diff --git a/.github/vale/Vocab/Technology/accept.txt b/.github/vale/Vocab/Technology/accept.txt index 72a3a7c713..2dfdda75b2 100644 --- a/.github/vale/Vocab/Technology/accept.txt +++ b/.github/vale/Vocab/Technology/accept.txt @@ -1,3 +1,4 @@ +AGPLv3 APIs? ARM AWS @@ -25,6 +26,7 @@ Fargate Fedora Flink GPG +GPLv3 GRUB GeoNetwork Git diff --git a/content/scout/policy/_index.md b/content/scout/policy/_index.md index 775af3f068..8f704c672c 100644 --- a/content/scout/policy/_index.md +++ b/content/scout/policy/_index.md @@ -60,7 +60,7 @@ Docker Scout ships the following three out-of-the-box policies: - [Critical and high vulnerabilities with fixes](#critical-and-high-vulnerabilities-with-fixes) - [Critical vulnerabilities](#critical-vulnerabilities) -- [Packages with GPL3+ licenses](#packages-with-gpl3-licenses) +- [Packages with AGPLv3, GPLv3 licenses](#packages-with-agplv3-gplv3-licenses) These policies are turned on by default for Scout-enabled repositories. There's currently no way to turn off or configure these policies. @@ -90,10 +90,12 @@ more critical vulnerabilities. This policy flags all critical vulnerabilities, whether or not there's a fix version available. -### Packages with GPL3+ licenses +### Packages with AGPLv3, GPLv3 licenses This policy requires that your artifacts don't contain packages distributed -under a GPL3+ [copyleft](https://en.wikipedia.org/wiki/Copyleft) license. +under an AGPLv3 or GPLv3 license. These licenses are protective +[copyleft](https://en.wikipedia.org/wiki/Copyleft), and may be unsuitable for +use in your software because of the restrictions they enforce. This policy is unfulfilled if your artifacts contain one or more packages with a violating license. diff --git a/content/scout/policy/view.md b/content/scout/policy/view.md index 60eb217ae1..f604438909 100644 --- a/content/scout/policy/view.md +++ b/content/scout/policy/view.md @@ -72,9 +72,9 @@ version that removes the vulnerability, when a fix version is available. To fix the issue, upgrade the package version to the fix version. For licensing-related policies, the list shows all packages whose license -doesn't meet the policy criteria. To fix the issue, look for an alternative -package distributed under a more appropriate license, or cut the dependency by -reimplementing the functionality in your own code. +doesn't meet the policy criteria. To fix the issue, find a way to remove the +dependency to the violating package, for example by looking for an alternative +package distributed under a more appropriate license. ## CLI