Invalid cyclonedx sbom is generated for elasticsearch:8.17.10

[jakub-bochenski]

Description

Invalid cyclonedx sbom is generated for elasticsearch:8.17.10

Desired Behavior

Valid cyclonedx sbom is generated

Actual Behavior

1. {
        "type": "number_one_of",
        "field": "components.271.licenses",
        "context": "(root).components.271.licenses",
        "description": "Must validate one and only one schema (oneOf)",
        "value": [
            {
                "license": {
                    "name": "curl"
                }
            },
            {
                "license": {
                    "name": "OLDAP-2.8"
                }
            },
            {
                "license": {
                    "id": "ISC"
                }
            },
            {
                "license": {
                    "name": "GPL-2.0-or-later WITH Autoconf-data-exception"
                }
            },
            {
                "license": {
                    "name": "GPL-3.0-or-later WITH Autoconf-data-exception"
                }
            },
            {
                "expression": "GPL-2.0-or-later WITH Libtool-exception"
            },
            {
                "license": {
                    "id": "BSD-3-Clause"
                }
            },
            {
                "license": {
                    "id": "BSD-4-Clause-UC"
                }
            },
            {
                "license": {
                    "name": "FSFULLR"
                }
            },
            {
                "license": {
                    "id": "X11"
                }
            },
            {
                "license": {
                    "id": "GPL-2.0-only"
                }
            }
        ]
    }
2. {
        "type": "required",
        "field": "components.271.licenses.5",
        "context": "(root).components.271.licenses.5",
        "description": "license is required",
        "value": {
            "expression": "GPL-2.0-or-later WITH Libtool-exception"
        }
    }
3. {
        "type": "additional_property_not_allowed",
        "field": "components.271.licenses.5",
        "context": "(root).components.271.licenses.5",
        "description": "Additional property expression is not allowed",
        "value": "GPL-2.0-or-later WITH Libtool-exception"
    }
4. {
        "type": "number_one_of",
        "field": "components.275.licenses",
        "context": "(root).components.275.licenses",
        "description": "Must validate one and only one schema (oneOf)",
        "value": [
            {
                "license": {
                    "id": "GPL-3.0-or-later"
                }
            },
            {
                "license": {
                    "name": "FSFULLR"
                }
            },
            {
                "license": {
                    "id": "LGPL-2.1-or-later"
                }
            },
            {
                "license": {
                    "name": "GPL-3.0-only WITH autoconf-exception+"
                }
            },
            {
                "license": {
                    "id": "GPL-3.0-only"
                }
            },
            {
                "expression": "GPL-3.0-or-later WITH texinfo-exception"
            },
            {
                "license": {
                    "id": "LGPL-2.0-or-later"
                }
            },
            {
                "license": {
                    "id": "GPL-2.0-or-later"
                }
            },
            {
                "license": {
                    "id": "X11"
                }
            },
            {
                "license": {
                    "name": "FSFAP"
                }
            },
            {
                "license": {
                    "id": "GFDL-1.3-no-invariants-only"
                }
            },
            {
                "license": {
                    "id": "LGPL-3.0-or-later"
                }
            },
            {
                "license": {
                    "id": "LGPL-3.0-only"
                }
            },
            {
                "license": {
                    "name": "public-domain"
                }
            },
            {
                "license": {
                    "id": "LGPL-2.0-only"
                }
            },
            {
                "license": {
                    "id": "LGPL-2.1-only"
                }
            },
            {
                "license": {
                    "id": "GPL-2.0-only"
                }
            },
            {
                "license": {
                    "id": "GFDL-1.3-only"
                }
            }
        ]
    }
5. {
        "type": "required",
        "field": "components.275.licenses.5",
        "context": "(root).components.275.licenses.5",
        "description": "license is required",
        "value": {
            "expression": "GPL-3.0-or-later WITH texinfo-exception"
        }
    }
6. {
        "type": "additional_property_not_allowed",
        "field": "components.275.licenses.5",
        "context": "(root).components.275.licenses.5",
        "description": "Additional property expression is not allowed",
        "value": "GPL-3.0-or-later WITH texinfo-exception"
    }
7. {
        "type": "number_one_of",
        "field": "components.277.licenses",
        "context": "(root).components.277.licenses",
        "description": "Must validate one and only one schema (oneOf)",
        "value": [
            {
                "license": {
                    "id": "GPL-2.0-only"
                }
            },
            {
                "license": {
                    "id": "LGPL-2.0-only"
                }
            },
            {
                "license": {
                    "id": "BSD-3-Clause"
                }
            },
            {
                "license": {
                    "id": "Apache-2.0"
                }
            },
            {
