Where does the 'pkg_license' and 'pkg_licenses' information come from?

[JustinWonjaePark]

Hi, I've been trying to use tern for the first time.

While I look into the html report for the example on the README.md (debian:buster),
I got curious how tern extract 'pkg_license' and 'pkg_licenses' information.

For most of packages, there were no pkg_license data while it has pkg_licenses.

Can anyone tell me the answer or give a link to relevant documentation?

[nishakm]

@JustinWonjaePark It depends on the package manager. In your case, it is Debian, for which Licenses are not specifically stated for each package and needs to be parsed from the copyright text. We use debian-inspector to parse Debian copyright text to extract any license information. That's what you're looking at in pkg_licenses.

[JustinWonjaePark]

@rnjudge By package manager, you mean something like npm or pip? If so, do you parse meta files like package.json and provide the license information extracted there? And, what kind of package managers does Tern support?
I got two more question, I suppose the answer to the question above would be related to the 'Analyzer' part at architecture.
Can you explain a little bit more about 'Navtive' and 'Custom' part?
And, why are you using both scancode and fossology?

@nishakm I really liked documentation in general. It was really easy to install and run Tern by reading the documents. What I'd like to see is the capability of Tern and structure of report(e.g. json or yaml). (It might be a minority opinion :P)

[nishakm]

@JustinWonjaePark Let me see if I can provide some answers:

Reg: Package Managers: Yes, we do mean npm or pip, but sometimes, we just mean a "method of installing software". I think we do a combination of both parsing meta files and using the package manager to list all the packages. Check out the base.yml file to see details on how we collect metadata.

Reg: Analyzer: Tern has a "default" method of analyzing images. This uses the base.yml file. However, this isn't a completely fool proof way of collecting that information. So we have the option of adding plugins for static analyzers. We currently support cve-bin-tool and scancode-toolkit within the project, but anyone can make their own analyzer plugin. You could use the scancode plugin to scan the container images if it works better for you.

Reg: Reports: What do you mean by "structure of report"? You can output the report in JSON or YAML format if you with using tern report -f json or tern report -f yaml.

[JustinWonjaePark]

@nishakm I was thinking something like "for dummies". Tern report provides a lot of information and I wasn't sure were to look at a quick glance. So, I thought rookies like me might find it "more" helpful if there was some kind of diagrams that explains the document. Don't get me wrong, documentation generally was great. :)

[nishakm]

That's a good suggestion! Could you do us a favor and file an issue proposing a "how to read the reports" section in the README.md?

[JustinWonjaePark]

@nishakm I just filed an issue as you asked. https://github.com/tern-tools/tern/issues/960