.lichen.yaml

---
# Licenses other than Apache-2.0 are governed by
# https://github.com/cncf/foundation/blob/master/allowed-third-party-license-policy.md#approved-licenses-for-allowlist
# Note that Allowlist also requires that projects were created
# on GitHub at least 12 months prior and have at least 10 stars
# or 10 forks
allow:
  - "Apache-2.0"
  - "BSD-2-Clause"
  - "BSD-2-Clause-FreeBSD"
  - "BSD-3-Clause"
  - "MIT"
  - "ISC"
  - "Python-2.0"
  - "PostgreSQL"
  - "X11"
  - "Zlib"

exceptions:
  # The following references belong to OpenShift, and lichen is unable to find any referece
  # to the type of license, it comes from RedHat, so we assume it's safe to import.
  unresolvableLicense:
  - path: "github.com/openshift/openshift-apiserver"
  - path: "github.com/openshift/route-controller-manager"
  # The CNFC maintains a list of project license exceptions which are safe or Apache-2
  # compliant, those exceptions are maintained here:
  # https://github.com/cncf/foundation/tree/main/license-exceptions
  licenseNotPermitted:
  - path: "github.com/docker/go-metrics"
    licenses: ["CC-BY-SA-4.0"] # also dual licensed as Apache-2.0
  - path: "github.com/heketi/heketi"
    licenses: ["GPL-2.0", "LGPL-2.0", "LGPL-3.0"]  # also dual licensed as Apache-2.0
  - path: "github.com/opencontainers/go-digest"
    licenses: ["CC-BY-SA-4.0"]  # also dual licensed as Apache-2.0
  - path: "github.com/hashicorp/golang-lru"
    licenses: ["MPL-2.0"]