WITH operator license exceptions not supported

[marschall]

Description

Starting with version 2.0 SPDX deprecated the -exception licenses and instead introduced the "WITH" operator.

Release 2.0 of the SPDX Specification introduced License Expressions that supports the ability to identify common variations of SPDX-identified licenses without the need to define each potential variation as a distinct license on the SPDX License List. This new syntax supports the ability to declare an SPDX-identified license exception using the "WITH" operator (e.g. GPL-2.0-or-later WITH Autoconf-exception-2.0), as well as the ability to use a simple "+" operator after a license short identifier to indicate "or later version". SPDX has defined a list of license exceptions to use after the "WITH" operator. As a result, a number of licenses formerly included on the SPDX License List have been deprecated, and correct usage employs the License Expression syntax as of v2.0.

So what was GPL-2.0-with-classpath-exception became GPL-2.0-only WITH Classpath-exception-2.0. Unfortunately trivy now reports this as three different licenses, GPL-2.0-only, WITH and Classpath-exception-2.0.

Similar

• License exceptions with a plus sign #7833
• License exceptions with a plus sign #7838

Desired Behavior

Exception licenses are reported as a single license.

Actual Behavior

Exception licenses are reported as a three different licenses.

Reproduction Steps

1. trivy image --format cyclonedx azul/zulu-openjdk-alpine:21-jre-headless-latest | jq '.components[] | .name = "zulu21-ca-jre-headless" | .licenses'

Target

Container Image

Scanner

License

Output Format

CycloneDX

Mode

Standalone

Debug Output

2025-07-21T21:52:46+02:00	DEBUG	No plugins loaded
2025-07-21T21:52:46+02:00	DEBUG	Default config file "file_path=trivy.yaml" not found, using built in values
2025-07-21T21:52:46+02:00	DEBUG	Cache dir	dir="/home/marschall/.cache/trivy"
2025-07-21T21:52:46+02:00	DEBUG	Cache dir	dir="/home/marschall/.cache/trivy"
2025-07-21T21:52:46+02:00	DEBUG	Parsed severities	severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2025-07-21T21:52:46+02:00	DEBUG	Ignore statuses	statuses=[]
2025-07-21T21:52:46+02:00	INFO	"--format cyclonedx" disables security scanning. Specify "--scanners vuln" explicitly if you want to include vulnerabilities in the "cyclonedx" report.
2025-07-21T21:52:46+02:00	DEBUG	[pkg] Package types	types=[os library]
2025-07-21T21:52:46+02:00	DEBUG	[pkg] Package relationships	relationships=[unknown root workspace direct indirect]
2025-07-21T21:52:46+02:00	DEBUG	Initializing scan cache...	type="fs"
2025-07-21T21:52:46+02:00	DEBUG	[notification] Running version check
2025-07-21T21:52:46+02:00	DEBUG	[image] Detected image ID	image_id="sha256:e453b3d370122962db4a6f4ea49e3eaf96622dc678f51f1f20e8599d683c32e5"
2025-07-21T21:52:46+02:00	DEBUG	[image] Detected diff ID	diff_ids=[sha256:097100c76c154cc850192d4aad97bbb1438883ab0cf11944673b645f60d683cb sha256:1408a6ee19da55c9ef155873777ec7ccf0136d115123ae76288b89762506744f]
2025-07-21T21:52:46+02:00	DEBUG	[image] Detected base layers	diff_ids=[sha256:097100c76c154cc850192d4aad97bbb1438883ab0cf11944673b645f60d683cb]
2025-07-21T21:52:46+02:00	INFO	Detected OS	family="alpine" version="3.20.7"
2025-07-21T21:52:46+02:00	INFO	Number of language-specific files	num=0
2025-07-21T21:52:46+02:00	DEBUG	Specified ignore file does not exist	file=".trivyignore"
2025-07-21T21:52:46+02:00	DEBUG	[vex] VEX filtering is disabled

Operating System

Ubuntu 25.04

Version

Version: 0.64.1
Java DB:
  Version: 1
  UpdatedAt: 2025-07-19 00:55:14.067180316 +0000 UTC
  NextUpdate: 2025-07-22 00:55:14.067180195 +0000 UTC
  DownloadedAt: 2025-07-19 14:45:43.428783425 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[DmitriyLewen]

Hello @marschall
Thanks for your report!

Created #9230

Regards, Dmitriy