Invalid SPDX License should (as opt-in?) be counted as warning about dependency-review-action HOT 2 CLOSED

@panthony thanks for the report 🙇

The Action uses ClearlyDefined to fetch project licenses. I took a quick look at these two projects:

1. aopalliance:aopalliance: This was last updated in 2015, I could not find the LICENSE file in an online repo. ClearlyDefined reported this as "OTHER" in this PR.

2. org.tukaani/xz: the ClearlyDefined license is also OTHER. I took a look at their repo and they are using a 0BSD license, which I think should be renamed to ISC to be made SPDX-compliant (need a double check here).

For a quick fix, you can add an allow-dependencies-licenses option to your configuration, and add entries in PURL format. With that the Action should skip the licenses check.

For a long-term fix I'd encourage you to open a pull request in https://github.com/clearlydefined/curated-data/ to update the licenses for both of these projects in ClearlyDefined.

from dependency-review-action.

Thanks for you reply!

The downside of using "allow-dependencies-licenses" is that if the license changes between 2 versions I won't be notified, granted the chances of a library going from "0BSD" to "GPL-3.0" is low :)

Thanks for the pointer @ curated-data I did not know this project.

from dependency-review-action.