Skip to content

GitLab Next

Closed
Created by Joshua Lambert@joshlambertMaintainer0 of 8 tasks completed0/8 tasks

License Management

Description

A common need for organizations is understand the licenses of the libraries and components they are using.

Building or incorporating software which has been released with an incompatible license can open a company to legal exposure, as well as result in significant re-engineering work or even features being pulled.

We should add these features into GitLab, either by internally building or leveraging existing open source solutions.

Proposal

  • Check all your open source dependencies against a license whitelist and notify you about violations.
  • Support package managers, like NPM, Bundler, Composer, PIP.

Note: the first iteration is based on the licence_finder gem we already use at GitLab. This will cover the following languages right out of the box: Ruby, Python, Node.js, Java, "everything covered by Bower" (JS/CSS to some extent), Swift, Objective-C, Erlang, go. To cover other languages, we will need to iterate on this feature.

  • This feature is activated by default on all projects (for Ultimate/Gold subscribers).
  • Per project, you can deactivate the feature, and also define a list of licenses your dependencies can not use. List of licenses can be found here.
  • By default a list of unacceptable copyleft licenses is loaded (https://gitlab.com/snippets/1548385)
  • On every commit in a MR, we run the license_finder gem to automatically find external dependencies license information of the project. We will support all the package managers already supported by this gem.
  • If a violation occurs, MR is blocked and user has to take action to change their License policy. we show a message These libraries failed licenses: middleman (MIT), ...
  • If no violation occurs, we display a message All licenses passed
  • If the merge is attempted through CLI and we detect a license violates our list, we display a message through git informing that the merge can’t happen.
  • This feature is only available to instances which are EE Premium
Settings License Finder failed License Finder passed
license-finder--setting license-finder--licenses-tab-failed license-finder--licenses-tab-passed

Links

There are some vendors who provider this today, such as:

Many of them offer integration into CI and repository tools, including GitLab, as well.

Edited by Mark Pundsack