Command line application to validate that project dependencies comply with licence restrictions dictated by a company. This works by identifying project licences using the reliable go-license-detector, then validating that the most pertinent licences (those with highest confidence level) do not match any of the restricted licences specified as arguments. The list of restricted licences are passed as arguments to allow projects to have different restriction policies. Optional filters can be used to ignore some projects and/or override the licence detected for a project.

The checker is intended for use in continuous integration pipelines, to help ensure that projects are complying with licence restrictions on an ongoing basis.

If you already have Go installed, the easiest way of installing is with go get:

go get github.com/sky-uk/licence-compliance-checker

licence-compliance-checker -r LGPL -r GPL -r AGPL -o vendor/github.com/spf13/cobra=MIT vendor/github.com/spf13/cobra vendor/golang.org/x/crypto

See the licencecheck target in the Makefile for an example of how to use with dependencies managed by go dep

Example of JSON output

{
  "compliant": [
    {
      "project": "testdata/BSD3",
      "matches": [
        {
          "license": "BSD-3-Clause",
          "confidence": 0.9953052
        },
        {
          "license": "BSD-4-Clause",
          "confidence": 0.84976524
        },
        {
          "license": "BSD-3-Clause-No-Nuclear-License-2014",
          "confidence": 0.8356807
        },
        {
          "license": "BSD-Source-Code",
          "confidence": 0.8333333
        }
      ]
    }
  ],
  "restricted": [
    {
      "project": "testdata/MIT",
      "matches": [
        {
          "license": "MIT",
          "confidence": 0.9814815
        },
        {
          "license": "JSON",
          "confidence": 0.9259259
        },
        {
          "license": "MIT-feh",
          "confidence": 0.8447205
        },
        {
          "license": "Xnet",
          "confidence": 0.80864197
        }
      ]
    }
  ],
  "unidentifiable": null,
  "ignored": null
}

• If you have a general question about this project, please create an issue for it. The issue title should be the question itself, with any follow-up information in a comment. Add the "question" tag to the issue.

• If you think you have found a bug in this project, please create an issue for it. Use the issue title to summarise the problems, and supply full steps to reproduce in a comment. Add the "bug" tag to the issue.

See CONTRIBUTING.md