.syft.yaml

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.

# Scan only the source archive. Dependency resolution and host caches would make
# the source SBOM depend on the machine and time at which it is rebuilt.
check-for-app-update: false
enrich: []
# This attribution-only NOTICE is not a license. Syft's Dart cataloger otherwise
# adds its content hash as an unknown license alongside Apache-2.0. The source
# archive retains the NOTICE, and the package LICENSE remains in the scan.
exclude:
  - ./dart/packages/fory/NOTICE
java:
  use-network: false
  use-maven-local-repository: false
golang:
  use-packages-lib: false
  search-local-mod-cache-licenses: false
  search-remote-licenses: false
javascript:
  search-remote-licenses: false
python:
  search-remote-licenses: false