Add support to ignore by package instead of by id

[Patrick-Remy]

Description

With the great new support for .trivyignore.yaml files #5070 , it is easily possible to ignore certain Licenses onnly for a specified path.

In my case I would like to ignore a certain license by package name. Use cases are:

• Internal (node) package with license type UNLICENSED, which is recommended in https://docs.npmjs.com/cli/v10/configuring-npm/package-json#license
• Purchased licenses for a specific package

Currently it is only possible to use the license-id as id inside the ignorefile, which would ignore e.g. UNLICENSED for all dependencies.

Same could affect for vulnarabilites where you want to accept a risk only for a certained, checked package that does not affect you.

Is there currently any workaround? How dow you think about it?
/cc @knqyf263

Target

None

Scanner

License

[Patrick-Remy]

May be possible if rego is supported for licenses #6004

[knqyf263]

Thanks for your suggestion. I think using PURL makes more sense. I created #6119 for tracking.