Open tapanagupta opened 1 month ago
Thanks @tapanagupta! I'll take a look at this right away because this is definitely not behaving as expected. **
should be a valid rule - does *
also fail for your as well?
Here is our integration test for denial on an empty config: https://github.com/anchore/grant/blob/main/test/cli/check_test.go
I'll get this fleshed out with your case and a bit more cases so this feature is behaving as expected.
Thanks for looking into this, @spiffcs! To answer your question, I ran a test using *
instead of **
and got the same result.
Looking forward to further updates on this.
Looks like only denies have been implemented per https://github.com/anchore/grant/blob/260752c11c540d11451e255affb68bc44b42a866/grant/policy.go#L54
There is also a comment above in the policy struct w/ a todo for that feature
https://github.com/anchore/grant/blob/260752c11c540d11451e255affb68bc44b42a866/grant/policy.go#L10
So it looks like it's not possible to implement a deny by default and allow list licenses right now.
Hello,
I'm trying to create a .grant.yaml config file that would achieve the following behavior: Deny all licenses except for the ones that have corresponding 'allow' rules in .grant.yaml.
First, I tried to specify allow rules for specific licenses, as shown below, expecting that non-matching licenses would be denied. However, the resulting output allowed ALL licenses.
Next, I tried to specify a 'deny all' rule alongside the allow rule, but this time ALL licenses were denied.
Below is the command used for running the tests (SBOM from Syft fed as input):
grant check -o json syft.spdx-json.json | jq > grant.json
In general, from my testing, I observed that when Grant is supplied with a config file, it allows all licenses by default, but when not supplied with a config file, it denies all licenses by default.
From the Grant documentation:
Question is, how do I achieve the latter, i.e. allow specific licenses while denying all others? Thank you for looking into this issue.