license-audit¶

Analyze dependency licenses for Python projects.

license-audit tells you what license your project can use, flags incompatible combinations, and generates compliance documents suitable for CI gating.

Features¶

License detection across the full transitive tree, from PEP 639 metadata, the legacy License field, trove classifiers, and user overrides.
Pairwise compatibility checking against the OSADL compatibility matrix (~120 licenses).
Outbound license recommendations ranked by permissiveness.
Compliance reports as Markdown, JSON, or third-party-notices.
CI exit codes that distinguish policy violations from undetected licenses.
Reads the licenses straight from your installed environment: provision it however you like (uv, Poetry, pip), then point license-audit at it.

Installation¶

pip install license-audit

Or with uv:

uv add license-audit --dev

Quickstart¶

Provision your dependencies first, then run license-audit inside that environment:

uv sync
uv run license-audit analyze

Or point it at an existing virtualenv:

license-audit --target .venv analyze

───────────────────── License Analysis: my-project ─────────────────────
Source: /path/to/my-project/.venv

                         Dependency Licenses
┏━━━━━━━━━━┳━━━━━━━━━┳━━━━━━━━━━━━━━┳━━━━━━━━━━━━┳━━━━━━━━┳━━━━━━━━━━┓
┃ Package  ┃ Version ┃ License      ┃ Category   ┃ Source ┃ Parent   ┃
┡━━━━━━━━━━╇━━━━━━━━━╇━━━━━━━━━━━━━━╇━━━━━━━━━━━━╇━━━━━━━━╇━━━━━━━━━━┩
│ click    │ 8.3.1   │ BSD-3-Clause │ permissive │ pep639 │ (direct) │
│ pydantic │ 2.12.5  │ MIT          │ permissive │ pep639 │ (direct) │
│ rich     │ 14.3.0  │ MIT          │ permissive │ pep639 │ (direct) │
└──────────┴─────────┴──────────────┴────────────┴────────┴──────────┘

Recommended Outbound Licenses (most -> least permissive):
  -> MIT
     Apache-2.0
     BSD-2-Clause
     BSD-3-Clause
     ISC
  ... and 111 more

──────────────────────────────── Summary ───────────────────────────────
  Total dependencies: 3
  Unknown licenses:   0
  Copyleft licenses:  0
  Policy check:       PASSED

Commands¶

Command	Purpose
`analyze`	Per-package analysis in the terminal, or as JSON with `--format json`
`check`	CI policy gate with distinct exit codes
`report`	Compliance documents: Markdown, JSON, or third-party notices
`recommend`	Outbound license recommendation with guidance
`refresh`	Re-download the OSADL compatibility data

See the commands reference for details.

CI quickstart¶

Add to your pipeline to gate on license policy:

jobs:
  license-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v5
      - run: uv sync --locked
      - run: uv run license-audit check

Exit codes:

Code	Meaning
`0`	All dependencies pass the policy
`1`	Policy violation (incompatible pairs, denied licenses, or category exceeded), or the check could not run
`2`	Unknown licenses detected and no other violation (when `fail-on-unknown = true`)

For GitLab, pre-commit, handling unknowns, and the new-dependency workflow, see the CI integration guide.

Configuration¶

[tool.license-audit]
fail-on-unknown = true
policy = "permissive"  # permissive | weak-copyleft | strong-copyleft | network-copyleft
allowed-licenses = ["MIT", "Apache-2.0", "BSD-3-Clause"]
denied-licenses = ["GPL-3.0-only"]
target = ".venv"  # optional; defaults to ./.venv, else the active environment

[tool.license-audit.overrides]
some-internal-package = "MIT"
dual-licensed-pkg = "Apache-2.0 OR MIT"

[tool.license-audit.license-classifications]
"CNRI-Python" = "permissive"  # your judgement for licenses OSADL doesn't cover

[tool.license-audit.ignored-packages]
pandas-stubs = "Stubs only, not redistributed"

Full reference: user guide -> configuration.

Documentation¶

Full documentation lives at https://dgeragh.github.io/license-audit:

License¶

MIT. See LICENSE.

This project bundles data from the OSADL Open Source License Obligations Checklists project, licensed under CC-BY-4.0. See THIRD_PARTY_NOTICES.md for full attribution.