Dependency Firewall early access: 50% off the base fee. See pricing

Block packages by license

Keep packages under licenses you have not approved out of your builds. A license set names the licenses, and a rule on each firewall checks every download against it, for direct and transitive dependencies.

Start 14-day free trialBook a demo

How license enforcement works

  1. 1Name the licenses in a set

    A license set is a list of SPDX license IDs. Every namespace starts with a Copyleft set (GPL, AGPL and LGPL variants, SSPL-1.0, EUPL-1.2, CC-BY-SA-4.0) that you can use, edit or copy.

  2. 2Add a rule that uses the set

    Block the licenses in the set, or block every license that is not in it. A third mode blocks packages with no license information.

  3. 3Every download is checked

    The package manager downloads each dependency through the firewall, direct or transitive. A version whose license breaks the rule is not served.

What a license policy covers

Shared across ecosystems
Sets belong to the namespace and every firewall can use them. The same Copyleft list backs the rules of your npm, Maven and PyPI firewalls.
Deny list or allow list
A strict policy is an allow rule for the approved set and a rule for unknown licenses. A package then passes only with an approved license.
Dual licenses count in full
Every license in an expression counts. A package declared as MIT OR GPL-3.0-only matches a set that contains GPL-3.0-only. Add an exception for the ones you accept.
Log first
A rule can log without blocking. Run it to see which licenses you use today, then switch on block.
Block the Copyleft set
{  "id": "block-copyleft",  "executionPhase": "download",  "selector": {    "function": {      "name": "license",      "options": {        "licenseSet": "<license-set-id>",        "mode": "deny"      }    }  },  "ruleEffect": { "block": true, "log": true }}

Questions

Can we allow some licenses and block everything else?

Yes. An allow rule blocks every package whose license is not in the set. Add the rule for unknown licenses too, so a package with no license information is also blocked.

Where does the license data come from?

From a public license data source first, then from the license the package declares in its registry metadata on npm, NuGet, Composer and Conda.

Does it cover container images?

No. License rules are not available on container firewalls.

Does this replace an SCA tool?

No. The firewall blocks disallowed licenses at install. For a full inventory and license reporting per release, use SBOM Observer.

More features

Also in the Bytesafe platform

Try it on one registry

Point one package manager at Dependency Firewall and check the log after the next install. The trial runs 14 days.

Start free trialBook a demo