westonsteimel/go-bouncer

Reports on the licenses used by a Go package and its dependencies.

bouncer

A go dependency license checker.

This is thin a wrapper around google's license classifier forked from go-license with a few extra options.

Installation

# install the latest version to ./bin
curl -sSfL https://raw.githubusercontent.com/wagoodman/go-bouncer/master/bouncer.sh | sh 

# install a specific version to another directory
curl -sSfL https://raw.githubusercontent.com/wagoodman/go-bouncer/master/bouncer.sh | sh -s -- -b ./path/to/bin v1.26.0

Usage

# list the licenses of all of your dependencies...
bouncer list                        # ... from ./go.mod
bouncer list ~/some/path            # ... from ~/some/path/go.mod
bouncer list github.com/some/repo   # ... from a remote repo

# pass/fail of user-specified license restrictions (by .bouncer.yaml)
bouncer check
bouncer check ~/some/path
bouncer check github.com/some/repo

The .bouncer.yaml can specify a simple allow-list or deny-list license name regex patterns (by SPDX name):

permit:
  - BSD.*
  - MIT.*
  - Apache.*
  - MPL.*

forbid:
  - GPL.*

ignore-packages:
  - github.com/some/repo
forbid:
  - GPL.*

Note: either allow or deny lists can be specified, not both.