feature: raise issue when package is labeled as X license, but source header shows Y

anchore / grant

Search an SBOM for licenses and the packages they belong to

Apache License 2.0

64 stars 5 forks source link

feature: raise issue when package is labeled as X license, but source header shows Y #45

Open spiffcs opened 7 months ago

spiffcs commented 7 months ago

Grant has the ability to show the license declared for a package as surfaced by syft.

Syft should also be able to communicate to consumers if a declared license is different from one found in the header of the source files. This would allow grant to flag packages with conflicting statements for the user in their evaluation policy.