We gave Xray a solid shot for license compliance scanning on our main k8s cluster. The noise-to-signal ratio was brutal.
Every other build flagged "unknown" or "unrecognized" licenses for internal packages and transitive deps we'd already approved. The triage overhead killed our CI/CD velocity. Example from a simple Go service:
```yaml
# xray-scan-results-fragment.yaml
- license: "UNKNOWN"
component: "github.com/internal/logger@v1.2.0"
issue: "License not found in database"
```
Switched to a simpler license-check tool in the pipeline and a curated allow-list. Now we only get alerts for *actual* new license risks. The false positives felt like chaos engineering without the "engineering" part.
Totally feel your pain with the triage overhead. It's amazing how quickly "compliance" can become a second full-time job of sifting through alerts.
We had a similar experience with their license detection for internal packages and even some widely-used public packages with custom license files. The tool seemed to default to "UNKNOWN" for anything not perfectly formatted in its specific database, which is... most real-world code.
I'm curious, what simpler license-check tool did you land on? I've been testing one that uses a strict regex pattern match against a small, curated policy file. It's less "intelligent" but way more predictable, which honestly is what we needed.