plain-json, cyclondx, spdx-tv scan outputs are very different for the same software package, any explanation?

[jni2000]

Hi,

I run the tool to scan the license info of a software package. What I found that,

1. if output is set to plain json, the tool yield a lot of licenses information entries -- inline with the software contents
2. if the output formats are set to CyclonDX or SPDX-TV, the scan results are empty without a single licenses information entry.

Can anyone please help me explain if this is restricted by the CycloneDX and SPDX specification limitation or a potential bug in the tool ?

The tool is still a great tool, in all my usage experiences!

Thanks

[Ganesh-403]

@jni2000 From what you've described, I don't think this is a limitation of the CycloneDX or SPDX specifications themselves.

One important difference is that ScanCode's native JSON output is a complete scan report, while the CycloneDX and SPDX-TV outputs are SBOM formats. They are intended to represent software components/packages and their associated metadata, not necessarily every license detection that appears in individual source files. :contentReference[oaicite:0]{index=0}

In particular, the ScanCode documentation notes that:

• --json / --json-pp contain the full scan results and are the recommended formats for preserving all ScanCode findings.
• --cyclonedx is primarily useful when scanning with --package, since it generates a Software Bill of Materials (SBOM) from detected packages. :contentReference[oaicite:1]{index=1}

A few questions that would help narrow this down:

1. What command are you using?

   For example, are you running something like:

   scancode -clpieu --json result.json <path>

   versus

   scancode -clpieu --cyclonedx bom.json <path>

2. Are you also using the --package option?

   If no packages are detected, the resulting CycloneDX/SPDX SBOM may legitimately contain little or no package/license information, even though the JSON report contains file-level license detections. :contentReference[oaicite:2]{index=2}

3. When you say the SPDX/CycloneDX outputs are "empty", do you mean:

   • there are no components/packages,
   • or the components exist but their license fields are empty?

If you're using the same scan options and the JSON report clearly contains detected licenses while the generated SPDX-TV/CycloneDX contains no corresponding package or file license information, that could indicate a bug or an edge case worth investigating.

A minimal reproducer would be very helpful:

• the exact ScanCode version,
• the full command line,
• and (if possible) a small sample project that exhibits the behavior.

That would make it much easier to determine whether this is expected SBOM behavior or a problem in the output generation.

If this solves your problem, feel free to mark it as the accepted answer so others can find it easily.