code.syft-licensessyft licence policy
Builds an SBOM with syft and flags copyleft licences: strong (AGPL, GPL, SSPL, EUPL, OSL) as medium, weak (LGPL, MPL, EPL, CDDL) as low, and one aggregated info finding for packages with no licence. Set settings["code.syft-licenses"].sbomOut to also write the CycloneDX SBOM to that path. Policy relevance depends on how the project is distributed, so it is opt-in.
- Engine
- Wrapped scanner
- Wraps
syft- Targets
- Codebase
- Areas
- Supply chain, Compliance
- Runs
- Opt-in: only when selected with --only
- Network
- Only the target itself
Run only this auditor
bunx openaudit . --only code.syft-licensesWraps syft. When it isn't installed, the auditor is skipped with an install hint and the rest of the audit runs.