How to specify/allow a non spdx license
Open
backlog
- Dominant language
- Go
- Stars
- 11k
- Forks
- 792
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 48
Description
When a [non-spdx license string]() is specified in license scanning the scaner crashes.
```
osv-scanner -r --format=json --licenses="NVIDIAProprietarySoftware" --config=./osv.toml .
```
What is the recommended path to whitelist/allow proprietary licences that are not a port of the SPDX list? As example [NVIDIA Proprietary Software License](https://www.nvidia.com/en-us/agreements/enterprise-software/nvidia-software-license-agreement) and others that are not spdx listed but can be acceptable upon license review.
SPDX licence list is sort of limiting. Is there a way to specify non-spdx license to osv scanner?
Contributor guide
Assessment
This issue has not been assessed yet.