Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

license checker problems with SPDX expressions AND / OR #1299

Open
jayvdb opened this issue Oct 5, 2024 · 0 comments · May be fixed by #1329
Open

license checker problems with SPDX expressions AND / OR #1299

jayvdb opened this issue Oct 5, 2024 · 0 comments · May be fixed by #1329
Assignees
@G-Rath
Labels
bug Something isn't working

Comments

@jayvdb
Copy link

jayvdb commented Oct 5, 2024

These should be excluded

> osv-scanner --experimental-licenses MIT,ISC,Apache-2.0,BSD-3-Clause,BSD-2-Clause,CC0-1.0,BlueOak-1.0.0,CC-BY-3.0 --lockfile pnpm-lock.yaml
╭─────────────────────────┬───────────┬──────────────────────────────────┬──────────────┬────────────────╮
│ LICENSE VIOLATION       │ ECOSYSTEM │ PACKAGE                          │ VERSION      │ SOURCE         │
├─────────────────────────┼───────────┼──────────────────────────────────┼──────────────┼────────────────┤

│ Apache-2.0 AND MIT      │ npm       │ @swc/core-darwin-arm64           │ 1.7.26       │ pnpm-lock.yaml │
│ Apache-2.0 AND MIT      │ npm       │ @swc/core-darwin-x64             │ 1.7.26       │ pnpm-lock.yaml │
│ Apache-2.0 AND MIT      │ npm       │ @swc/core-linux-arm64-gnu        │ 1.7.26       │ pnpm-lock.yaml │
│ Apache-2.0 AND MIT      │ npm       │ @swc/core-linux-arm64-musl       │ 1.7.26       │ pnpm-lock.yaml │
│ Apache-2.0 AND MIT      │ npm       │ @swc/core-linux-x64-gnu          │ 1.7.26       │ pnpm-lock.yaml │
│ Apache-2.0 AND MIT      │ npm       │ @swc/core-linux-x64-musl         │ 1.7.26       │ pnpm-lock.yaml │
│ Apache-2.0 AND MIT      │ npm       │ @swc/core-win32-arm64-msvc       │ 1.7.26       │ pnpm-lock.yaml │
│ Apache-2.0 AND MIT      │ npm       │ @swc/core-win32-ia32-msvc        │ 1.7.26       │ pnpm-lock.yaml │
│ Apache-2.0 AND MIT      │ npm       │ @swc/core-win32-x64-msvc         │ 1.7.26       │ pnpm-lock.yaml │
...
│ CC0-1.0 OR MIT          │ npm       │ type-fest                        │ 0.13.1       │ pnpm-lock.yaml │
│ CC0-1.0 OR MIT          │ npm       │ type-fest                        │ 0.20.2       │ pnpm-lock.yaml │
│ CC0-1.0 OR MIT          │ npm       │ type-fest                        │ 0.21.3       │ pnpm-lock.yaml │
│ CC0-1.0 OR MIT          │ npm       │ type-fest                        │ 1.4.0        │ pnpm-lock.yaml │
│ CC0-1.0 OR MIT          │ npm       │ type-fest                        │ 2.13.0       │ pnpm-lock.yaml │
│ CC0-1.0 OR MIT          │ npm       │ type-fest                        │ 2.19.0       │ pnpm-lock.yaml │
│ CC0-1.0 OR MIT          │ npm       │ type-fest                        │ 3.13.1       │ pnpm-lock.yaml │
│ CC0-1.0 OR MIT          │ npm       │ type-fest                        │ 4.26.1       │ pnpm-lock.yaml │

And this workaround doesnt work

> osv-scanner --experimental-licenses "MIT,ISC,Apache-2.0,BSD-3-Clause,BSD-2-Clause,CC0-1.0,BlueOak-1.0.0,CC-BY-3.0,Apache-2.0 AND MIT,CC0-1.0 OR MIT" --lockfile pnpm-lock.yaml
--experimental-licenses requires comma-separated spdx licenses. The following license(s) are not recognized as spdx: Apache-2.0 AND MIT,CC0-1.0 OR MIT
@oliverchang oliverchang added the bug Something isn't working label Oct 8, 2024
@G-Rath G-Rath self-assigned this Oct 13, 2024
@G-Rath G-Rath linked a pull request Oct 18, 2024 that will close this issue
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@G-Rath G-Rath

Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

feat: support evaluating spdx license expressions ackama/osv-scanner
3 participants
@jayvdb @oliverchang @G-Rath