License Inspector finds all dependencies for .NET solutions or JavaScript projects, detects their licenses and generates a report with violations based on rules given by the user.

At many companies there might be rules regarding which external dependencies may be taken based on their licensing terms. Keeping track of the licenses of all dependencies and sub-dependencies across all used versions is not a fun manual task.

This project tries to solve this problem in a resonably slim and pragmatic way.

There are many good commercial options available where this functionality is provided, often in combination with security analysis. See Software Composition Analysis if you need something with commercial support.

JSON:

[
  {
    "Package": {
      "Id": "Newtonsoft.Json",
      "Version": "12.0.3",
      "Messages": [],
      "State": "Ok",
      "License": "MIT",
      "Result": "Ok",
      "Remark": ""
    },
    "Dependencies": []
  },
  {
    "Package": {
      "Id": "Serilog.Sinks.Console",
      "Version": "3.1.1",
      "Messages": [],
      "State": "Ok",
      "License": "Apache-2.0",
      "Result": "Ok",
      "Remark": ""
    },
    "Dependencies": [
      {
        "Package": {
          "Id": "Serilog",
          "Version": "2.5.0",
          "Messages": [],
          "State": "Ok",
          "License": "Apache-2.0",
          "Result": "Ok",
          "Remark": ""
        },
        "Dependencies": []
      }
    ]
  }
  ...
]

Human readable:

- CommandLineParser 2.7.82                                         MIT                  Ok
- Newtonsoft.Json 12.0.3                                           MIT                  Ok
- NuGet.Protocol 5.4.0                                      Apache-2.0                  Ok
 - NuGet.Packaging 5.4.0                                    Apache-2.0                  Ok
   - NuGet.Configuration 5.4.0                               Apache-2.0                  Ok
     - NuGet.Common 5.4.0                                     Apache-2.0                  Ok
       - NuGet.Frameworks 5.4.0                                Apache-2.0                  Ok
   - NuGet.Versioning 5.4.0                                  Apache-2.0                  Ok
   - Newtonsoft.Json 9.0.1                                          MIT                  Ok
- Roslynator.Analyzers 2.2.0                                Apache-2.0                  Ok
- Roslynator.CSharp 1.0.0                                   Apache-2.0                  Ok
 - Roslynator.Core 1.0.0                                    Apache-2.0                  Ok
- SemanticVersion 2.1.0                                            MIT                  Ok
- Serilog 2.9.0                                             Apache-2.0                  Ok

The application needs at least .NET Core 3.1 SDK, see .NET SDKs for Visual Studio

The shipped config and license policies will likely not suite you, but when you have gotten everything up-and-running, it can be easily tweaked to suite your needs.

git clone https://github.com/edespong/license-inspector.git

cd license-inspector

dotnet run --project src/Main/LicenseInspector.Main.csproj -- -r . -c src/Main/config.json -t dotnet -p

This will run the application on the source code for the application.

Note that if you are targeting .NET, the first run will download a lot of items from nuget.org which will take a significant amount of time (around 9500 files). If you want to reduce the time for this, you can run the following script.

New-Item -ItemType Directory -Force c:\temp\licence-inspector | Out-Null

Invoke-WebRequest https://www.dropbox.com/s/017ho23wr6zt66f/nugetPagesCache.zip?dl=1 -OutFile c:\temp\licence-inspector\nugetPagesCache.zip

Expand-Archive c:\temp\licence-inspector\nugetPagesCache.zip c:\temp\licence-inspector

Remove-Item c:\temp\licence-inspector\nugetPagesCache.zip

For NuGet packages, licenses are detected in roughly the following way:

• If the package has a license set manually by config, use it
• If the package metadata contains a valid SPDX license, use it
• If the package metadata points to a known license URL, which can be set by config, use that license
• Download the file pointed to by the package license URL and run license-detector on it. If the confidence is high enough, use the license from the output

The basics principle is that a package will never change once it has been released. As such, the information around a package and its dependencies is cached when fetched the first time.

If you are running the application in such a way that the environment is continously set up and torn down, you should set a stable cache path such as a network share or similar.

• Dependencies way vary depending on target platform. This is ignored.

• Recursive dependency lookup for internal packages are based on location rather than project. This means that if an internal dependency is part of a larger codebase, all dependencies of that codebase are discovered.