Library tsc_cobbler without a license was detected by Whitesource scan.

[simonzhong1985]

Type of question

Open question

Question

What did you do?

Scan image using Whitesource

What did you expect to see?

No license risk

What did you see instead? Under which circumstances?

A library named tsc_cobbler has been identified as having no license.

Environment

Operator type:

language helm

Kubernetes cluster type:

$ operator-sdk version
quay.io/operator-framework/helm-operator:v1.41.1

$ go version (if language is Go)

$ kubectl version

Client Version: v1.27.2
Kustomize Version: v5.0.1
Server Version: v1.31.9

Additional context

Here is the Dockerfile we're using.

FROM quay.io/operator-framework/helm-operator:v1.41.1 ENV HOME=/opt/helm COPY watches.yaml ````{HOME}/helm-charts WORKDIR ${HOME}

Here is result of whitesource scanning

Here are files recognizd by whitesoure

According to my understanding, this should be a mistake made by Whitesource. The helm-operator:v1.41.1 should not be using this tsc_cobbler library https://github.com/Hektorwang/tsc_cobbler/tree/0.9.5-x86_64-20240905. Please help confirm this.

[simonzhong1985]

@acornett21 Sorry to bother you, I just noticed that you are one of the main committers to this repository. If possible, could you please help take a look at my issue?

[acornett21]

HI @simonzhong1985 I'm not sure about this scanning tool, but this isn't a dependency in the Dockerfile, nor in the go dependencies.