                "license": {
                    "id": "ISC"
                }
            },
            {
                "license": {
                    "id": "GPL-2.0-or-later"
                }
            },
            {
                "license": {
                    "name": "MIT-US-export"
                }
            },
            {
                "license": {
                    "name": "Kazlib"
                }
            },
            {
                "license": {
                    "name": "Latex2e"
                }
            },
            {
                "expression": "GPL-2.0-or-later WITH Texinfo-exception"
            }
        ]
    }
8. {
        "type": "required",
        "field": "components.277.licenses.9",
        "context": "(root).components.277.licenses.9",
        "description": "license is required",
        "value": {
            "expression": "GPL-2.0-or-later WITH Texinfo-exception"
        }
    }
9. {
        "type": "additional_property_not_allowed",
        "field": "components.277.licenses.9",
        "context": "(root).components.277.licenses.9",
        "description": "Additional property expression is not allowed",
        "value": "GPL-2.0-or-later WITH Texinfo-exception"
    }
10. {
        "type": "number_one_of",
        "field": "components.287.licenses",
        "context": "(root).components.287.licenses",
        "description": "Must validate one and only one schema (oneOf)",
        "value": [
            {
                "license": {
                    "id": "LGPL-2.1-or-later"
                }
            },
            {
                "license": {
                    "name": "GAP-FSF"
                }
            },
            {
                "license": {
                    "id": "LGPL-3.0-or-later"
                }
            },
            {
                "license": {
                    "id": "LGPL-3.0-only"
                }
            },
            {
                "expression": "GPL-2.0-or-later WITH libtool-exception"
            },
            {
                "license": {
                    "id": "GPL-2.0-only"
                }
            },
            {
                "license": {
                    "id": "GPL-3.0-or-later"
                }
            },
            {
                "license": {
                    "id": "GPL-3.0-only"
                }
            },
            {
                "license": {
                    "name": "GAP"
                }
            },
            {
                "license": {
                    "id": "GPL-2.0-or-later"
                }
            },
            {
                "license": {
                    "id": "LGPL-2.1-only"
                }
            }
        ]
    }
11. {
        "type": "required",
        "field": "components.287.licenses.4",
        "context": "(root).components.287.licenses.4",
        "description": "license is required",
        "value": {
            "expression": "GPL-2.0-or-later WITH libtool-exception"
        }
    }
12. {
        "type": "additional_property_not_allowed",
        "field": "components.287.licenses.4",
        "context": "(root).components.287.licenses.4",
        "description": "Additional property expression is not allowed",
        "value": "GPL-2.0-or-later WITH libtool-exception"
    }
13. {
        "type": "number_one_of",
        "field": "components.299.licenses",
        "context": "(root).components.299.licenses",
        "description": "Must validate one and only one schema (oneOf)",
        "value": [
            {
                "license": {
                    "id": "GPL-2.0-only"
                }
            },
            {
                "license": {
                    "id": "LGPL-2.0-only"
                }
            },
            {
                "license": {
                    "id": "BSD-3-Clause"
                }
            },
            {
                "license": {
                    "id": "Apache-2.0"
                }
            },
            {
                "license": {
                    "id": "ISC"
                }
            },
            {
                "license": {
                    "id": "GPL-2.0-or-later"
                }
            },
            {
                "license": {
                    "name": "MIT-US-export"
                }
            },
            {
                "license": {
                    "name": "Kazlib"
                }
            },
            {
                "license": {
                    "name": "Latex2e"
                }
            },
            {
                "expression": "GPL-2.0-or-later WITH Texinfo-exception"
            }
        ]
    }
14. {
        "type": "required",
        "field": "components.299.licenses.9",
        "context": "(root).components.299.licenses.9",
        "description": "license is required",
        "value": {
            "expression": "GPL-2.0-or-later WITH Texinfo-exception"
        }
    }
15. {
        "type": "additional_property_not_allowed",
        "field": "components.299.licenses.9",
        "context": "(root).components.299.licenses.9",
        "description": "Additional property expression is not allowed",
        "value": "GPL-2.0-or-later WITH Texinfo-exception"
    }
16. {
        "type": "number_one_of",
        "field": "components.301.licenses",
        "context": "(root).components.301.licenses",
        "description": "Must validate one and only one schema (oneOf)",
        "value": [
            {
                "license": {
                    "name": "curl"
                }
            },
            {
                "license": {
                    "name": "OLDAP-2.8"
                }
            },
            {
                "license": {
                    "id": "ISC"
                }
            },
            {
                "license": {
                    "name": "GPL-2.0-or-later WITH Autoconf-data-exception"
                }
            },
