Support ignoring a package only from license scanning

[shahar-h]

Today [[PackageOverrides]] can be configured to ignore a package entirely from both vulnerability and license scanning using ignore field:

[[PackageOverrides]]
# The package name, version, and ecosystem to match against
name = "lib"
# If version is not set or empty, it will match every version
version = "1.0.0"
ecosystem = "Go"
# Ignore this package entirely, including license scanning
ignore = true

However, there are cases where we only want to ignore a package from license scanning, for example when the package is only used in tests we may still want to detect vulnerabilities but ignore license since this package is not compiled in our application.

[G-Rath]

You should be able to do this using license.override to override the license to one you consider allowed, e.g.

[[PackageOverrides]]
# The package name, version, and ecosystem to match against
name = "lib"
# If version is not set or empty, it will match every version
version = "1.0.0"
ecosystem = "Go"
# Ignore the license of this package
license.override = ["IGNORED"]

and then call osv-scanner with --experimental-licenses IGNORED.

While a little messier than being to do say license.ignore = true, I don't know if there's enough of an advantage as I'd expect we would still want to at least output that ignoring like we do when a license is overridden so you'd still have the same amount of output..

@another-rex @cuixq what do you think?

[shahar-h]

You should be able to do this using license.override to override the license to one you consider allowed, e.g.

[[PackageOverrides]]
# The package name, version, and ecosystem to match against
name = "lib"
# If version is not set or empty, it will match every version
version = "1.0.0"
ecosystem = "Go"
# Ignore the license of this package
license.override = ["IGNORED"]

and then call osv-scanner with --experimental-licenses IGNORED.

While a little messier than being to do say license.ignore = true, I don't know if there's enough of an advantage as I'd expect we would still want to at least output that ignoring like we do when a license is overridden so you'd still have the same amount of output..

@another-rex @cuixq what do you think?

Currently I do something similar - I override the package license to an allowed one like MIT, but having an explicit license.ignore flag would make it more readable.