{"id":19368454,"url":"https://github.com/anchore/grant","last_synced_at":"2026-02-18T23:03:22.029Z","repository":{"id":220995548,"uuid":"575008869","full_name":"anchore/grant","owner":"anchore","description":"A license scanner for container images and filesystems.","archived":false,"fork":false,"pushed_at":"2026-02-17T16:08:17.000Z","size":6592,"stargazers_count":140,"open_issues_count":22,"forks_count":12,"subscribers_count":9,"default_branch":"main","last_synced_at":"2026-02-17T19:36:41.949Z","etag":null,"topics":["compliance","golang","license","sbom","static-analysis"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/anchore.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2022-12-06T14:54:51.000Z","updated_at":"2026-02-17T16:09:56.000Z","dependencies_parsed_at":"2026-01-08T20:04:30.655Z","dependency_job_id":null,"html_url":"https://github.com/anchore/grant","commit_stats":{"total_commits":140,"total_committers":10,"mean_commits":14.0,"dds":0.5,"last_synced_commit":"eb20c776a04ee047e7cfe821c0491162268e143a"},"previous_names":["anchore/grant"],"tags_count":31,"template":false,"template_full_name":null,"purl":"pkg:github/anchore/grant","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anchore%2Fgrant","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anchore%2Fgrant/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anchore%2Fgrant/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anchore%2Fgrant/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/anchore","download_url":"https://codeload.github.com/anchore/grant/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anchore%2Fgrant/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29597854,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-18T22:25:43.180Z","status":"ssl_error","status_checked_at":"2026-02-18T22:25:42.766Z","response_time":162,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["compliance","golang","license","sbom","static-analysis"],"created_at":"2024-11-10T08:06:28.278Z","updated_at":"2026-02-18T23:03:21.993Z","avatar_url":"https://github.com/anchore.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Grant\n\nView licenses for container images, SBOM documents, filesystems, and apply rules that help you build a license\ncompliance report.\n\n![demo](https://github.com/anchore/grant/assets/32073428/981be7c0-582f-4966-a1e9-31e770aba9eb)\n\n### Supply an image\n```bash\n$ grant check redis:latest\n```\n\n#### Supply an SBOM document\n```bash\n$ grant check alpine.spdx.json\n```\n\n### Supply multiple sources including stdin and a mix of image and sbom\n```bash\n$ syft -o spdx-json alpine:latest | grant check node:latest\n```\n\n\n## Installation\n```bash\ncurl -sSfL https://raw.githubusercontent.com/anchore/grant/main/install.sh | sh -s -- -b /usr/local/bin\n```\n\n... or, you can specify a release version and destination directory for the installation:\n\n```\ncurl -sSfL https://raw.githubusercontent.com/anchore/grant/main/install.sh | sh -s -- -b \u003cDESTINATION_DIR\u003e \u003cRELEASE_VERSION\u003e\n```\n\n## Usage\n\nGrant can be used with any container image, sbom document, or directory to scan for licenses and check those classifierResults\nagainst a set of rules provided by the user.\n\nRules take the form of a pattern to match the license against, a name to identify the rule, a mode to either allow,\ndeny, or ignore the license,\na reason for the rule, and a list of packages that are exceptions to the rule.\n```\npattern: \"*gpl*\"\nname: \"deny-gpl\"\nmode: \"deny\"\nreason: \"GPL licenses are not allowed\"\nexceptions:\n  - \"alpine-base-layout\" # We don't link against this package so we don't care about its license\n```\n\nMatching Rules:\n- Denying licenses take precedence over allowing licenses\n- License patterns are matched on a case-insensitive basis.\n- If a license is has rules for both modes it is denied\n\nSupplied patterns follow a standard globbing syntax:\n```\npattern:\n{ term }\n\nterm:\n`*`         matches any sequence of non-separator characters\n`**`        matches any sequence of characters\n`?`         matches any single non-separator character\n`[` [ `!` ] { character-range } `]`\ncharacter class (must be non-empty)\n`{` pattern-list `}`\npattern alternatives\nc           matches character c (c != `*`, `**`, `?`, `\\`, `[`, `{`, `}`)\n`\\` c       matches character c\n\ncharacter-range:\nc           matches character c (c != `\\\\`, `-`, `]`)\n`\\` c       matches character c\nlo `-` hi   matches character c for lo \u003c= c \u003c= hi\n\npattern-list:\npattern { `,` pattern }\ncomma-separated (without spaces) patterns\n```\n\nBy default grant is configured to deny all licenses out of the box.\n\nGrant can be used to deny specific licenses while allowing all others.\n\nIt can also be used to allow specific licenses, denying all others.\n\n## Output\n#### Table\n![table-output](https://github.com/anchore/grant/assets/32073428/59a516de-3acd-4f4a-8861-4e90eae09866)\n\n#### JSON: TODO\n![json-output](https://github.com/anchore/grant/assets/32073428/c2d89645-e323-4f99-a179-77e5a750ee6a)\n\n## Configuration\n\n### Example: Deny GPL\n\n```yaml\n#.grant.yaml\nconfig: \".grant.yaml\"\nformat: table # table, json\nshow-packages: false # show the packages which contain the licenses --show-packages\nnon-spdx: false # list only licenses that could not be matched to an SPDX identifier --non-spdx\nosi-approved: false # highlight licenses that are not OSI approved --osi-approved\nrules: \n    - pattern: \"*gpl*\"\n      name: \"deny-gpl\"\n      mode: \"deny\"\n      reason: \"GPL licenses are not allowed per xxx-xx company policy\"\n      exceptions:\n        - \"alpine-base-layout\" # We don't link against this package so we don't care about its license\n```\n\n### Example: Allow Lists\n\nIn this example, all licenses are denied except BSD and MIT:\n\n```yaml\n#.grant.yaml\nrules:\n  - pattern: \"BSD-*\"\n    name: \"bsd-allow\"\n    mode: \"allow\"\n    reason: \"BSD is compatible with our project\"\n    exceptions:\n      # Packages to disallow even if they are licensed under BSD.\n      - my-package\n  - pattern: \"MIT\"\n    name: \"mit-allow\"\n    mode: \"allow\"\n    reason: \"MIT is compatible with our project\"\n  # Reject the rest.\n  - pattern: \"*\"\n    name: \"default-deny-all\"\n    mode: \"deny\"\n    reason: \"All licenses need to be explicitly allowed\"\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fanchore%2Fgrant","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fanchore%2Fgrant","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fanchore%2Fgrant/lists"}