Keep bad packages out
License policy for open source packages
Each cached file has its license read from the package metadata and turned into an SPDX expression where it can be. Then three lists you control decide what happens.
npm licenses come from license or the old licenses array. PyPI licenses come from License-Expression, then License, then the trove classifiers. NuGet licenses come from the licenseExpression only, so an older package that points at a license url counts as unknown. Maven reads the pom, RubyGems the gem's license list, CocoaPods the podspec, Composer composer.json, and RPM the package header. Swift packages, APT packages and container images name no license anywhere this box reads, so they count as unknown. GPL-2.0+ becomes GPL-2.0-or-later, and "Apache Software License" becomes Apache-2.0. Nothing is guessed: SEE LICENSE IN or a pasted license text counts as unknown, with a note saying why.
Settings, Licenses has allowed, needs review and blocked, one SPDX id per line with * as a wildcard (BSD-*). In MIT OR GPL-3.0-only the better choice counts, in MIT AND GPL-3.0-only the worse part does. You also choose what a license on no list is, and what an unreadable one is.
- off, the default, does nothing.
- warn logs it and npm prints a
LICENSE:notice during the install. - enforce holds review licenses in quarantine and rejects blocked ones.
Changing a list re-judges every stored license at once, with no network. A license waiver covers exactly one license on exactly those versions, so if a package changes license the waiver does not follow it.
In short
- SPDX normalization for npm, PyPI, NuGet, Maven, RubyGems, CocoaPods, Composer and RPM, nothing guessed
- Allowed, needs review and blocked lists, with wildcards
- OR takes the better choice, AND the worse part
- Off, warn or enforce through quarantine
- Changing a list re-judges everything already cached
In the documentation
- Licenses, lookalikes and provenance Administrator Guide
Goes well with
- Integrity alerts and quarantine A file that changes after it was first seen is held. The original keeps being served.
- Waivers A written down, time boxed yes for one finding on one package, scoped to an app or environment.
- Artifacts, SBOMs and lifecycle Every file stored once by SHA-256, CycloneDX and SPDX out, properties and promotion stages.
One container, about two minutes
A Linux box with Docker, or one without it, and a reverse proxy for TLS. The installer does the rest and it is safe to run twice. Free, MIT licensed, nothing to sign up for.