Finding license dependencies from GitHub repo

Question

How can I easily determine a project's dependencies' licenses? For example on my GitHub repo which includes multiple open source softwares.

Answer 1

In case you are using java project build by maven than add https://github.com/openCage/loracle-maven-plugin into your pom.xml.

It checks whether all licenses of all dependencies (direct and transitive) are declared and fit together with your declared license.

note: my project

Answer 2

Unfortunately, open-source license compliance is a tricky task. There are open source (e.g. Fossology) and proprietary (e.g. Black Duck's Protex) tools assisting you.

It would be so much more easier and convinient if SPDX becomes a standard for all open-source projects.

Answer 3

The OSS Review Toolkit's analyzer is designed to do just that. You need to clone your GitHub repo to a local working directory, and then run the analyzer on it as explained in the getting started document at the example of the mime-types project.

Disclaimer: I'm the founder and lead developer of the OSS Review Toolkit (ORT).

Answer 4

Unfortunately, this is not always so easy. Some dependencies have a mix of files with different licenses, and they are difficult to find.

Just as an example: When you look at org.springframework.security:spring-security-crypto it clearly seems to be an Apache 2.0 licensed library. However it includes 1 file which is under ISC license: BCrypt.java

I think it is difficult to determine how much diligence developers have to show in searching/finding cases like this in dependencies of their software, or if it is enough to rely on the declarations of the project itself in the repository.

[I know the question is old, but still want to add my 2c]

Answer 5

For example, look at this project

You can see it here：

Open https://github.com/otale/tale/blob/master/LICENSE