            {
                "license": {
                    "name": "GPL-3.0-or-later WITH Autoconf-data-exception"
                }
            },
            {
                "expression": "GPL-2.0-or-later WITH Libtool-exception"
            },
            {
                "license": {
                    "id": "BSD-3-Clause"
                }
            },
            {
                "license": {
                    "id": "BSD-4-Clause-UC"
                }
            },
            {
                "license": {
                    "name": "FSFULLR"
                }
            },
            {
                "license": {
                    "id": "X11"
                }
            },
            {
                "license": {
                    "id": "GPL-2.0-only"
                }
            }
        ]
    }
17. {
        "type": "required",
        "field": "components.301.licenses.5",
        "context": "(root).components.301.licenses.5",
        "description": "license is required",
        "value": {
            "expression": "GPL-2.0-or-later WITH Libtool-exception"
        }
    }
18. {
        "type": "additional_property_not_allowed",
        "field": "components.301.licenses.5",
        "context": "(root).components.301.licenses.5",
        "description": "Additional property expression is not allowed",
        "value": "GPL-2.0-or-later WITH Libtool-exception"
    }
19. {
        "type": "number_one_of",
        "field": "components.304.licenses",
        "context": "(root).components.304.licenses",
        "description": "Must validate one and only one schema (oneOf)",
        "value": [
            {
                "license": {
                    "id": "GPL-2.0-only"
                }
            },
            {
                "license": {
                    "id": "LGPL-2.0-only"
                }
            },
            {
                "license": {
                    "id": "BSD-3-Clause"
                }
            },
            {
                "license": {
                    "id": "Apache-2.0"
                }
            },
            {
                "license": {
                    "id": "ISC"
                }
            },
            {
                "license": {
                    "id": "GPL-2.0-or-later"
                }
            },
            {
                "license": {
                    "name": "MIT-US-export"
                }
            },
            {
                "license": {
                    "name": "Kazlib"
                }
            },
            {
                "license": {
                    "name": "Latex2e"
                }
            },
            {
                "expression": "GPL-2.0-or-later WITH Texinfo-exception"
            }
        ]
    }
20. {
        "type": "required",
        "field": "components.304.licenses.9",
        "context": "(root).components.304.licenses.9",
        "description": "license is required",
        "value": {
            "expression": "GPL-2.0-or-later WITH Texinfo-exception"
        }
    }
21. {
        "type": "additional_property_not_allowed",
        "field": "components.304.licenses.9",
        "context": "(root).components.304.licenses.9",
        "description": "Additional property expression is not allowed",
        "value": "GPL-2.0-or-later WITH Texinfo-exception"
    }
22. {
        "type": "number_one_of",
        "field": "components.318.licenses",
        "context": "(root).components.318.licenses",
        "description": "Must validate one and only one schema (oneOf)",
        "value": [
            {
                "license": {
                    "name": "OpenLDAP-2.8"
                }
            },
            {
                "license": {
                    "name": "FSF-unlimited"
                }
            },
            {
                "license": {
                    "name": "GPL-2.0-only WITH autoconf-exception+"
                }
            },
            {
                "license": {
                    "name": "GPL-3.0-only WITH autoconf-exception+"
                }
            },
            {
                "expression": "GPL-2.0-or-later WITH Libtool-exception"
            },
            {
                "expression": "GPL-3.0-or-later WITH Libtool-exception"
            },
            {
                "license": {
                    "id": "GPL-3.0-or-later"
                }
            },
            {
                "license": {
                    "id": "GPL-2.0-or-later"
                }
            },
            {
                "license": {
                    "name": "UMich"
                }
            },
            {
                "license": {
                    "name": "F5"
                }
            },
            {
                "license": {
                    "name": "JCG"
                }
            },
            {
                "license": {
                    "name": "MIT-XC"
                }
            },
            {
                "license": {
                    "name": "NeoSoft-permissive"
                }
            },
            {
                "license": {
                    "id": "BSD-3-Clause"
                }
            },
            {
                "license": {
                    "name": "Beerware"
                }
            },
            {
                "license": {
                    "name": "public-domain"
                }
            },
            {
                "license": {
                    "name": "BSD-4-clause-California"
                }
            },
            {
                "license": {
                    "name": "BSD-3-clause-variant"
                }
            },
            {
                "license": {
                    "name": "Expat-ISC"
                }
            },
            {
                "license": {
                    "name": "Expat-UNM"
                }
            },
            {
                "license": {
