License compliance

license-complianceDeterministic

The project declares a licence and no bundled dependency is under a strong copyleft licence (GPL, AGPL, SSPL).

v1.0.3 · current

Version 1.0.3

Implementation sha256 Published

Verifies: The project declares a licence and no runtime dependency is under a strong copyleft licence (GPL, AGPL, SSPL, EUPL, CC-BY-SA, OSL, CPAL) once its SPDX expression is evaluated as the consumer's choice.
Inputs: Root package.json and npm lockfiles (v2/v3) with their license fields (string, array or { type }). Paths listed in excludes (test, spec and tmp files, __tests__, __mocks__, fixtures, test, tests and audit-scripts folders) are never analysed.
Decision rule: Each licence string is parsed as an SPDX expression: with OR, the package is accepted when at least one alternative is not strong copyleft (a dual licence such as (MIT OR GPL-3.0-or-later) is used under MIT); with AND, every operand must be acceptable; parentheses nest; WITH keeps the licence it qualifies. FAIL when a non-dev dependency forces a strong copyleft licence. An empty, UNKNOWN, UNLICENSED, SEE LICENSE IN or unparseable value is a medium unknown-license finding; a missing project licence is a medium finding; neither blocks.
Type: deterministic

1.0.3: never analyses temporary files (*.tmp.*; spec.excludes follows AUDITOR_ANALYSIS_EXCLUDES). (1.0.2: never analyses test, spec, fixture and mock paths nor the auditor's own scripts (spec.excludes = AUDITOR_ANALYSIS_EXCLUDES); a fixture-looking secret (sk_test_, example, dummy) in real code is LOW, informative. (1.0.1 parses SPDX expressions: OR accepts a permissive alternative, AND requires every operand, parentheses nest, WITH keeps the licence; empty or UNKNOWN values are unknown-license.))

// SPDX tree: OR -> every alternative copyleft; AND -> any operand copyleft; WITH keeps the licence

function forcesStrongCopyleft(node) { if (node.op === 'OR') return node.operands.every(forcesStrongCopyleft); if (node.op === 'AND') return node.operands.some(forcesStrongCopyleft); return STRONG_COPYLEFT.test(node.id); }

// (MIT OR GPL-3.0-or-later) -> accepted; GPL-3.0-only -> FAIL; (MIT AND GPL-2.0) -> FAIL; UNKNOWN or empty -> unknown-license

The full script is disclosed on request in a read-only viewer (never published on GitHub); the attestation binds to this exact hash.