Re: [Fedora-legal-list] Trivy for licenses

2024-03-04 Thread Maxwell G
On Tue Mar 5, 2024 at 04:06 +, Maxwell G wrote: > On Mon Mar 4, 2024 at 22:35 +0100, Sandro wrote: > > On 04-03-2024 07:59, Miroslav Suchý wrote: > > > It would welcome if anyone can help Robert here: > > > https://bugzilla.redhat.com/show_bug.cgi?id=2235055 > > > > I had a look and it seems

Re: [Fedora-legal-list] Trivy for licenses

2024-03-04 Thread Maxwell G
On Mon Mar 4, 2024 at 22:35 +0100, Sandro wrote: > On 04-03-2024 07:59, Miroslav Suchý wrote: > > It would welcome if anyone can help Robert here: > > https://bugzilla.redhat.com/show_bug.cgi?id=2235055 > > I had a look and it seems the package is currently stuck on broken >

Re: [Fedora-legal-list] Trivy for licenses

2024-03-04 Thread Maxwell G
On Mon Mar 4, 2024 at 07:59 +0100, Miroslav Suchý wrote: > Dne 03. 03. 24 v 20:22 Philippe Ombredanne napsal(a): > > > If you want robust license detection, consider using ScanCode [2] and > > Scancode.io [3] for more complex pipelines. Both are tools that I > > co-maintain and are considered as

Re: [Fedora-legal-list] Trivy for licenses

2024-03-04 Thread Maxwell G
On Sun Mar 3, 2024 at 20:22 +0100, Philippe Ombredanne wrote: > Hi Maxwell: Hi Philippe, > On Sun, Mar 3, 2024, Maxwell G wrote: > > Has anyone every used trivy [1] to scan for licenses? It appears more > > robust and better maintained than askalono-cli and can detect files with > > multiple

Re: [Fedora-legal-list] Trivy for licenses

2024-03-04 Thread Sandro
On 04-03-2024 07:59, Miroslav Suchý wrote: It would welcome if anyone can help Robert here: https://bugzilla.redhat.com/show_bug.cgi?id=2235055 I had a look and it seems the package is currently stuck on broken python-pymaven-patch, which requires python-lxml < 5~~. In rawhide and f40

Re: [Fedora-legal-list] Trivy for licenses

2024-03-03 Thread Miroslav Suchý
Dne 03. 03. 24 v 20:22 Philippe Ombredanne napsal(a): It is mostly based on google/licenseclassifier which had a single commit in the last 17 months, and this means this is not more maintained than askalono (and frankly both are fairly lightweight tools for license detection). Trivy adds SPDX

Re: [Fedora-legal-list] Trivy for licenses

2024-03-03 Thread Philippe Ombredanne
Hi Maxwell: On Sun, Mar 3, 2024, Maxwell G wrote: > Has anyone every used trivy [1] to scan for licenses? It appears more > robust and better maintained than askalono-cli and can detect files with > multiple licenses and licenses embedded in file headers. I have been > running it with "trivy fs

Re: Trivy for licenses

2024-03-03 Thread Maxwell G
On Sun Mar 3, 2024 at 17:28 +0100, Miroslav Suchý wrote: > Dne 03. 03. 24 v 7:35 Maxwell G napsal(a): > > > > Has anyone every used trivy [1] to scan for licenses? It appears more > > robust and better maintained than askalono-cli > > and can detect files with multiple licenses and licenses

Re: Trivy for licenses

2024-03-03 Thread Miroslav Suchý
Dne 03. 03. 24 v 7:35 Maxwell G napsal(a): Has anyone every used trivy [1] to scan for licenses? It appears more robust and better maintained than askalono-cli and can detect files with multiple licenses and licenses embedded in file headers.  I have been running it with "trivy fs --scanners

Trivy for licenses

2024-03-02 Thread Maxwell G
Hi, Has anyone every used trivy [1] to scan for licenses? It appears more robust and better maintained than askalono-cli and can detect files with multiple licenses and licenses embedded in file headers.  I have been running it with "trivy fs --scanners license --license-full ." [1]