chainloop
chainloop copied to clipboard
Missing license for altas related packages
Executing the policy sbom-with-licenses over the controlplane migrations sbom shows some components without licenses:
Violations
- Missing licenses for ariga.io/atlas/cmd/atlas (pkg:golang/ariga.io/atlas/[email protected]?package-id=cab9ec0d40a529be#atlas)
- Missing licenses for github.com/ariga/language-tools/packages/language-server-go (pkg:golang/github.com/ariga/[email protected]?package-id=b71cbfd2cf76b196#packages/language-server-go)
These packages are included as part of atlas container community edition distribution. However, since they are pointing to a specific snapshot syft is not able to retrieve the license. These modules are distributed under the Apache license - https://github.com/ariga/atlas/blob/master/LICENSE.