Whitelist

[ntdaley]

A blacklist is good, but with a black list, any new types of licenses will be allowed.
This could be a problem if the licenses haven't been vetted as being compatible with our license.

A whitelist might cause a dependency to incorrectly get flagged in the case of a new license. But this would be easily noticed, and the new license could be added to the whitelist.

A blacklist on the other hand could incorrectly let a dependency with an incompatible license past. This would not be easily noticed.