Open source license compliance: SPDX expressions, obligations and SBOM checks

Start from the artifact. The licenses that bind you are those of the components in what you distribute or run, which a build-time SBOM records, plus code that was copied into your repository without a package manager. A manifest misses vendored code, bundled assets and the base image; /domains/supply-chain/sbom/generate-release-inventory/ covers producing an SBOM that matches the release.

Each component can carry three kinds of license information. The declared license is what the author's package metadata claims. The concluded license is what someone determined after examining the files, which can differ when a package bundles code under other licenses or ships a license file that contradicts its metadata. Observed licenses are the evidence a scanner such as ScanCode Toolkit found in the files. CycloneDX 1.6 and later mark each license entry as declared or concluded with acknowledgement; SPDX documents have separate declared and concluded fields. A value of NOASSERTION, or no license at all, means nobody has established the terms, and code with no license grants no rights to copy or distribute it.

The SPDX License List, version 3.29.0 on 2026-09-16, gives each license and exception a short identifier. A license expression combines them. OR means the licensee may choose one of the options, AND means all apply at once, WITH attaches an exception that grants extra permissions, and a + suffix means that version or any later one. WITH binds tighter than AND, which binds tighter than OR, and parentheses override that order. License identifiers match case-insensitively, but the operators are case-sensitive: write them in upper case (all lower case is also accepted).

Some identifiers are deprecated because they were ambiguous. GPL-2.0 did not say whether later versions were allowed, so current lists use GPL-2.0-only and GPL-2.0-or-later; the same applies to the LGPL, AGPL and GFDL families. Licenses that are not on the list are written as LicenseRef- followed by your own name, with the license text included in the SBOM; treat them as needing review.

Obligations attach to an action, usually distribution: giving a copy of the software, as a download, an app, an installer, a container image you hand to customers or firmware on a device. Running software internally or as a hosted service is usually not distribution, which is why the network clause in AGPL-3.0 matters. The table summarizes the main conditions; read the license text for the exact wording, and ask counsel about anything that affects a product decision.

A license that is fine for an internal tool can be a problem in firmware you sell, so write the policy per distribution model and let each product declare its model. Use three outcomes: allow without review, review by someone who owns licensing decisions, and deny unless legal approves an exception. Put unknown, NOASSERTION and LicenseRef- values in review, and give every exception an owner and a scope.

Recheck licenses on upgrade, not only on first use, because projects change licenses in new versions. HashiCorp moved future releases of Terraform and its other products from MPL-2.0 to BUSL-1.1 on 2023-08-10, and the OpenTofu fork continued from the last MPL release. Redis moved to a choice of its source-available license and SSPL in March 2024 and added AGPL-3.0 as a further option with Redis 8 on 2025-05-01. Elastic relicensed Elasticsearch from Apache-2.0 to SSPL and the Elastic License in 2021 and added AGPL-3.0 on 2024-08-29. An update bot that bumps such a dependency without a license check changes your obligations in a routine pull request.

Gate releases on the SBOM of the release, because that is the list your notices and your customers' tools will use. The script below reads a CycloneDX JSON SBOM, evaluates each component's license entries as an SPDX expression (a choice under OR takes the best option, AND takes the worst, and a WITH exception needs its own policy entry), and reports everything that is not allowed. It exits non-zero on any denied license, so it can fail a release job. Several license entries on one component are treated as all applying, the conservative reading, because CycloneDX does not define how they combine.

Trivy can do a similar check from lockfiles or images with --scanners license, sorting licenses into forbidden, restricted, reciprocal, notice, permissive and unencumbered categories that you can edit in trivy.yaml. For deeper analysis of source files, ScanCode Toolkit and the OSS Review Toolkit detect license texts that metadata does not declare.

"""Check the licenses in a CycloneDX JSON SBOM against an allow/review/deny policy.

Usage: python3 license_gate.py sbom.cdx.json   (exit 1 if anything is denied)
"""
import json
import re
import sys

# Example policy for software distributed to customers as a binary; adjust per product.
ALLOW = {"MIT", "BSD-2-Clause", "BSD-3-Clause", "Apache-2.0", "ISC", "0BSD", "Zlib", "Unlicense"}
REVIEW = {"MPL-2.0", "LGPL-2.1-only", "LGPL-2.1-or-later", "LGPL-3.0-only", "LGPL-3.0-or-later", "EPL-2.0",
          "GPL-2.0-only WITH Classpath-exception-2.0"}
DENY = {"GPL-2.0-only", "GPL-2.0-or-later", "GPL-3.0-only", "GPL-3.0-or-later",
        "AGPL-3.0-only", "AGPL-3.0-or-later", "SSPL-1.0", "BUSL-1.1", "Elastic-2.0"}
RANK = {"allow": 0, "review": 1, "deny": 2}


def classify_id(license_id):
    """Outcome for one SPDX identifier; anything unknown, LicenseRef or NOASSERTION is review."""
    upper = license_id.upper()
    for outcome, ids in (("allow", ALLOW), ("review", REVIEW), ("deny", DENY)):
        if upper in {i.upper() for i in ids}:  # SPDX identifiers are case-insensitive
            return outcome
    return "review"


