Repository navigation
Clarify licenses of aggregated data, in particular undisclosed CC-BY-ND-NC licensed data #6218
Description
There have been historical efforts to clarify the license of the aggregated data feeds served by OSV.dev such as:
The documentation publishes a list of data sources and licenses:
- https://google.github.io/osv.dev/data/#current-data-sources
- from https://github.com/google/osv.dev/blob/master/docs/data.md
The bulk of the licenses documented there are permissive, except for the Ubuntu CC-BY-SA which a limited copyleft license.
There are data sources in use that are missing from that doc, and some have seriously problematic licenses restricting their use for open source in general, and likely so for any organization, group, and companies.
For instance, the wolfi OSV data are under a proprietary CC-BY-NC-ND-4.0 license:
Proposed resolution
Here are some ideas to resolve that problem:
- clarify and document the OSV.dev data license policy and which licenses are allowed
- stop distributing the wolfi data source unless CC-BY-NC-ND-4.0 is an acceptable license, or work with that group to have them use a proper allowed license.
- track the license of each data source in https://github.com/google/osv.dev/blob/master/source.yaml and use that data to generate the https://github.com/google/osv.dev/blob/master/docs/data.md doc with the current list of sources
- address other unknown or unpalatable license issues for the other data sources
- update the OSV schema at the OpenSSF to support tracking data license in OSV feeds to make this a lesser issue in the future
Activity
docs: datasource licenses and licenses requirements (#6220)
michaelkedar commentedon Oct 23, 2026
Thanks for bringing this up.
I've updated the docs to list more licenses (though it's still not exhaustive) and updated our contribution docs on OSV.dev to require new data sources to supply licenses. We'll need to reach out to a number of data sources who have not listed a license.
I agree, having them in
source.yamlis sensible. I might take a look into generating the docs in future.The Wolfi/Chainguard license is now explicitly mentioned on our docs site, so downstream consumers can be aware of them. This does seem like it might be an oversight to me - we've had people from Chainguard contributing to OSV, so they evidently want the data available in OSV.dev.
pombredanne commentedon Nov 10, 2026
@cpanato re: the closed and related issue
@michaelkedar has clarified OSV licensing requirements at
and Wolfi data is the only data that no longer complies with these:
This has been documented at
osv.dev/docs/data.md
Line 71 in 59ebdcf
@cpanato may I suggest that you either withdraw publishing Chainguard data at OSV or consider changing your data license? It looks like an ugly wart and is seriously problematic. For all I know, OSV may actually be out of compliance with that CC-BY-NC-ND license as they publish something that could be construed as a derivative?
xnox commentedon Nov 10, 2026
Hi @michaelkedar,
The Wolfi & Chainguard OSV feed is licensed under Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International (CC BY-NC-ND 4.0), provided, however, the Chainguard License for Commercial Scanners shall apply to Commercial Scanners available at https://www.chainguard.dev/legal/chainguard-license-for-commercial-scanners, as such terms are defined therein.
The two license terms together are permissive and so far has been suitable for all use cases by all users.
I have read the updated https://github.com/google/osv.dev/blob/master/docs/new_source.md#data-licensing and my understanding (I am not a lawyer) the two licenses together meet all at minimum requirements listed in the updated new_source.md document; when both license terms are taken into account.
If it isn't, or you have any questions or concerns, please reach out - and I can put you in touch with relevant people to discuss this further privately.
To avoid any misunderstanding, both licenses should be encoded there. I.e. a custom SPDX LicenseRef; or like https://reuse.software/ statement in a LICENSE/ folder; etc. I can propose a PR to add it as a URL reference, and we can figure out if some other format is preferred there.
michaelkedar commentedon Nov 11, 2026
I've added the Chainguard License for Commercial Scanners to the docs page.
As a not-a-lawyer myself, I'll have to get back to you about whether it's still a concern or not.
docs: add chainguard license for commercial scanners (#6333)