                    "id": "MIT"
                }
            },
            {
                "license": {
                    "name": "BSD-3-clause-California"
                }
            },
            {
                "license": {
                    "id": "GPL-2.0-only"
                }
            },
            {
                "license": {
                    "id": "GPL-3.0-only"
                }
            }
        ]
    }
23. {
        "type": "required",
        "field": "components.318.licenses.4",
        "context": "(root).components.318.licenses.4",
        "description": "license is required",
        "value": {
            "expression": "GPL-2.0-or-later WITH Libtool-exception"
        }
    }
24. {
        "type": "additional_property_not_allowed",
        "field": "components.318.licenses.4",
        "context": "(root).components.318.licenses.4",
        "description": "Additional property expression is not allowed",
        "value": "GPL-2.0-or-later WITH Libtool-exception"
    }
25. {
        "type": "required",
        "field": "components.318.licenses.5",
        "context": "(root).components.318.licenses.5",
        "description": "license is required",
        "value": {
            "expression": "GPL-3.0-or-later WITH Libtool-exception"
        }
    }
26. {
        "type": "additional_property_not_allowed",
        "field": "components.318.licenses.5",
        "context": "(root).components.318.licenses.5",
        "description": "Additional property expression is not allowed",
        "value": "GPL-3.0-or-later WITH Libtool-exception"
    }
27. {
        "type": "number_one_of",
        "field": "components.344.licenses",
        "context": "(root).components.344.licenses",
        "description": "Must validate one and only one schema (oneOf)",
        "value": [
            {
                "license": {
                    "id": "GPL-2.0-only"
                }
            },
            {
                "license": {
                    "id": "LGPL-2.0-only"
                }
            },
            {
                "license": {
                    "id": "BSD-3-Clause"
                }
            },
            {
                "license": {
                    "id": "Apache-2.0"
                }
            },
            {
                "license": {
                    "id": "ISC"
                }
            },
            {
                "license": {
                    "id": "GPL-2.0-or-later"
                }
            },
            {
                "license": {
                    "name": "MIT-US-export"
                }
            },
            {
                "license": {
                    "name": "Kazlib"
                }
            },
            {
                "license": {
                    "name": "Latex2e"
                }
            },
            {
                "expression": "GPL-2.0-or-later WITH Texinfo-exception"
            }
        ]
    }
28. {
        "type": "required",
        "field": "components.344.licenses.9",
        "context": "(root).components.344.licenses.9",
        "description": "license is required",
        "value": {
            "expression": "GPL-2.0-or-later WITH Texinfo-exception"
        }
    }
29. {
        "type": "additional_property_not_allowed",
        "field": "components.344.licenses.9",
        "context": "(root).components.344.licenses.9",
        "description": "Additional property expression is not allowed",
        "value": "GPL-2.0-or-later WITH Texinfo-exception"
    }
30. {
        "type": "number_one_of",
        "field": "components.357.licenses",
        "context": "(root).components.357.licenses",
        "description": "Must validate one and only one schema (oneOf)",
        "value": [
            {
                "license": {
                    "id": "GPL-2.0-only"
                }
            },
            {
                "license": {
                    "id": "LGPL-2.0-only"
                }
            },
            {
                "license": {
                    "id": "BSD-3-Clause"
                }
            },
            {
                "license": {
                    "id": "Apache-2.0"
                }
            },
            {
                "license": {
                    "id": "ISC"
                }
            },
            {
                "license": {
                    "id": "GPL-2.0-or-later"
                }
            },
            {
                "license": {
                    "name": "MIT-US-export"
                }
            },
            {
                "license": {
                    "name": "Kazlib"
                }
            },
            {
                "license": {
                    "name": "Latex2e"
                }
            },
            {
                "expression": "GPL-2.0-or-later WITH Texinfo-exception"
            }
        ]
    }
31. {
        "type": "required",
        "field": "components.357.licenses.9",
        "context": "(root).components.357.licenses.9",
        "description": "license is required",
        "value": {
            "expression": "GPL-2.0-or-later WITH Texinfo-exception"
        }
    }
32. {
        "type": "additional_property_not_allowed",
        "field": "components.357.licenses.9",
        "context": "(root).components.357.licenses.9",
        "description": "Additional property expression is not allowed",
        "value": "GPL-2.0-or-later WITH Texinfo-exception"
    }

Reproduction Steps

docker run --rm -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy:0.65.0 image --scanners license --license-full --license-confidence-level 0 --format cyclonedx library/elasticsearch:8.17.10

Target

None

Scanner

None

Output Format

None

Mode

None

Debug Output

see above

Operating System

linux

Version

see above

Checklist

• Run trivy clean --all
• Read the troubleshooting

[jakub-bochenski]

Actually might be a duplicate of #9300

[DmitriyLewen]

Duplicate of #9300