Export a Licence Compliance Inventory - TRUSTIVAN

TRUSTIVAN extracts software licence metadata from container OS packages (Alpine APK, Debian dpkg, RedHat RPM) and language dependencies (npm, Go modules, PyPI, Cargo, Maven) during standard vulnerability scans. Because licence data is derived from package component graphs, no special scanner configuration or secondary build step is required.

1. Querying the Licence Inventory

Retrieve software licences across all scanned assets or for a specific image:

curl -s "https://api.trustivan.com/v1/licenses?order=recent&limit=100" \
  -H "Authorization: Bearer $TRUSTIVAN_KEY"

To scope results to a single container image:

curl -s "https://api.trustivan.com/v1/licenses?asset_id=ast_01H9A3..." \
  -H "Authorization: Bearer $TRUSTIVAN_KEY"

Example Response

{
  "licenses": [
    {
      "id": "lic_01H9A3...",
      "assetId": "ast_01H9A3...",
      "componentName": "libssl3",
      "componentVersion": "3.0.13-r0",
      "ecosystem": "apk",
      "spdxExpression": "Apache-2.0",
      "category": "permissive",
      "declaredIn": "OS package metadata"
    },
    {
      "id": "lic_01H9A4...",
      "assetId": "ast_01H9A3...",
      "componentName": "busybox",
      "componentVersion": "1.36.1-r15",
      "ecosystem": "apk",
      "spdxExpression": "GPL-2.0-only",
      "category": "copyleft_strong",
      "declaredIn": "OS package metadata"
    }
  ],
  "page": {
    "limit": 100,
    "next": null,
    "stable": true
  }
}

2. Licence Classifications

TRUSTIVAN classifies detected licences into standard risk categories:

Category	Example SPDX Identifiers	Compliance Impact
`permissive`	`MIT`, `Apache-2.0`, `BSD-2-Clause`, `ISC`	Minimal distribution restrictions
`copyleft_weak`	`LGPL-2.1-only`, `MPL-2.0`, `EPL-2.0`	Modifications must be shared; linking allowed
`copyleft_strong`	`GPL-2.0-only`, `GPL-3.0-only`, `AGPL-3.0-only`	Derivative works must be licensed under same terms
`proprietary`	Commercial, non-standard enterprise licences	Subject to specific vendor contractual terms
`unknown`	Packages without valid SPDX identifiers	Requires manual legal review

3. Exporting Standard SBOMs with Licences

Export your complete Software Bill of Materials including full licence expressions in CycloneDX or SPDX format:

# Export CycloneDX 1.5 JSON
curl -s -H "Accept: application/vnd.cyclonedx+json" \
  -H "Authorization: Bearer $TRUSTIVAN_KEY" \
  "https://api.trustivan.com/v1/assets/{id}/sbom" > sbom-cyclonedx.json

# Export SPDX 2.3 JSON
curl -s -H "Accept: application/spdx+json" \
  -H "Authorization: Bearer $TRUSTIVAN_KEY" \
  "https://api.trustivan.com/v1/assets/{id}/sbom" > sbom-spdx.json

Next Steps

Exchange VEX Advisories: Share OpenVEX triage statements.
Export Compliance Reports: Generate auditable evidence packages.
Scan Private Repositories: Secure private registry credentials.