How can I easily determine a project's dependencies' licenses? For example on my GitHub repo which includes multiple open source softwares.

  • how is this asking for a tool? what if the answer was "look at this tab".
    – albert
    Mar 2, 2017 at 23:21
  • 1
    Dependencies is a vague concept. Github support reporting deps for Ruby only at this stage. And their detection is kinda crap. Which language are you talking about? Mar 3, 2017 at 15:37
  • Can you tell which language you are concerned with? Apr 28, 2017 at 21:30

5 Answers 5


In case you are using java project build by maven than add https://github.com/openCage/loracle-maven-plugin into your pom.xml.

It checks whether all licenses of all dependencies (direct and transitive) are declared and fit together with your declared license.

note: my project


Unfortunately, open-source license compliance is a tricky task. There are open source (e.g. Fossology) and proprietary (e.g. Black Duck's Protex) tools assisting you.

It would be so much more easier and convinient if SPDX becomes a standard for all open-source projects.


The OSS Review Toolkit's analyzer is designed to do just that. You need to clone your GitHub repo to a local working directory, and then run the analyzer on it as explained in the getting started document at the example of the mime-types project.

Disclaimer: I'm the founder and lead developer of the OSS Review Toolkit (ORT).


Unfortunately, this is not always so easy. Some dependencies have a mix of files with different licenses, and they are difficult to find.

Just as an example: When you look at org.springframework.security:spring-security-crypto it clearly seems to be an Apache 2.0 licensed library. However it includes 1 file which is under ISC license: BCrypt.java

I think it is difficult to determine how much diligence developers have to show in searching/finding cases like this in dependencies of their software, or if it is enough to rely on the declarations of the project itself in the repository.

[I know the question is old, but still want to add my 2c]


For example, look at this project

You can see it here:

Open https://github.com/otale/tale/blob/master/LICENSE

  • 5
    That displays the license of the project, not the project's dependencies.
    – RubberDuck
    Mar 5, 2017 at 12:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.