Package: liccheck
Python License CheckerCheck python packages listed in arequirements.txtfile and report license issues.AboutYou can define a list of authorized licenses, unauthorized licenses and authorized packages.The tool will check therequirements.txtfile, check packages and their
dependencies and return an error if some packages are not compliant
against the given strategy.The tool has 3 levels of checks to select from:Standard (default):A package is considered as compliant when at least one of its licenses is
in the authorized license list, or if the package is in the list of
authorized packages.Cautious:Same asStandard, but a package isnotconsidered compliant when one
or more of its licenses is in the unauthorized license list, even if it
also has a license in the authorized license list. A package is still
compliant if present in the authorized packages list.Paranoid:All licenses listed for a package must be in the authorised license list
for the package to be considered compliant. A package is still
compliant if present in the authorized packages list.AssumptionThe tool requires to be installed in the same python (virtual) environment as the packages. This, because it usespkg_resourcesto access the packages resources and thus, their licenses information.How to install$ pip install liccheckHow to useliccheckwill read therequirements.txtand verify compliance of packages against a strategy defined in theinifile.
If the requirements file is not specified on the command line, it will search forrequirements.txtin the current folder.
You have to setup aninifile with an authorized license list, unauthorized license list and authorized package list. The packages from yourrequirements.txtneed to all be installed in the same python environment/virtualenv asliccheck.
If theinifile is not specified on the command line, it will search forliccheck.iniin the current folder.Here is an example of aliccheck.inifile:# Authorized and unauthorized licenses in LOWER CASE
[Licenses]
authorized_licenses:
        bsd
        new bsd
        bsd license
        new bsd license
        simplified bsd
        apache
        apache 2.0
        apache software license
        gnu lgpl
        lgpl with exceptions or zpl
        isc license
        isc license (iscl)
        mit
        mit license
        python software foundation license
        zpl 2.1

unauthorized_licenses:
        gpl v3

[Authorized Packages]
# Python software license (see http://zesty.ca/python/uuid.README.txt)
uuid: 1.30Note: versions of authorized packages can be defined usingPEP-0440 version specifiers, such as>=1.3,<1.4. The implementation uses the nice packagesemantic_version.For demo purpose, let’s say yourrequirements.txtfile contains this:Flask>=0.12.1
flask_restful
jsonify
psycopg2>=2.7.1
nose
scipy
scikit-learn
pandas
numpy
argparse
uuid
sqlbuilder
proboscis
pyyaml>=3.12The execution will output this:$ liccheck -s my_strategy.ini -r my_project/required.txt
gathering licenses...23 packages and dependencies.
check forbidden packages based on licenses...none
check authorized packages based on licenses...19 packages.
check authorized packages...4 packages.
check unknown licenses...noneIf some dependencies are unknown or are not matching the strategy, the output will be something like:$ liccheck -s my_strategy.ini -r my_project/requirements.txt
    gathering licenses...32 packages and dependencies.
    check forbidden packages based on licenses...1 forbidden packages :
        Unidecode (0.4.21) : GPL ['GNU General Public License v2 or later (GPLv2+)']
          dependency:
              Unidecode << python-slugify << yoyo-migrations

    check authorized packages based on licenses...24 packages.
    check authorized packages...6 packages.
    check unknown licenses...1 unknown packages :
        feedparser (5.2.1) : UNKNOWN []
          dependency:
              feedparserAlso supports pyproject.toml like:[project]
dependencies = [
    "Flask>=0.12.1",
    "flask_restful",
    "jsonify",
    "psycopg2>=2.7.1",
    "nose",
    "scipy",
    "scikit-learn",
    "pandas",
    "numpy",
    "argparse",
    "uuid",
    "sqlbuilder",
    "proboscis",
    "pyyaml>=3.12",
]

[project.optional-dependencies]
test = [
    "pytest>=3.6.3",
]

[tool.liccheck]
authorized_licenses = [
    "bsd",
    "new bsd",
    "bsd license",
    "new bsd license",
    "simplified bsd",
    "apache",
    "apache 2.0",
    "apache software license",
    "gnu lgpl",
    "lgpl with exceptions or zpl",
    "isc license",
    "isc license (iscl)",
    "mit",
    "mit license",
    "python software foundation license",
    "zpl 2.1",
]
unauthorized_licenses = [
    "gpl v3",
]
# strategy_ini_file = "./liccheck.ini"
# level = "STANDARD"
# requirement_txt_file = "./requirements.txt" # ignored if dependencies or optional_dependencies are defined
# reporting_txt_file = "path/to/reporting.txt file" # by default is None
# no_deps = false
dependencies = true # to load [project.dependencies]
optional_dependencies = ["test"] # to load extras from [project.optional-dependencies]

[tool.liccheck.authorized_packages]
uuid = "1.30"By default, exact matching is required between each package’s license and one of the license of the authorized or unauthorized list.
You can also provide regular expressions to match licenses by using theas_regexboolean flag. For instance, to exclude GPL licenses,
one could define the following configuration inpyproject.toml:...

unauthorized_licenses = [
    '\bgpl'
]
as_regex = trueUsing liccheck with pre-commitAdd this to your .pre-commit-config.yaml:- repo: https://github.com/dhatim/python-license-check
  rev: master
  hooks:
  - id: liccheck
    language: systemContributingTo run the tests:$ tox -p allLicensingSeeLICENSE