Scan with javascript-lock cataloger does not provide licenses

[aslansky]

When scanning with javascript-lock cataloger the license field in the resulting bom is empty. Is there a way to get the licenses with this cataloger?

[tgerla]

Hi @aslansky, thanks for filing this issue. Do you mind attaching a lockfile or container image that you're using so we can test it out on our end? Thanks!

[aslansky]

Sure, we are using yarn.

yarn.lock.txt

syft version is 0.84.1

.syft.yaml looks like this:

output: cyclonedx-json
file: dist/bom.json
exclude:
  - ./dist/**
  - ./node_modules/**
  - ./tmp/**
  - ./tools/**
  - ./coverage/**
  - ./.storybook/**
  - ./.nx/**
catalogers:
  - javascript-lock
  - go-mod-file
  - dotnet-deps
golang:
  search-local-mod-cache-licenses: true
  search-remote-licenses: true

[aslansky]

Ah, by posting the content of the config file, I noticed that node_modules was excluded. Removing it from exclude config solves this.

Sorry for opening up the ticket, should have checked the config before asking :-)

[tgerla]

No problem, glad it was an easy fix! :)