config.docker.example.toml

# Example License Scanner Config - Docker Version
# use this config for running license-scanner against built docker images

[environment]

title = "License Scanner Config"

##
# What mode should we run the scanner in?
# options:
# - "standalone": will run the tool against all repos listed in the `repos` list (below)
# - "local": will run the tool against the repo defined in `pathToRepo`
# - "docker": will run the tool against the docker image defined in `dockerImage`
mode = 'docker'

##
# How we should process the licenses
# options are: 
# - "fossa-api": will export to fossa api (requires FOSSA_API_KEY to be set in .env)
# - "fossa-json": will export from fossa to a folder of json files. This just shows import heirarchies, and doesn't scan licenses
# - "lc-csv": will use npm license-checker, and export to a list of csv files
# - "lc-summary": will use npm license-checker, and export a summary file for each repo
tool = "lc-csv"

##
# The docker image to be scanned.
# DEPRECATED: use `dockerImages` instead
#
# Ignored when `mode != "docker"`
# Override by setting `dockerImage` env variable
##
dockerImage = 'mojaloop/central-ledger:latest'


##
# A list of docker images to scan
#
# Ignored when `mode != "docker"`
# Override by setting `dockerImages` env variable
##
dockerImages = [
  "mojaloop/ml-api-adapter:latest",
  "mojaloop/central-ledger:latest"
]

##
# A list of packages that we have manually audited and are ok with.
#
# string: Format: "<package>;<reason>"
#
#
# e.g.
# excludeList = [
#   "taffydb@2.6.2;Contains MIT license on github, but not listed in package.json"
# ]
#
# will ignore taffydb@2.6.2 in the license check, and put the "Contains MIT..." reason in the license-summary
##
excludeList = [
  "taffydb@2.6.2;Contains MIT license on github, but not listed in package.json",
  "buffercursor@0.0.12;No license on github or npm", # has no license on github or npm
  "cycle@1.0.3;Listed as Public-Domain on npm, but no License file in github",
  "spdx-exceptions@2.2.0;Requires attribution",
]

##
# A list of licenses strings that we allow.
##
allowedList = [
  "AFLv2.1",
  "Apache License, Version 2.0",
  "Apache*",
  "Apache-2.0",
  "BSD",
  "BSD*",
  "BSD-2-Clause",
  "BSD-3-Clause",
  "CC-BY-3.0",
  "CC0-1.0",
  "ISC",
  "MIT",
  "MIT*",
  "Public Domain",
  "UNLICENSED",
  "Unlicense",
  "Unlicensed",
  "WTFPL",
]