Python libraries licenses are not gathered

[templier2]

What happened: syft shows python packages, but doesn't collect licenses.

What you expected to happen: I want to see licenses for packages

Steps to reproduce the issue: I run anchore_syft packages . -o cyclonedx-xml=bom.xml

Anything else we need to know?: unsure

Environment:

• Output of syft version:

  Application:        syft
  Version:            0.76.0
  JsonSchemaVersion:  7.0.1
  BuildDate:          2023-03-31T15:11:44Z
  GitCommit:          dfcc07e5122217ca9e2fc75817c593356fc0c405
  GitDescription:     v0.76.0
  Platform:           linux/amd64
  GoVersion:          go1.19.7
  Compiler:           gc

• OS (e.g: cat /etc/os-release or similar):

  PRETTY_NAME="Ubuntu 22.04.4 LTS"
  NAME="Ubuntu"
  VERSION_ID="22.04"
  VERSION="22.04.4 LTS (Jammy Jellyfish)"
  VERSION_CODENAME=jammy
  ID=ubuntu
  ID_LIKE=debian
  HOME_URL="https://www.ubuntu.com/"
  SUPPORT_URL="https://help.ubuntu.com/"
  BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
  PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
  UBUNTU_CODENAME=jammy

[kzantow]

Hi @templier2, what type of python packages are you scanning? It looks like today Syft is only able to find licenses from wheel/egg files, and perhaps the license information isn't present in other packaging formats? Could you provide a reproducible case, such as a public docker image we could look at to help understand what's there and let us know what you expect?

[templier2]

Hi @templier2, what type of python packages are you scanning? It looks like today Syft is only able to find licenses from wheel/egg files, and perhaps the license information isn't present in other packaging formats? Could you provide a reproducible case, such as a public docker image we could look at to help understand what's there and let us know what you expect?

Hi, It is a list of libraries from requirements.txt, I suppose that every library has appropriate information about the license at pypi.org (i.e. https://pypi.org/project/rdflib/) databricks-connect==14.3.2 rdflib==7.0.0 SPARQLWrapper==2.0.0 azure-search-documents==11.4.0 pyspark==3.5.1 lxml==5.2.2

It isn't a docker image, it is just a python application.