---
name: licensing
source: botcore
description: >
  OSS license compliance and dependency auditing.
  Use when reviewing dependencies, ensuring license compatibility, or preparing for release.
version: "1.0.0"
triggers:
  - licensing
  - license
  - OSS
  - compliance
  - SBOM
  - GPL
  - MIT
  - Apache
---

# Licensing

Best practices for open source license compliance and dependency management.

## When to Use

- Adding new dependencies
- Preparing for release/distribution
- Auditing existing dependencies
- Generating SBOM (Software Bill of Materials)
- Reviewing license compatibility

## License Categories

| Category | Examples | Commercial Use |
|----------|----------|----------------|
| **Permissive** | MIT, Apache-2.0, BSD | ✅ Yes |
| **Weak Copyleft** | LGPL, MPL | ⚠️ Careful |
| **Strong Copyleft** | GPL, AGPL | ❌ Risky |
| **Public Domain** | Unlicense, CC0 | ✅ Yes |

## Common Licenses

| License | Requirements | Compatibility |
|---------|--------------|---------------|
| **MIT** | Attribution | ✅ Most permissive |
| **Apache-2.0** | Attribution + patent grant | ✅ Permissive |
| **BSD-3** | Attribution, no endorsement | ✅ Permissive |
| **LGPL** | Link dynamically, share modifications | ⚠️ Library only |
| **GPL** | Share all derivative work | ❌ Viral |
| **AGPL** | GPL + network use triggers | ❌ Very viral |

## Audit Commands

```bash
# Node.js
npx license-checker --summary
npx license-checker --onlyAllow "MIT;Apache-2.0;BSD-3-Clause"

# Python
pip-licenses --format=markdown
pip-licenses --fail-on="GPL"

# Go
go-licenses report ./...
```

## License Compatibility Matrix

When combining libraries:

| Your Project | Can Use |
|--------------|---------|
| MIT | MIT, BSD, Apache, LGPL (link), Public Domain |
| Apache-2.0 | MIT, BSD, Apache, Public Domain |
| GPL | Anything (but output is GPL) |
| Proprietary | MIT, BSD, Apache, LGPL (link), Public Domain |

## SBOM Generation

```bash
# CycloneDX (Node.js)
npx @cyclonedx/cyclonedx-npm --output-file sbom.json

# SPDX (Python)
pip install spdx-tools
# Then generate programmatically

# Syft (universal)
syft . -o spdx-json > sbom.spdx.json
```

## Required Files

| File | Purpose |
|------|---------|
| `LICENSE` | Your project's license |
| `NOTICE` | Third-party attributions (Apache requires) |
| `THIRD-PARTY-LICENSES` | Detailed dependency licenses |

## CI Integration

```yaml
# GitHub Actions
- name: License Check
  run: npx license-checker --onlyAllow "MIT;Apache-2.0;BSD-3-Clause;ISC"
  
- name: Generate SBOM
  run: npx @cyclonedx/cyclonedx-npm --output-file sbom.json
  
- name: Upload SBOM
  uses: actions/upload-artifact@v4
  with:
    name: sbom
    path: sbom.json
```

## Red Flags

| Issue | Risk | Action |
|-------|------|--------|
| GPL in proprietary app | Legal | Remove or replace |
| AGPL in SaaS | Legal | Remove or open source |
| No license file | Unknown | Contact author |
| `UNLICENSED` | Proprietary | Cannot use |
| License mismatch | Confusion | Verify source |

## Anti-Patterns

| Avoid | Instead |
|-------|---------|
| Ignoring license files | Audit regularly |
| Copy-pasting code without license | Include attribution |
| Using GPL without understanding | Check compatibility |
| No SBOM for releases | Generate and publish |

## Checklist

- [ ] All dependencies have known licenses
- [ ] No GPL/AGPL in proprietary code
- [ ] LICENSE file in repo root
- [ ] NOTICE file if using Apache deps
- [ ] SBOM generated for releases
- [ ] License check in CI pipeline
- [ ] Third-party attributions documented
