How can I easily determine a project's dependencies' licenses? For example on my GitHub repo which includes multiple open source softwares.

  • how is this asking for a tool? what if the answer was "look at this tab". – albert Mar 2 '17 at 23:21
  • 1
    Dependencies is a vague concept. Github support reporting deps for Ruby only at this stage. And their detection is kinda crap. Which language are you talking about? – Philippe Ombredanne Mar 3 '17 at 15:37
  • Can you tell which language you are concerned with? – Philippe Ombredanne Apr 28 '17 at 21:30

In case you are using java project build by maven than add https://github.com/openCage/loracle-maven-plugin into your pom.xml.

It checks whether all licenses of all dependencies (direct and transitive) are declared and fit together with your declared license.

note: my project


Unfortunately, open-source license compliance is a tricky task. There are open source (e.g. Fossology) and proprietary (e.g. Black Duck's Protex) tools assisting you.

It would be so much more easier and convinient if SPDX becomes a standard for all open-source projects.


The OSS Review Toolkit's analyzer is designed to do just that. You need to clone your GitHub repo to a local working directory, and then run the analyzer on it as explained in the getting started document at the example of the mime-types project.

Disclaimer: I'm the founder and lead developer of the OSS Review Toolkit (ORT).


For example, look at this project

You can see it here:

Open https://github.com/otale/tale/blob/master/LICENSE

  • 3
    That displays the license of the project, not the project's dependencies. – RubberDuck Mar 5 '17 at 12:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.