We use iText7 in an application.
The scan of the artefact reports violations of the policy “License-Banned”. There are violations found for the following components:
com.itextpdf : forms : 7.1.13
com.itextpdf : html2pdf : 3.0.2
com.itextpdf : io : 7.1.13
com.itextpdf : kernel : 7.1.13
com.itextpdf : layout : 7.1.13
com.itextpdf : pdfa : 7.1.13
com.itextpdf : sign : 7.1.13
com.itextpdf : styled-xml-parser : 7.1.13
com.itextpdf : svg : 7.1.13
Our valid license-file is located in the artefact and is loaded in the way iText suggests:
com.itextpdf.licensekey.LicenseKey.loadLicenseFile(pathToLicFile);
(from library itext-licensekey-3.1.1)
In the running application, the license is loaded correctly as show in the properties of created PDF files.
Otherwise, AGPL would appear in this place.
Why is Sonartype reporting the violation?
Are there any certain conditions for NexusIQ scanner to recognise the license files or do the files need to be in any certain location?