grant doesn't find grant in grant image

[pd-gov]

What happened:

When scanning the grant docker image anchore/grant:v0.6.4 using itself no packages and licenses are found

What you expected to happen:

then executable /grant is found and correctly identified as "Apache-2.0".

Steps to reproduce the issue:

docker run anchore/grant:v0.6.4 check image:anchore/grant:v0.6.4
 ✔ Loaded image:anchore/grant:v0.6.4                              image
   ├── ✔ Packages                       [0 packages]
   ├── ✔ Licenses                       [0 unique]
   └── ✔ File metadata                  [0 locations]
 ✔ Scanned for license compliance     [0 packages]

Anything else we need to know?:

Environment:

• Output of grant version: 0.6.4
• OS (e.g: cat /etc/os-release or similar): docker

[pd-gov]

The same is true for other anchor images like anchore/grype and anchore/syft

[willmurphyscode]

Hi @pd-gov thanks for the issue!

TL;DR

• Cause: By default, Grant doesn't make network calls to ask the go package API about licenses of Go packages. Since go binaries don't have licenses files this means we don't find any licenses on any package in anchore/grant or similar images. (The image is just go binary in a mostly empty image.)
• Workaround: SYFT_GOLANG_SEARCH_REMOTE_LICENSES=true syft anchore/grant:v0.6.4 -o json | grant check does work
• Code changes eventually needed: Grant can (optionally?) tell Syft to look harder for licenses, e.g. calling Go packaging APIs, because Grant always needs good license info.

Longer version:

I think the issue is that Syft isn't finding any licenses for these packages. If we do this:

$ docker run anchore/syft:latest anchore/grant:v0.6.4
NAME                                                                                 VERSION                               TYPE
cel.dev/expr                                                                         v0.25.1                               go-module
cloud.google.com/go                                                                  v0.123.0                              go-module
cloud.google.com/go/auth                                                             v0.18.1                               go-module
cloud.google.com/go/auth/oauth2adapt                                                 v0.2.8                                go-module
cloud.google.com/go/compute/metadata                                                 v0.9.0                                go-module
... snip ...

So we're finding packages. But if we do this:

$ docker run anchore/syft:latest anchore/grant:v0.6.4 -o json | jq -c '.artifacts[] | { purl, licenses }'
{"purl":"pkg:golang/cel.dev/expr@v0.25.1","licenses":[]}
{"purl":"pkg:golang/cloud.google.com/go@v0.123.0","licenses":[]}
{"purl":"pkg:golang/cloud.google.com/go/auth@v0.18.1","licenses":[]}
... snip ...

where almost nothing has licenses.

However, if we give Syft permission to search remotely for license information for Go packages, we see:

$ SYFT_GOLANG_SEARCH_REMOTE_LICENSES=true syft anchore/grant:v0.6.4 -o json | jq -c '.artifacts[] | { purl, licenses }'
{"purl":"pkg:golang/github.com/anchore/go-macholibre@v0.0.0-20220308212642-53e6d0aaf6fb","licenses":[{"value":"Apache-2.0","spdxExpression":"Apache-2.0","type":"concluded","urls":["https://proxy.golang.org/github.com/anchore/go-macholibre/@v/v0.0.0-20220308212642-53e6d0aaf6fb.zip#github.com/anchore/go-macholibre@v0.0.0-20220308212642-53e6d0aaf6fb/LICENSE"],"locations":[]}]}
{"purl":"pkg:golang/github.com/anchore/go-rpmdb@v0.0.0-20250516171929-f77691e1faec","licenses":[{"value":"MIT","spdxExpression":"MIT","type":"concluded","urls":["https://proxy.golang.org/github.com/anchore/go-rpmdb/@v/v0.0.0-20250516171929-f77691e1faec.zip#github.com/anchore/go-rpmdb@v0.0.0-20250516171929-f77691e1faec/LICENSE"],"locations":[]}]}
{"purl":"pkg:golang/github.com/anchore/go-struct-converter@v0.1.0","licenses":[{"value":"Apache-2.0","spdxExpression":"Apache-2.0","type":"concluded","urls":["https://proxy.golang.org/github.com/anchore/go-struct-converter/@v/v0.1.0.zip#github.com/anchore/go-struct-converter@v0.1.0/LICENSE"],"locations":[]}]}
{"purl":"pkg:golang/github.com/anchore/go-sync@v0.0.0-20250326131806-4eda43a485b6","licenses":[{"value":"Apache-2.0","spdxExpression":"Apache-2.0","type":"concluded","urls":["https://proxy.golang.org/github.com/anchore/go-sync/@v/v0.0.0-20250326131806-4eda43a485b6.zip#github.com/anchore/go-sync@v0.0.0-20250326131806-4eda43a485b6/LICENSE"],"locations":[]}]}
... snip ...

So Syft can find these licenses, but it doesn't by default.

