Check a CycloneDX or SPDX SBOM for AGPL and other copyleft licences

A software bill of materials (SBOM) lists the components of a project. If each component carries a licence field, you can check the list against a licence policy without installing anything. The free command-line tool described here does that for the two common SBOM formats, CycloneDX and SPDX, using only the Python standard library.

Where each format keeps the licence

CycloneDX (JSON). Each entry in components can have a licenses list. An item holds either an SPDX licence id, a licence name, or an SPDX expression. The tool reads several entries in one list as all applying (AND).

SPDX 2.x (JSON). Each entry in packages has licenseConcluded and licenseDeclared. The tool uses licenseConcluded and falls back to licenseDeclared when the first is missing, NOASSERTION or NONE. It skips the package the document says it describes, which is your own project. The SPDX reader has been tested only against a made-up fixture in the repository, not against a real GitHub export.

For background on the formats, see Wikipedia on software supply chains, software bills of materials and the GNU Affero General Public License.

How the default policy treats AGPL, GPL and LGPL

These rules come from policies/default.json in the repository, a policy for an MIT-licensed project in distributed-binary mode. They are the maintainer's interpretation and may become outdated.

• AGPL-3.0-only and AGPL-3.0-or-later: deny (exit code 1).
• GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only and GPL-3.0-or-later: deny.
• SSPL-1.0: deny.
• LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-only and LGPL-3.0-or-later: review, meaning a person decides.
• MPL-2.0 and EPL-2.0: review.
• MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC and a few other permissive licences: allow.

Names in the deny, allow and review lists are decided first. For a licence in none of the lists, the project mode picks a default for its category:

• Weak copyleft (for example LGPL): allow in internal, saas and distributed-source; review in distributed-binary.
• Strong copyleft (GPL): allow in internal; review in saas and distributed-source; deny in distributed-binary.
• Network copyleft (AGPL and similar): review in internal; deny in the other three modes.

If a component offers a choice such as MIT OR GPL-3.0-only, the tool lets the most permissive branch decide. With AND, the strictest branch decides. To change any of this, pass your own policy with --policy FILE; the policies page shows eight other rule sets.

The command

Clone the repository at github.com/autoaugeo/augeo-dependency-license-checker-15b5 and run, from its root, the SPDX example from its README:

python -m licence_check tests/fixtures/sbom.spdx.json

For a CycloneDX file the command has the same shape:

python -m licence_check tests/fixtures/bom.json --format json

With your own file, replace the path with your SBOM. The exit code is 0 when nothing is denied, 1 when at least one package is denied, 2 when nothing is denied but something needs review and you passed --fail-on review, and 3 on a usage error. That makes it usable as a CI step.

Offline limit

Licence detection works only where the file carries licence fields. The tool makes no network calls, so it cannot look up a licence that the SBOM leaves out. A component with no licence, or with NOASSERTION in both SPDX fields, is reported as review rather than guessed. An unrecognised licence name is also review. If your SBOM generator left the licence fields empty, fix that first.

The result depends on your policy, not on a legal analysis of how the code is combined. Whether a copyleft licence affects your project depends on how you use the component, and that is a question for qualified counsel.