forked from envoyproxy/gateway
-
Notifications
You must be signed in to change notification settings - Fork 0
/
osv-scanner.toml
122 lines (106 loc) · 5.7 KB
/
osv-scanner.toml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
[[IgnoredVulns]]
id = "GO-2022-0646"
reason = "No a real issue, just a warning about third party package."
[[PackageOverrides]]
name = "github.com/AdaLogics/go-fuzz-headers"
version = "0.0.0-20230811130428-ced1acdcaa24"
ecosystem = "Go"
license.override = ["Apache-2.0"]
reason = "Unidentified license since package version is missing in pkg.go.dev"
[[PackageOverrides]]
name = "github.com/asaskevich/govalidator"
version = "0.0.0-20230301143203-a9d515a09cc2"
ecosystem = "Go"
license.override = ["MIT"]
reason = "Unidentified license, remove once https://github.com/google/deps.dev/issues/87 is resolved"
[[PackageOverrides]]
name = "github.com/containers/storage"
version = "1.55.0"
ecosystem = "Go"
license.override = ["Apache-2.0"]
reason = "Unidentified license, remove once https://github.com/google/deps.dev/issues/104 is resolved"
[[PackageOverrides]]
name = "github.com/distribution/distribution/v3"
version = "3.0.0-beta.1"
ecosystem = "Go"
license.override = ["Apache-2.0"]
reason = "Unidentified license, remove once https://github.com/google/deps.dev/issues/105 is resolved"
[[PackageOverrides]]
name = "github.com/docker/go-metrics"
version = "0.0.1"
ecosystem = "Go"
license.override = ["Apache-2.0"]
reason = "This package has dual license - the code is licensed under the Apache 2.0 license and the docs under CC-BY-SA-4.0 license"
[[PackageOverrides]]
name = "github.com/go-sql-driver/mysql"
version = "1.8.1"
ecosystem = "Go"
# Override the license to an allowed one until https://github.com/google/osv-scanner/issues/1124 is resolved and we can skip it from licnese scanning instead
license.override = ["Apache-2.0"]
reason = "This package has MPL-2.0 which is not approved in CNCF Allowlist, but it has an exception. See https://github.com/cncf/foundation/blob/main/license-exceptions/CNCF-licensing-exceptions.csv"
[[PackageOverrides]]
name = "github.com/hashicorp/errwrap"
version = "1.1.0"
ecosystem = "Go"
# Override the license to an allowed one until https://github.com/google/osv-scanner/issues/1124 is resolved and we can skip it from licnese scanning instead
license.override = ["Apache-2.0"]
reason = "This package has MPL-2.0 which is not approved in CNCF Allowlist, but it has an exception. See https://github.com/cncf/foundation/blob/main/license-exceptions/CNCF-licensing-exceptions.csv"
[[PackageOverrides]]
name = "github.com/hashicorp/go-cleanhttp"
version = "0.5.2"
ecosystem = "Go"
# Override the license to an allowed one until https://github.com/google/osv-scanner/issues/1124 is resolved and we can skip it from licnese scanning instead
license.override = ["Apache-2.0"]
reason = "This package has MPL-2.0 which is not approved in CNCF Allowlist, but it has an exception. See https://github.com/cncf/foundation/blob/main/license-exceptions/CNCF-licensing-exceptions.csv"
[[PackageOverrides]]
name = "github.com/hashicorp/go-multierror"
version = "1.1.1"
ecosystem = "Go"
# Override the license to an allowed one until https://github.com/google/osv-scanner/issues/1124 is resolved and we can skip it from licnese scanning instead
license.override = ["Apache-2.0"]
reason = "This package has MPL-2.0 which is not approved in CNCF Allowlist, but it has an exception. See https://github.com/cncf/foundation/blob/main/license-exceptions/CNCF-licensing-exceptions.csv"
[[PackageOverrides]]
name = "github.com/hashicorp/go-version"
version = "1.7.0"
ecosystem = "Go"
# Override the license to an allowed one until https://github.com/google/osv-scanner/issues/1124 is resolved and we can skip it from licnese scanning instead
license.override = ["Apache-2.0"]
reason = "This package has MPL-2.0 which is not approved in CNCF Allowlist, but it has an exception. See https://github.com/cncf/foundation/blob/main/license-exceptions/CNCF-licensing-exceptions.csv"
[[PackageOverrides]]
name = "github.com/hashicorp/hcl"
version = "1.0.0"
ecosystem = "Go"
# Override the license to an allowed one until https://github.com/google/osv-scanner/issues/1124 is resolved and we can skip it from licnese scanning instead
license.override = ["Apache-2.0"]
reason = "This package has MPL-2.0 which is not approved in CNCF Allowlist, but it has an exception. See https://github.com/cncf/foundation/blob/main/license-exceptions/CNCF-licensing-exceptions.csv"
[[PackageOverrides]]
name = "github.com/moby/patternmatcher"
version = "0.6.0"
ecosystem = "Go"
license.override = ["Apache-2.0"]
reason = "Unidentified license, remove once https://github.com/google/deps.dev/issues/106 is resolved"
[[PackageOverrides]]
name = "github.com/opencontainers/go-digest"
version = "1.0.0"
ecosystem = "Go"
license.override = ["Apache-2.0"]
reason = "This package has dual license - the code is licensed under the Apache 2.0 license and the docs under CC-BY-SA-4.0 license"
[[PackageOverrides]]
name = "github.com/shoenig/go-m1cpu"
version = "0.1.6"
ecosystem = "Go"
# Override the license to an allowed one until https://github.com/google/osv-scanner/issues/1124 is resolved and we can skip it from licnese scanning instead
license.override = ["Apache-2.0"]
reason = "This package has MPL-2.0 which is not approved in CNCF Allowlist, but it has an exception. See https://github.com/cncf/foundation/blob/main/license-exceptions/cncf-exceptions-2023-08-31.spdx"
[[PackageOverrides]]
name = "stdlib"
ecosystem = "Go"
license.override = ["BSD-3-Clause"]
reason = "Unidentified license, remove once https://github.com/google/deps.dev/issues/86 is resolved"
[[PackageOverrides]]
name = "github.com/grafana/tempo"
version = "1.5.0"
ecosystem = "Go"
# Override the license to an allowed one until https://github.com/google/osv-scanner/issues/1124 is resolved and we can skip it from licnese scanning instead
license.override = ["Apache-2.0"]
reason = "This package is only used in e2e tests so we can ignore its license"