ossf / scorecard

OpenSSF Scorecard - Security health metrics for Open Source
https://scorecard.dev
Apache License 2.0
4.62k stars 503 forks source link

✨ Update SPDX license list, source for license data #4323

Closed lelia closed 2 months ago

lelia commented 2 months ago

What kind of change does this PR introduce?

What is the current behavior?

The outdated list of licenses causes some users to experience lower scores on License checks, in addition including licenses that are not FSF/OSI-approved.

What is the new behavior (if this is a feature change)?**

The updated list of licenses should help prevent these issues.

Which issue(s) this PR fixes

Fixes #4031

Special notes for your reviewer

For now, this just updates the list of licenses. A future enhancement can be added to programmatically fetch the licenses from the SPDX repo, and format the data in the way that fsfOsiApprovedLicenseMap expects.

Does this PR introduce a user-facing change?

Updates list of supported SDPX licenses to include latest data.