A common need for organizations is understand the licenses of the libraries and components they are using.
Building or incorporating software which has been released with an incompatible license can open a company to legal exposure, as well as result in significant re-engineering work or even features being pulled.
We should add these features into GitLab, either by internally building or leveraging existing open source solutions.
- Check all your open source dependencies against a license whitelist and notify you about violations.
- Support package managers, like NPM, Bundler, Composer, PIP.
Note: the first iteration is based on the licence_finder gem we already use at GitLab. This will cover the following languages right out of the box: Ruby, Python, Node.js, Java, "everything covered by Bower" (JS/CSS to some extent), Swift, Objective-C, Erlang, go. To cover other languages, we will need to iterate on this feature.
- This feature is activated by default on all projects (for Ultimate/Gold subscribers).
- Per project, you can deactivate the feature, and also define a list of licenses your dependencies can not use. List of licenses can be found here.
- By default a list of unacceptable copyleft licenses is loaded (https://gitlab.com/snippets/1548385)
On every commit in a MR, we run the
license_findergem to automatically find external dependencies license information of the project. We will support all the package managers already supported by this gem.
If a violation occurs, MR is blocked and user has to take action to change their License policy. we show a message
These libraries failed licenses: middleman (MIT), ...
If no violation occurs, we display a message
All licenses passed
- If the merge is attempted through CLI and we detect a license violates our list, we display a message through git informing that the merge can’t happen.
- This feature is only available to instances which are EE Premium
|Settings||License Finder failed||License Finder passed|
There are some vendors who provider this today, such as:
- LicenseFinder Gem
- Black Duck
- fossology by Linux Foundation
- WhiteSource Software
- and plenty more.
Many of them offer integration into CI and repository tools, including GitLab, as well.
- VersionEye initial issue: https://gitlab.com/gitlab-org/gitlab-ee/issues/744
- GitLab Licensing Doc: https://docs.gitlab.com/ee/development/licensing.html