Parsing of 3rdpartylicenses.txt to support dependency/licences detection for Angular apps running in a container

[ertl]

Description

When I scan my container, the dependencies for my front end are missing. My front end is a built Angular application that does not have a node_modules folder or a package-lock.json. However, when the application is build, all dependencies including the licence are written to a separate 3rdpartylicenses.txt file.

Target

Container Image

Scanner

License

[DmitriyLewen]

Hello @ertl
Thanks for your interest to Trivy!

Have you tried using file patterns for your licenses?

Regards, Dmitriy

[knqyf263]

@DmitriyLewen If I understand correctly, 3rdpartylicenses.txt has a list of licenses.
https://github.com/ng-bootstrap/ng-bootstrap.github.io/blob/7806c452da41f7b46f29c2d2b56e15db9c4b654e/3rdpartylicenses.txt

Trivy may be able to enrich the result by parsing 3rdpartylicenses.txt. A problem is that Trivy doesn't know the dependency version if node_modules doesn't exist.

@ertl Does Angular also store the dependency information somewhere?

[ertl]

@knqyf263 you are right, the version of the dependencies is missing :-(
As far as I know, there is no standard way to get a list of all dependencies and their version.
But there is a webpack plugin (https://github.com/CycloneDX/cyclonedx-webpack-plugin) that creates a sbom file.
So maybe a sbom scan in combination with the --file-pattern parameter pointing to the generated sbom file could work.

[DmitriyLewen]

If you have sbom file with dependencies (and their licenses) - you can use sbom command.
I mean you don't need --file-pattern flag for sbom files.