Add HTML report support for license scanning

[dirsigler]

Description

It would be nice to have additional support for License scanning as an HTML page via the template format.
For now the template only supports misconfigurations and vulnerabilities.

Target

None

Scanner

License

[afdesk]

there is a Trivy plugin for it

$ trivy plugin install scan2htm

[jaudriga]

AFAICS https://github.com/fatihtokus/scan2html does not support visualizing licenses as of today.

At least I did not find a way to do it and if I see that correctly there is also an open issue for it fatihtokus/scan2html#37 .

If that is not correct, can you please be more precise on how to use this plugin to visualize licenses?

[fatihtokus]

Hi @jaudriga,

We are working on that, it will be released in the next release. Please bear with us.

[fatihtokus]

Hi @jaudriga ,

We have released the feature. Please have a look and share your feedback.

trivy scan2html image --scanners license alpine:latest --scan2html-flags --output interactive_report.html

[jaudriga]

Looks good. I am trying it out for an npm project with trivy scan2html fs --scanners license . --scan2html-flags --help --output interactive_report.html. It seems to list all relevant dependencies and produce a nice overview.

There are two small things that I noticed:

• optional npm dependencies do not seem to be supported and will be left out (this seems to be a general trivy limitation, see Add [dep-types] feature to exclude dependencies of user defined types like optional dependency in Trivy Scan #7165 )
• link appears to be empty for each dependency

[fatihtokus]

I am glad to hear that.

• Yes, it is not supported by trivy yet.
• Yeah, I noticed that as well. Unfortunately, trivy is returning empty for 'Link', maybe @afdesk and @itaysk can help with that
  {
  "Severity": "LOW",
  "Category": "notice",
  "PkgName": "libretls",
  "FilePath": "",
  "Name": "MIT",
  "Text": "",
  "Confidence": 1,
  "Link": "" <---- THIS is EMPTY
  }