syft/.bouncer.yaml

permit:
  - BSD.*
  - CC0.*
  - MIT.*
  - Apache.*
  - MPL.*
  - ISC
  - WTFPL

ignore-packages:
  # packageurl-go is released under the MIT license located in the root of the repo at /mit.LICENSE
  - github.com/anchore/packageurl-go

  # both of these dependencies are specified as Apache-2.0 in their respective GitHub READMEs
  - github.com/alibabacloud-go/cr-20160607/client
  - github.com/alibabacloud-go/tea-xml/service

  # crypto/internal/boring is released under the openSSL license as a part of the Golang Standard Libary
  - crypto/internal/boring

  # from: https://github.com/spdx/tools-golang/blob/main/LICENSE.code
  # The tools-golang source code is provided and may be used, at your option,
  # under either:
  # * Apache License, version 2.0 (Apache-2.0), OR
  # * GNU General Public License, version 2.0 or later (GPL-2.0-or-later).
  # (we choose Apache-2.0)
  - github.com/spdx/tools-golang

  # from: https://github.com/xi2/xz/blob/master/LICENSE
  # All these files have been put into the public domain.
  # You can do whatever you want with these files.
  - github.com/xi2/xz

  # from: https://gitlab.com/cznic/sqlite/-/blob/v1.15.4/LICENSE
  # This is a BSD-3-Clause license
  - modernc.org/libc
  - modernc.org/libc/errno
  - modernc.org/libc/fcntl
  - modernc.org/libc/fts
  - modernc.org/libc/grp
  - modernc.org/libc/langinfo
  - modernc.org/libc/limits
  - modernc.org/libc/netdb
  - modernc.org/libc/netinet/in
  - modernc.org/libc/poll
  - modernc.org/libc/pthread
  - modernc.org/libc/pwd
  - modernc.org/libc/signal
  - modernc.org/libc/stdio
  - modernc.org/libc/stdlib
  - modernc.org/libc/sys/socket
  - modernc.org/libc/sys/stat
  - modernc.org/libc/sys/types
  - modernc.org/libc/termios
  - modernc.org/libc/time
  - modernc.org/libc/unistd
  - modernc.org/libc/utime
  - modernc.org/libc/uuid/uuid
  - modernc.org/libc/wctype
  - modernc.org/mathutil
  - modernc.org/memory