Describe the bug
As a compliance analyst I want to ensure projects referenced include appropriate license and copyright files so that software bill of materials and license compliance reports reflect proper current state of the software or hardware utilized.
Notes: Found this while working to reference unbound source build to get latest features and include in final image. I had OARC DNS checker with an 'A' rating using 1.24 and only a 'B' rating with 1.22. The apt catalog gives only 1.22 so was checking for SBOM and license compliances in my 'ke-net-screen' github project to build and apply newer unbound release.
To reproduce
Steps to reproduce the behavior:
-
Create a SBOM using Syft via rpi-image-gen build tool and include unbound package install
-
Review generated syft sbom json file, search for unbound
"spdxElementId": "SPDXRef-Package-deb-unbound-5c388af62716eb96",
"relatedSpdxElement": "SPDXRef-File-usr-share-doc-unbound-copyright-366ce59e26682283",
-
Identify copyright file reference at /usr/share/doc/unbound
-
Consider -V version year reference output
-
Consider /usr/share/doc/unbound/copyright unbound version year reference
Expected behavior
Appreciate the long history of the product and would expect to see 2001-2026 or year of build release (2001-YearOfRelease).
Also consider additional /usr/share/license/unbound/license file and/or /usr/share/common-license/unbound-license file as suggested by Yocto and "other generated responses" for license file locations and SBOM/Compliances tools checkers...
System:
- Unbound version: 1.22.0
- OS: Rasperry Pi 5 with Debian 13/Trixie
unbound -V output:
Version 1.22.0
Configure line: --build=aarch64-linux-gnu --prefix=/usr --includedir=${prefix}/include --mandir=${prefix}/share/man --infodir=${prefix}/share/info --sysconfdir=/etc --localstatedir=/var --disable-option-checking --disable-silent-rules --libdir=${prefix}/lib/aarch64-linux-gnu --runstatedir=/run --disable-maintainer-mode --disable-dependency-tracking --with-pythonmodule --with-pyunbound --enable-subnet --enable-dnstap --enable-systemd --enable-cachedb --with-libhiredis --with-libnghttp2 --with-chroot-dir= --with-dnstap-socket-path=/run/dnstap.sock --disable-rpath --with-pidfile=/run/unbound.pid --with-libevent --enable-tfo-client --with-rootkey-file=/usr/share/dns/root.key --disable-flto --enable-tfo-server
Linked libs: libevent 2.1.12-stable (it uses epoll), OpenSSL 3.5.5 27 Jan 2026
Linked modules: dns64 python cachedb subnetcache respip validator iterator
TCP Fastopen feature available
Additional information
myuser@myhost:/usr/share/doc/unbound$ ls
contrib copyright examples
localadmin@ke-localdns:/usr/share/doc/unbound$ cat copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: unbound
Files: *
Copyright: 2001-2021 NLnet Labs
2008-2009 W.C.A. Wijngaards
2008-2009 Wouter Wijngaards
License: BSD-3-NLnetLabs
Describe the bug
As a compliance analyst I want to ensure projects referenced include appropriate license and copyright files so that software bill of materials and license compliance reports reflect proper current state of the software or hardware utilized.
Notes: Found this while working to reference unbound source build to get latest features and include in final image. I had OARC DNS checker with an 'A' rating using 1.24 and only a 'B' rating with 1.22. The apt catalog gives only 1.22 so was checking for SBOM and license compliances in my 'ke-net-screen' github project to build and apply newer unbound release.
To reproduce
Steps to reproduce the behavior:
Create a SBOM using Syft via rpi-image-gen build tool and include unbound package install
Review generated syft sbom json file, search for unbound
"spdxElementId": "SPDXRef-Package-deb-unbound-5c388af62716eb96",
"relatedSpdxElement": "SPDXRef-File-usr-share-doc-unbound-copyright-366ce59e26682283",
Identify copyright file reference at /usr/share/doc/unbound
Consider -V version year reference output
Consider /usr/share/doc/unbound/copyright unbound version year reference
Expected behavior
Appreciate the long history of the product and would expect to see 2001-2026 or year of build release (2001-YearOfRelease).
Also consider additional /usr/share/license/unbound/license file and/or /usr/share/common-license/unbound-license file as suggested by Yocto and "other generated responses" for license file locations and SBOM/Compliances tools checkers...
System:
unbound -Voutput:Version 1.22.0
Configure line: --build=aarch64-linux-gnu --prefix=/usr --includedir=${prefix}/include --mandir=${prefix}/share/man --infodir=${prefix}/share/info --sysconfdir=/etc --localstatedir=/var --disable-option-checking --disable-silent-rules --libdir=${prefix}/lib/aarch64-linux-gnu --runstatedir=/run --disable-maintainer-mode --disable-dependency-tracking --with-pythonmodule --with-pyunbound --enable-subnet --enable-dnstap --enable-systemd --enable-cachedb --with-libhiredis --with-libnghttp2 --with-chroot-dir= --with-dnstap-socket-path=/run/dnstap.sock --disable-rpath --with-pidfile=/run/unbound.pid --with-libevent --enable-tfo-client --with-rootkey-file=/usr/share/dns/root.key --disable-flto --enable-tfo-server
Linked libs: libevent 2.1.12-stable (it uses epoll), OpenSSL 3.5.5 27 Jan 2026
Linked modules: dns64 python cachedb subnetcache respip validator iterator
TCP Fastopen feature available
Additional information
myuser@myhost:/usr/share/doc/unbound$ ls
contrib copyright examples
localadmin@ke-localdns:/usr/share/doc/unbound$ cat copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: unbound
Files: *
Copyright: 2001-2021 NLnet Labs
2008-2009 W.C.A. Wijngaards
2008-2009 Wouter Wijngaards
License: BSD-3-NLnetLabs