license-audit 0.5.0

Analyze dependency licenses for Python projects, with compatibility checks and outbound license recommendations

license-audit

Analyze dependency licenses for Python projects.

license-audit tells you what license your project can use, flags incompatible combinations, and generates compliance documents suitable for CI gating.

Features

• License detection across the full transitive tree, from PEP 639 metadata, the legacy License field, trove classifiers, and user overrides.
• Pairwise compatibility checking against the OSADL compatibility matrix (~120 licenses).
• Outbound license recommendations ranked by permissiveness.
• Compliance reports as Markdown, JSON, or third-party-notices.
• CI exit codes that distinguish policy violations from undetected licenses.
• Reads uv.lock, poetry.lock, pixi.lock, pyproject.toml, requirements.txt, and live virtualenvs.

Installation

pip install license-audit

Or with uv:

uv add license-audit --dev

Quickstart

Run against the current project directory:

license-audit --target . analyze

License Analysis: my-project

Dependency Licenses
  Package   Version  License        Category    Source  Parent
  click     8.1.7    BSD-3-Clause   permissive  pep639  (direct)
  pydantic  2.9.2    MIT            permissive  pep639  (direct)
  rich      13.9.4   MIT            permissive  pep639  (direct)

Recommended Outbound Licenses (most -> least permissive):
  -> MIT
     BSD-3-Clause
     Apache-2.0
     ...

Summary
  Total dependencies: 3
  Policy check:       PASSED

CI quickstart

Add to your pipeline to gate on license policy:

jobs:
  license-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v5
      - run: uv sync --locked
      - run: uv run license-audit check

Exit codes:

Code	Meaning
0	All dependencies pass the policy
1	Policy violation (incompatible pairs or denied licenses)
2	Unknown licenses detected (when fail-on-unknown = true)

For GitLab, pre-commit, handling unknowns, and the new-dependency workflow, see the CI integration guide.

Configuration

[tool.license-audit]
fail-on-unknown = true
policy = "permissive"  # permissive | weak-copyleft | strong-copyleft | network-copyleft
allowed-licenses = ["MIT", "Apache-2.0", "BSD-3-Clause"]
denied-licenses = ["GPL-3.0-only"]

[tool.license-audit.overrides]
some-internal-package = "MIT"
dual-licensed-pkg = "Apache-2.0 OR MIT"

[tool.license-audit.ignored-packages]
pandas-stubs = "Stubs only, not redistributed"

Full reference: user guide -> configuration.

Documentation

Full documentation lives at https://dgeragh.github.io/license-audit:

• Configuration reference
• CI integration guide
• How it works
• Comparison with other tools
• Limitations

License

MIT. See LICENSE.

This project bundles data from the OSADL Open Source License Obligations Checklists project, licensed under CC-BY-4.0. See THIRD_PARTY_NOTICES.md for full attribution.