中文
devexamples
← Workflows

阅读中文版本

Open Source License Compliance Workflow

Collect license metadata for all dependencies, classify obligations, flag incompatible or unknown licenses, and produce notices before release.

intermediate~90 mincompliancelicensingsupply-chain

Objective

Ensure dependency licenses are known, compatible with distribution, and their obligations are met.

Environment

  • A license scanning tool
  • A dependency inventory

Steps

1. Scan dependencies and collect license identifiers

Scan dependencies and collect license identifiers.

Expected state: Every dependency has a known license.

2. Classify obligations: permissive, copyleft, or unknown

Classify obligations: permissive, copyleft, or unknown.

Expected state: You know what each license requires.

3. Flag incompatible or unknown licenses

Flag incompatible or unknown licenses for review.

Expected state: Risky dependencies are escalated.

4. Generate notices and attributions required

Generate notices and attributions required by the licenses.

Expected state: Distribution obligations are met.

Decision points

Block copyleft or review it?

  • Review with legal
  • Block outright

Review with a documented decision; some copyleft is fine for internal use but not for distribution.

Allow unknown licenses?

  • No
  • Yes with a note

Block unknown licenses until identified; unknown means uncontrolled obligation.

Expected outcome

A dependency license inventory with obligations classified, risky licenses reviewed, and required notices generated for release.

Verification

Confirm no distributed artifact contains an unapproved copyleft or unknown-license dependency and that notices include all required attributions.

Cleanup

Record decisions for flagged licenses and update the approved-license policy.

Overview

Ensure dependency licenses are known, compatible with distribution, and their obligations are met. Confirm no distributed artifact contains an unapproved copyleft or unknown-license dependency and that notices include all required attributions.

Steps

  1. Scan dependencies and collect license identifiers. Expected state: Every dependency has a known license.
  2. Classify obligations: permissive, copyleft, or unknown. Expected state: You know what each license requires.
  3. Flag incompatible or unknown licenses for review. Expected state: Risky dependencies are escalated.
  4. Generate notices and attributions required by the licenses. Expected state: Distribution obligations are met.
npx license-checker --summary
# or
syft $IMAGE -o spdx-json | jq '[.packages[].licenseConcluded]'

Verification

  • A dependency license inventory with obligations classified, risky licenses reviewed, and required notices generated for release.

Decision points

  • Block copyleft or review it? Options: Review with legal; Block outright. Recommended: Review with a documented decision; some copyleft is fine for internal use but not for distribution.
  • Allow unknown licenses? Options: No; Yes with a note. Recommended: Block unknown licenses until identified; unknown means uncontrolled obligation.