google / google/osv-scanner

How to specify/allow a non spdx license

Open
#1,829 3 comments 0 reactions 0 assignees View on GitHub
backlog
Dominant language
Go
Stars
11k
Forks
792
Avg merge
1d 20h
Merged PRs (30d)
48

Description

When a [non-spdx license string]() is specified in license scanning the scaner crashes.
```
osv-scanner -r --format=json --licenses="NVIDIAProprietarySoftware" --config=./osv.toml .
```

What is the recommended path to whitelist/allow proprietary licences that are not a port of the SPDX list? As example [NVIDIA Proprietary Software License](https://www.nvidia.com/en-us/agreements/enterprise-software/nvidia-software-license-agreement) and others that are not spdx listed but can be acceptable upon license review.

SPDX licence list is sort of limiting. Is there a way to specify non-spdx license to osv scanner?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.