anchore / grant

Search an SBOM for licenses and the packages they belong to
Apache License 2.0
64 stars 5 forks source link

json value in .grant.yaml doesn't work #49

Open tomerse-sg opened 7 months ago

tomerse-sg commented 7 months ago

Hi,

I tried to run the binary using a simple config file as specified in the documentation:

#.grant.yaml
config: ".grant.yaml"
format: json # table, json
show-packages: false # show the packages which contain the licenses --show-packages
non-spdx: false # list only licenses that could not be matched to an SPDX identifier --non-spdx
osi-approved: false # highlight licenses that are not OSI approved --osi-approved
rules: 
    - pattern: "*gpl*"
      name: "deny-gpl"
      mode: "deny"
      reason: "GPL licenses are not allowed per xxx-xx company policy"
      exclusions:
        - "alpine-base-layout" # We don't link against this package so we don't care about its license

run the below line: grant check redis:latest

I got table output instead of json output.

I think it will be better that the configuration will be "stronger" than command line (in case it is exists) moreover, I used -c flag like this: grant check redis:latest -c ./.grant.yaml grant check redis:latest -c .grant.yaml

still printed it as a table.

Thanks a lot for your time!