File Location Missing in Licence Scan Output

[PeterBurner]

Description

I am using full license scanning to scan for loose file licenses with table as output format. When specifying an output file I get a different result than with stdout. In the output file the File Location column has the wrong value. It contains the severity. The console output shows the correct paths.

trivy rootfs --scanners license --license-full --output output.md .

What did you expect to happen?

Console output and output file should be identical.

What happened instead?

Output file is missing the file paths.

STDOUT

Loose File License(s) (license)

Total: 2 (UNKNOWN: 0, LOW: 1, MEDIUM: 1, HIGH: 0, CRITICAL: 0)

┌────────────────┬──────────┬────────────┬───────────────┐
│ Classification │ Severity │  License   │ File Location │
├────────────────┼──────────┼────────────┼───────────────┤
│ Reciprocal     │ MEDIUM   │ MPL-2.0    │ dep1/LICENSE  │
├────────────────┼──────────┼────────────┼───────────────┤
│ Notice         │ LOW      │ Apache-2.0 │ dep2/LICENSE  │
└────────────────┴──────────┴────────────┴───────────────┘

FILE

Loose File License(s) (license)
===============================
�[0mTotal: 2 (UNKNOWN: 0, LOW: 1, MEDIUM: 1, HIGH: 0, CRITICAL: 0)

�[0m┌────────────────┬──────────┬────────────┬───────────────┐
│ Classification │ Severity │  License   │ File Location │
├────────────────┼──────────┼────────────┼───────────────┤
│ reciprocal     │ MEDIUM   │ MPL-2.0    │ MEDIUM        │
├────────────────┼──────────┼────────────┼───────────────┤
│ notice         │ LOW      │ Apache-2.0 │ LOW           │
└────────────────┴──────────┴────────────┴───────────────┘

Output of run with --debug:

trivy rootfs --scanners license --license-full --output output.md --debug .
2023-04-19T12:17:41.656+0200    DEBUG   Severities: ["UNKNOWN" "LOW" "MEDIUM" "HIGH" "CRITICAL"]
2023-04-19T12:17:41.667+0200    DEBUG   cache dir:  /Users/***/Library/Caches/trivy
2023-04-19T12:17:41.667+0200    INFO    Full license scanning is enabled
2023-04-19T12:17:41.667+0200    DEBUG   Walk the file tree rooted at '.' in parallel
2023-04-19T12:17:41.667+0200    DEBUG   License scanning: dep2/LICENSE
2023-04-19T12:17:41.667+0200    DEBUG   License scanning: output.md
2023-04-19T12:17:41.667+0200    DEBUG   Loading the default license classifier...
2023-04-19T12:17:41.667+0200    DEBUG   License scanning: dep1/LICENSE
2023-04-19T12:17:42.018+0200    DEBUG   OS is not detected.

Output of trivy -v:

Version: 0.40.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2023-04-18 12:07:11.190735073 +0000 UTC
  NextUpdate: 2023-04-18 18:07:11.190734673 +0000 UTC
  DownloadedAt: 2023-04-18 12:08:56.203368 +0000 UTC
Policy Bundle:
  Digest: sha256:d19c4c0d48ed4641862e020ff7eba7fd3ba449f66b532b09d79a6023bc65bd5b
  DownloadedAt: 2023-04-18 12:08:57.851285 +0000 UTC

Additional details (base image name, container registry info...):

• Folder structure to reproduce behaviour

[afdesk]

@PeterBurner thanks for the report.
i can reproduce this issue.