.grant.yaml

# .grant.yaml (auto-generated)
require-license: false
require-known-license: false

allow:
  - BSD.*
  - CC0.*
  - MIT.*
  - Apache.*
  - MPL.*
  - ISC
  - WTFPL
  - Unlicense
  - Unicode-DFS-2016
  - 0BSD

ignore-packages:
  # packageurl-go is released under the MIT license located in the root of the repo at /mit.LICENSE
  - github.com/anchore/packageurl-go

  # both of these dependencies are specified as Apache-2.0 in their respective GitHub READMEs
  - github.com/alibabacloud-go/cr-20160607/client
  - github.com/alibabacloud-go/tea-xml/service

  # crypto/internal/boring is released under the openSSL license as a part of the Golang Standard Libary
  - crypto/internal/boring

  # from: https://github.com/spdx/tools-golang/blob/main/LICENSE.code
  # The tools-golang source code is provided and may be used, at your option,
  # under either:
  # * Apache License, version 2.0 (Apache-2.0), OR
  # * GNU General Public License, version 2.0 or later (GPL-2.0-or-later).
  # (we choose Apache-2.0)
  - github.com/spdx/tools-golang

  # from: https://github.com/opencontainers/go-digest
  # go-digest is licensed under Apache-2.
  # The docs have CC-BY-SA included there but it does not apply to code distribution
  - github.com/opencontainers/go-digest

  - github.com/anchore/grant
  - github.com/anchore/syft