enhancement(python): use one info and multiple debug logs for License acquired from METADATA... message

[DmitriyLewen]

Description

License acquired from METADATA classifiers may be subject to additional terms messages can be too noisy.
So we need to use Once to show a single Info log and move these messages to the Debug level.
See #8159 for example.

Discussed in #8159

[sparrowt]

Thanks for promoting this to an issue. Out of interest why is it necessary to be running this license code at all when --scanners does not include license?

[DmitriyLewen]

this is a feature of the cache
Trivy collects all the information about the package and puts it in the cache so that later you don't have to scan the image again

[sparrowt]

I see, maybe there shouldn't be even 1 line at INFO level unless you have the license scanner enabled?

[DmitriyLewen]

There is a problem with this.
Analyzers/parsers do not have information about the scanners used.

[sparrowt]

Hum, perhaps at this stage it shouldn't log anything then (this doesn't seem like an error) and if there is something important to flag to the user then the license scanner should do this based on whatever the analyser put into the cache?

[DmitriyLewen]

There are challenges with this as well because the METADATA file has 4 fields for licenses, and Trivy parses these fields in the parser and only passes the resulting values to the cache.

It will be quite problematic to determine which specific field the license was obtained from after retrieving the cache.

[sparrowt]

Interesting ok, I'm unfamiliar with the details behind License acquired from METADATA classifiers may be subject to additional terms but certainly reducing it to 1 line of output would be an improvement (thanks!)

Even seeing that one line I wouldn't really be sure what to do about it but that's a separate question!

[knqyf263]

The license scanner is to detect license problems. Trivy shows package information, such as package name, version, license, etc., regardless of whether the license scanning is enabled.