# I need to do a license compliance check on my dependencies

**URL:** <https://discourse.julialang.org/t/i-need-to-do-a-license-compliance-check-on-my-dependencies/50460>\
**Category:** General Usage\
**Tags:** package\
**Created:** [November 19, 2020, 8:22pm UTC](https://discourse.julialang.org/t/i-need-to-do-a-license-compliance-check-on-my-dependencies/50460 "2020-11-19T20:22:26Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Allan\_Baker](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/allan_baker/32/42645_2.png) [@Allan\_Baker](https://discourse.julialang.org/u/Allan_Baker)\
**Post date:** [November 19, 2020, 8:22pm UTC](https://discourse.julialang.org/t/i-need-to-do-a-license-compliance-check-on-my-dependencies/50460/1 "2020-11-19T20:22:26Z")

</div>

I’m struggling with the Pkg API. I want to generate a list of all julia packages and I guess artifact software that may have been installed and obtain the name, version, git URL, and license name.

Is there an easy way to do this or do I need to write some custom readers to find the directories and license files, etc.

It seems like there were some old ways to do this with METADATA, but it looks depreciated. How do I do this now?

Best Regards,  
Allan Baker

---

<div class="post-metadata">

**Author:** ![rdeits](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/rdeits/32/286_2.png) [@rdeits](https://discourse.julialang.org/u/rdeits)\
**Post date:** [November 19, 2020, 9:00pm UTC](https://discourse.julialang.org/t/i-need-to-do-a-license-compliance-check-on-my-dependencies/50460/2 "2020-11-19T21:00:04Z")

</div>

The `Manifest.toml` file contains a complete list of every dependency (including all transitive dependencies) for the current package environment. To check all of the dependencies for a single package, you could:

- Create a new folder and `cd` to it
- Use `pkg> activate .` to activate a new environment in that folder
- Use `pkg> add YourPackageName` to add your target package to that environment.

You should now have a `Project.toml` in the folder listing just your package and a `Manifest.toml` listing your package and all of its transitive dependencies.

---

<div class="post-metadata">

**Author:** ![Allan\_Baker](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/allan_baker/32/42645_2.png) [@Allan\_Baker](https://discourse.julialang.org/u/Allan_Baker)\
**Post date:** [November 19, 2020, 10:46pm UTC](https://discourse.julialang.org/t/i-need-to-do-a-license-compliance-check-on-my-dependencies/50460/3 "2020-11-19T22:46:43Z")

</div>

But how do I query the registry to lookup the git location and get the license type?

---

<div class="post-metadata">

**Author:** ![Allan\_Baker](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/allan_baker/32/42645_2.png) [@Allan\_Baker](https://discourse.julialang.org/u/Allan_Baker)\
**Post date:** [November 23, 2020, 2:10pm UTC](https://discourse.julialang.org/t/i-need-to-do-a-license-compliance-check-on-my-dependencies/50460/4 "2020-11-23T14:10:03Z")

</div>

It seems like there should be a dictionary or command that lets me query the registry to get the license name and the git repository location in one fail swoop. I can’t find that.

---

<div class="post-metadata">

**Author:** ![awasserman](https://avatars.discourse-cdn.com/v4/letter/a/9de0a6/32.png) [@awasserman](https://discourse.julialang.org/u/awasserman)\
**Post date:** [December 17, 2021, 9:37pm UTC](https://discourse.julialang.org/t/i-need-to-do-a-license-compliance-check-on-my-dependencies/50460/5 "2021-12-17T21:37:01Z")

</div>

I found this topic by search for dependency licenses and julia. In case anyone finds this again, I found the following packages to be useful:

[https://knbrt.gitlab.io/LicenseGrabber.jl/](https://knbrt.gitlab.io/LicenseGrabber.jl/)

[https://docs.juliahub.com/LicenseCheck](https://docs.juliahub.com/LicenseCheck)

Here’s an example to generate a data frame of licenses found from all dependencies.

```julia
using DataFrames
using DataFramesMeta
using CSV
using LicenseGrabber
using LicenseCheck

using Pkg
Pkg.activate("/path/to/project")

license_locations = LicenseGrabber.getlicloc()
license_checks = Dict(
    pkg => filter(nt -> nt.license_file_percent_covered > 0, map(f -> licensecheck(read(f, String)), fs))
    for (pkg, fs) in license_locations
        )
license_approvals = Dict(pkg => all(map(nt -> (length(nt.licenses_found)) > 0 && is_osi_approved(nt), nts)) for (pkg, nts) in license_checks)
packages = collect(keys(license_locations))
licenses = [map(nt -> nt.licenses_found, license_checks[p]) for p in packages]
coverages = [map(nt -> nt.license_file_percent_covered, license_checks[p]) for p in packages]
df = @chain DataFrame(package = packages, license = licenses, coverage = coverages) begin
    flatten([:license, :coverage])
    flatten(:license)
end

```

Note that there may be multiple text files found per package, and multiple licenses found per text file.

---

<div class="post-metadata">

**Author:** ![Allan\_Baker](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/allan_baker/32/42645_2.png) [@Allan\_Baker](https://discourse.julialang.org/u/Allan_Baker)\
**Post date:** [January 11, 2022, 3:30am UTC](https://discourse.julialang.org/t/i-need-to-do-a-license-compliance-check-on-my-dependencies/50460/6 "2022-01-11T03:30:44Z")

</div>

How does this handle external python or other libraries that may be brought in during the build process? Does it catch them all? Can this be done without installing first? Can a license be checked before it is downloaded?