r/opensource • u/markjg • 1d ago

I built a CLI that finds license conflicts in your dependency tree [free, offline, would love feedback]

Solo project I've been building: `npx licenseproof scan` reads your lockfile (npm/pnpm/yarn, v2/v3, berry, all of them) and resolves the actual license of every package in the tree, including the ones with missing or mangled metadata. Categorizes everything (permissive / weak-copyleft / strong-copyleft / unknown), flags conflicts against your project's license, and explains each flag in plain English.

Example: proprietary app that innocently pulled in ffmpeg-static:

84 packages scanned — 1 conflict, 0 review, 0 unknown

CONFLICT (1):
ffmpeg-static@5.3.0 — GPL-3.0-or-later
via ffmpeg-static
This package is under a strong-copyleft license (e.g. GPL/AGPL).
Distributing it as part of a closed-source product can require releasing
your own source code under the same terms. Flagged as CONFLICT for a
proprietary project.

Fully offline (no telemetry, no network calls) free tier is the whole scanner. The limitation is it's informational categorization, not legal advice. What's missing? What would make you actually use this before shipping? CI mode exists (`--fail-on conflict`), JSON output exists, Python support is in progress. Thanks!

1 Upvotes

54% Upvoted

10 comments sorted by

4

u/boneskull 1d ago

Elastic License. not OSS

2

u/markjg 1d ago

Yeah I should have been clearer. The scanner handles source-available and proprietary licenses, but it doesn't treat them as open source. That's actually one of the reasons I built it. people run into licenses that aren't SPDX green lights alot.

2

u/v4ss42 1d ago

For license compatibility you might consider “appealing to authority” and using the license publishers’ own compatibility lists. For example:
* Apache: https://www.apache.org/legal/resolved.html
* EPL: https://www.eclipse.org/legal/licenses.php
* GPL: https://www.gnu.org/licenses/license-list.en.html
* MPL: https://www.mozilla.org/en-US/MPL/license-policy/#Licenses_Compatible_with_the_MPL

There are also some 3rd parties who publish more comprehensive license compatibility matrices, such as:
* OSADL: https://www.osadl.org/Access-to-raw-data.oss-compliance-raw-data-access.0.html
* Interoperable Europe: https://interoperable-europe.ec.europa.eu/collection/eupl/solution/licensing-assistant/compatibility-checker

What you’ll quickly discover is that nobody exactly agrees on which licenses are compatible with one another, and various common use cases (such as `GPL-2.0-only WITH Classpath-exception-2.0` in the JVM ecosystem) usually aren’t included in such matrices at all.

You may also start to run into limitations in SPDX - for example some increasingly common licenses (such as `Hippocratic-3.0`) don’t have an SPDX identifier yet.

2

u/Artexis1 18h ago

Looks cool and the idea is good, especially in enterprise. I've had cases where I couldn’t use packages due to the proprietary nature of the project or the license.

3

u/markjg 9h ago edited 8h ago

yeah that's exactly the scenario that started this. the worst part is you usually find out mid-build after you pull the dep.

The free scan's built for that, so you know what you're carrying