T10:10:10Z    INFO    Detected OS     family="amazon" version="2023.6.20241209 (Amazon Linux)"
2024-12-23T10:10:10Z    INFO    [amazon] Detecting vulnerabilities...   os_version="2023" pkg_num=108
2024-12-23T10:10:10Z    INFO    Number of language-specific files       num=1
2024-12-23T10:10:10Z    INFO    [python-pkg] Detecting vulnerabilities...
2024-12-23T10:10:10Z    DEBUG   [python-pkg] Scanning packages for vulnerabilities      file_path=""
2024-12-23T10:10:10Z    DEBUG   Specified ignore file does not exist    file=".trivyignore"
2024-12-23T10:10:10Z    DEBUG   [vex] VEX filtering is disabled

myimage:mytag (amazon 2023.6.20241209 (Amazon Linux))

Total: 12 (LOW: 0, MEDIUM: 0, HIGH: 12, CRITICAL: 0)

<table output of vulns which is irrelevant here>

Operating System

Ubuntu 22.04 in WSL2

Version

Version: 0.58.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2024-12-23 06:17:41.732111911 +0000 UTC
  NextUpdate: 2024-12-24 06:17:41.732111471 +0000 UTC
  DownloadedAt: 2024-12-23 09:34:10.732772026 +0000 UTC
Check Bundle:
  Digest: sha256:f6901e03f486a48f47aa17a78d89d18e6c31ded82aff83ed19d0d73935a1a059
  DownloadedAt: 2024-12-23 09:40:03.758769158 +0000 UTC

Checklist

Run trivy clean --all
Read the troubleshooting

DmitriyLewen · 2024-12-23T10:56:04Z

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Lots of "license acquired" spam despite license scanner not enabled #8159

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 1 comment

{{title}}

Select a reply

Lots of "license acquired" spam despite license scanner not enabled #8159

sparrowt Dec 23, 2024

Description

Desired Behavior

Actual Behavior

Reproduction Steps

Target

Scanner

Output Format

Mode

Debug Output

Operating System

Version

Checklist

Replies: 1 comment

DmitriyLewen Dec 23, 2024 Maintainer

sparrowt
Dec 23, 2024

DmitriyLewen
Dec 23, 2024
Maintainer