Thanks Soren, that's what debian/copyright for syft says now, with a link to your mail.
One correction to my count: it's 28 snippets, not 15. Besides Oracle Java and Elastic, five are from MongoDB (SSPL), five from Vault and three from ArangoDB 3.12 (both BSL 1.1). I take it fair use covers those the same way, since it doesn't depend on the licence. And one more case from the same family, for grype, the vulnerability scanner that uses syft (https://bugs.debian.org/1061720). Its tests read vulnerability records copied from about 25 public feeds. Most are fine (MITRE's CVE terms, CC-BY-4.0 for GitHub, Go and Red Hat, MIT, CC0). Two aren't: Wolfi and Chainguard publish their security data under CC BY-NC-ND 4.0, plus a "Chainguard License for Commercial Scanners". grype has 20 such files, with package names, fixed versions, CVE ids and a few one-line titles. Several other feeds (Alpine, Oracle, Ubuntu, EPSS) publish no licence at all. The binary package ships none of them, but without them the tests for those distributions have nothing to match. Is it fine to keep them in main on the same reasoning? Or is data that is mostly facts not something that needs a licence here? The OASIS SARIF schema, whose terms forbid modification, is already out of grype's source and goes to non-free next to the CSAF schemas. Juan