Probably Grant needs to be enhanced to pass additional config to Syft so that the package cataloging in Syft (which Grant uses as a library when its input is an image or other filesystem) will work.

In the meantime, as a workaround, you can do this:

SYFT_GOLANG_SEARCH_REMOTE_LICENSES=true syft anchore/grant:v0.6.4 -o json | grant check

which prints this:

NAME                                                                                 VERSION                               LICENSE                             RISK
 cel.dev/expr                                                                         v0.25.1                               [Apache-2.0](https://spdx.org/licenses/Apache-2.0.html)                          Low
 cloud.google.com/go                                                                  v0.123.0                              [Apache-2.0](https://spdx.org/licenses/Apache-2.0.html), [BSD-3-Clause](https://spdx.org/licenses/BSD-3-Clause.html)            Low
 cloud.google.com/go/auth                                                             v0.18.1                               [Apache-2.0](https://spdx.org/licenses/Apache-2.0.html)                          Low
 cloud.google.com/go/auth/oauth2adapt                                                 v0.2.8                                [Apache-2.0](https://spdx.org/licenses/Apache-2.0.html)                          Low
 cloud.google.com/go/compute/metadata                                                 v0.9.0                                [Apache-2.0](https://spdx.org/licenses/Apache-2.0.html)                          Low
 cloud.google.com/go/iam                                                              v1.5.3                                [Apache-2.0](https://spdx.org/licenses/Apache-2.0.html)                          Low
 cloud.google.com/go/monitoring                                                       v1.24.3                               [Apache-2.0](https://spdx.org/licenses/Apache-2.0.html)                          Low
 cloud.google.com/go/storage                                                          v1.60.0                               [Apache-2.0](https://spdx.org/licenses/Apache-2.0.html)                          Low
...

[pd-gov]

Okay, looking at the syft output it seems to find the grant executable alongside it's dependencies inside the image. What I don't understand is why grant still reports 0 packages. I would expect that it would report at least the grant executable as missing a license. Silently ignoring these seems dangerous since we use grant to ensure compliance.

[spiffcs]

Hi @pd-gov!

There is an option for the tool as well to surface unlicensed packages which is a flag/config setting:

SYFT_GOLANG_SEARCH_REMOTE_LICENSES=true syft anchore/grant:v0.6.4 -o json | grant check --unlicensed

This will return packages that are unlicensed and should work in the case to show packages where no license was detected.

This config should also work to expose those packages =)

require-license: true

Happy to make changes to this behavior to make your use better!

SYFT_GOLANG_SEARCH_REMOTE_LICENSES=true syft anchore/grant:v0.6.4 -o json | grant check --unlicensed                                                     ✘ 0|1  20s  1.26.3 15:03:54
 ✔ Loaded image                                                                                                                                                                                 anchore/grant:v0.6.4
 ✔ Parsed image                                                                                                                              sha256:56d8af63885ccf447988fd19120f07596f28ee4f16a992d96b13c6eb16d7591e
 ✔ Cataloged contents                                                                                                                               db2d6e0ae5459ec17f772eb69e10cd2e56fef79bdd150652e4b5ddcc224954a5
   ├── ✔ Packages                        [270 packages]
   ├── ✔ Executables                     [1 executables]
   ├── ✔ File digests                    [1 files]
 ✔ Loaded -                              sbom
   ├── ✔ Packages                       [270 packages]
   ├── ✔ Licenses                       [150 unique]
   └── ✔ File metadata                  [270 locations]
 ✔ Checking -                                                                             sbom
 ✔ License compliance check                                [non-compliant]

 ✔ Scanned for packages without licenses     [1 found]


Packages without licenses
 NAME               VERSION                             LICENSE STATUS
 github.com/xi2/xz  v0.0.0-20171230120015-48954b6210f8  (no licenses found)

For the original question of grant finding grant:

SYFT_GOLANG_SEARCH_REMOTE_LICENSES=true syft anchore/grant:v0.6.4 -o json | grant list Apache-2.0 | grep github.com/anchore/grant                                     1.26.3 15:53:39
 ✔ Loaded image                                                                                                                                                                                 anchore/grant:v0.6.4
 ✔ Parsed image                                                                                                                              sha256:56d8af63885ccf447988fd19120f07596f28ee4f16a992d96b13c6eb16d7591e
 ✔ Cataloged contents                                                                                                                               db2d6e0ae5459ec17f772eb69e10cd2e56fef79bdd150652e4b5ddcc224954a5
   ├── ✔ Packages                        [270 packages]
   ├── ✔ Executables                     [1 executables]
   ├── ✔ File digests                    [1 files]
 github.com/anchore/grant                                                             v0.6.4                                [Apache-2.0](https://spdx.org/licenses/Apache-2.0.html), [MIT](https://spdx.org/licenses/MIT.html)                     Low

[pd-gov]

I would expect grant to report all packages it found without having to use syft explicitly with undocumented environment variables. Are there more cases where grant omits packages?