licenses
1 post · all writing
The license nobody gated on: copyleft in your dependency tree
A CVE is embarrassing and fixable. A copyleft obligation you have been shipping for two years is neither, and you find out during due diligence. How to gate a build on license policy with Trivy or Mend, why permissive licenses should not be findings, and why this belongs on a different threshold from your CVEs.