def evaluate(tokens):
    """SPDX expression: WITH binds tightest, then AND, then OR (a choice: take the best)."""
    def term():
        token = tokens.pop(0)
        if token == "(":
            outcome = disjunction()
            tokens.pop(0)  # ")"
            return outcome
        if tokens and tokens[0].upper() == "WITH":
            tokens.pop(0)
            # An exception adds permissions, so the pair needs its own policy entry.
            return classify_id(f"{token} WITH {tokens.pop(0)}")
        return classify_id(token)

    def conjunction():
        outcome = term()
        while tokens and tokens[0].upper() == "AND":
            tokens.pop(0)
            outcome = max(outcome, term(), key=RANK.get)
        return outcome

    def disjunction():
        outcome = conjunction()
        while tokens and tokens[0].upper() == "OR":
            tokens.pop(0)
            outcome = min(outcome, conjunction(), key=RANK.get)
        return outcome

    return disjunction()


def component_outcome(component):
    choices = component.get("licenses") or []
    if not choices:
        return "review", "no license data"
    expressions = []
    for choice in choices:
        if "expression" in choice:
            expressions.append(choice["expression"])
        elif "id" in choice.get("license", {}):
            expressions.append(choice["license"]["id"])
        else:  # a named, non-SPDX license
            return "review", "named license: " + choice.get("license", {}).get("name", "?")
    # CycloneDX does not define how several entries combine; AND is the conservative reading.
    expression = " AND ".join(f"({e})" for e in expressions)
    return evaluate(re.findall(r"\(|\)|[^\s()]+", expression)), expression


with open(sys.argv[1], encoding="utf-8") as f:
    bom = json.load(f)
worst = "allow"
for component in bom.get("components", []):
    outcome, detail = component_outcome(component)
    worst = max(worst, outcome, key=RANK.get)
    if outcome != "allow":
        print(f"{outcome.upper():7} {component.get('purl') or component.get('name')}  {detail}")
sys.exit(1 if worst == "deny" else 0)

Checking at release time finds problems late. GitHub's dependency review action compares the dependency graph of a pull request with its base and fails when a new dependency's license is not on the allow-list. Use allow-licenses rather than deny-licenses, which the action has deprecated: an allow-list also stops licenses nobody has reviewed yet. The commands after the workflow run the same kind of check outside GitHub.

# .github/workflows/dependency-review.yml
name: dependency-review
on: pull_request
permissions:
  contents: read
jobs:
  licenses:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
        with:
          # An allow-list fails the PR on any license not listed, including unknown ones
          allow-licenses: MIT, BSD-2-Clause, BSD-3-Clause, Apache-2.0, ISC, 0BSD

Generate the SBOM with the same tool and options you use for the release, so the license gate and the published SBOM agree. /domains/supply-chain/sbom/formats-and-identifiers/ explains the CycloneDX and SPDX fields these commands read.

# Generate the SBOM from what you ship, then gate on it
syft dir:. -o cyclonedx-json=sbom.cdx.json
python3 license_gate.py sbom.cdx.json

# Or let Trivy classify licenses and fail on forbidden (CRITICAL) and restricted (HIGH)
trivy fs --scanners license --severity CRITICAL,HIGH --exit-code 1 .

# Rust: cargo-deny reads the [licenses] section of deny.toml
cargo deny check licenses

• A third-party notices file generated from the release SBOM, with each component's name, version, copyright lines and full license text, shipped inside the product or its documentation.
• The contents of every Apache-2.0 NOTICE file you distribute, carried into your notices.
• For GPL and LGPL components in distributed products, the corresponding source, or a written offer to provide it, for the exact versions you shipped; keep the source archived per release.
• For AGPL components you modified and run as a service, a way for users to get the source of the running version.
• For your own repositories, REUSE 3.3 headers (SPDX-License-Identifier, SPDX-FileCopyrightText) and license texts under LICENSES/, so your customers' tools can read your licensing.
• A record of each review decision and exception; OpenChain ISO/IEC 5230 describes the program around these artifacts if you need to show a process to customers.

Sources & further reading

The standards, specifications and documentation behind the guidance above. Each is the evidence for a claim on this page; consult it for detail beyond the defaults and versions listed here.

1. SPDX specification 3.0.1: SPDX License Expressions annex
2. SPDX License List. Version 3.29.0 (16 September 2026).
3. spdx/license-list-data release v3.29.0. 16 September 2026.
4. CycloneDX 1.7 JSON reference: licenses
5. Open Source Initiative: The SSPL is not an open source license. 19 January 2021.
6. Trivy: license scanning
7. actions/dependency-review-action: README
8. REUSE Specification 3.3
9. HashiCorp adopts the Business Source License (2023-08-10)
10. Redis is now available under the AGPLv3 open source license (2025-05-01)
11. Elastic: Elasticsearch is open source, again (2024-08-29)
12. GNU Affero General Public License v3.0, section 13. Version 3, 19 November 2007.

Reference information

Tags

SBOMCompliance and assurance evidenceSupplier and open source risk

SDLC phase

DevelopmentReleaseSecurity program

Role

AppSec engineersSecurity leaders

Download this guide as Markdown

Continue exploring