<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Analyzing Open-Source License Compliance — API Reference

## SPDX License Identifiers

### Permissive Licenses

| SPDX ID | Name | Obligations |
|---------|------|-------------|
| MIT | MIT License | Attribution |
| Apache-2.0 | Apache License 2.0 | Attribution + patent grant |
| BSD-2-Clause | BSD 2-Clause | Attribution |
| BSD-3-Clause | BSD 3-Clause | Attribution + no endorsement |
| ISC | ISC License | Attribution |
| 0BSD | Zero-Clause BSD | None |
| Unlicense | The Unlicense | None |

### Copyleft Licenses

| SPDX ID | Strength | Obligation |
|---------|----------|------------|
| GPL-2.0-only | Strong | Full source disclosure |
| GPL-3.0-only | Strong | Full source + patent grant |
| AGPL-3.0-only | Strong | Network use = distribution |
| LGPL-3.0-only | Weak | Modified files only |
| MPL-2.0 | Weak | Modified files only |
| EPL-2.0 | Weak | Modified files only |

## Syft License Detection

```bash
# Generate SBOM with license info
syft packages dir:. -o cyclonedx-json > sbom.cdx.json

# Extract licenses via jq
jq '.components[] | {name, licenses: [.licenses[]?.license?.id]}' sbom.cdx.json
```

## ScanCode Toolkit

```bash
# Full license + copyright scan
scancode --license --copyright --package \
  --json-pp report.json /path/to/project

# Classify licenses
scancode --license --classify --json report.json /path/to/project

# Extract copyleft findings
jq '.files[] | select(.licenses[].category == "Copyleft")' report.json
```

## FOSSology

```bash
# Run FOSSology agent
docker run -p 8081:80 fossology/fossology
# Upload source via web UI → agents detect licenses automatically
```

## License Compatibility Quick Reference

```
MIT → Apache-2.0    ✓
MIT → GPL-3.0       ✓ (output is GPL-3.0)
Apache-2.0 → GPL-3.0 ✓ (output is GPL-3.0)
Apache-2.0 → GPL-2.0 ✗ INCOMPATIBLE
GPL-2.0 → GPL-3.0   ✗ INCOMPATIBLE (unless "or later")
LGPL-3.0 → GPL-3.0  ✓
MIT → AGPL-3.0      ✓ (output is AGPL-3.0)
```

## CI/CD License Gate

```yaml
# GitHub Actions — fail on copyleft
- name: License check
  run: |
    node scripts/agent.js --action copyleft --sbom sbom.cdx.json --output /tmp/copyleft.json
    if jq -e '.copyleft_analysis.strong_count > 0' /tmp/copyleft.json; then
      echo "::error::Strong copyleft dependency detected"
      exit 1
    fi
```
