Documentation
¶
Overview ¶
Package license is the engine module that gates an image's component licenses against an allow/deny policy (CAPABILITY_SPEC domain 1 — license-policy gating). It generates the SBOM, evaluates each component's declared licenses with internal/license, and emits DS-RAT-LIC-* findings that flow into the normal report and the `dsecrat policy eval` CI gate.
The gate is opt-in and configured entirely through target metadata, so it stays quiet unless an operator sets a policy:
license.deny=GPL-3.0-only,AGPL-3.0-only comma-separated SPDX deny list license.allow=MIT,Apache-2.0,BSD-3-Clause allowlist (anything else denied) license.deny-classes=strong-copyleft,network-copyleft license.flag-unknown=true deny unrecognized licenses license.flag-unlicensed=true deny components with no license
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Module ¶
type Module struct{}
Module implements the license-policy gate.
func (*Module) Analyze ¶
Analyze generates the SBOM and evaluates each component's licenses against the policy from target metadata. It returns nothing when no policy is configured, so the module is inert by default.
Source Files