<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-open-source-license-compliance
description: >-
  Analyze open-source license compliance across project dependencies. Detect
  copyleft license contamination, license conflicts, and missing attributions.
  Generate license reports for legal review and ensure SBOM license data accuracy.
domain: cybersecurity
subdomain: supply-chain-security
tags:
  - license-compliance
  - open-source
  - copyleft
  - gpl
  - sbom
  - attribution
  - legal-risk
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Analyzing Open-Source License Compliance

## Overview

Open-source license non-compliance creates legal risk — copyleft licenses (GPL,
AGPL) require derivative work disclosure, incompatible licenses cannot be combined,
and missing attributions violate license terms. This skill covers automated license
detection, copyleft contamination analysis, license conflict identification, and
attribution report generation for legal review.

Mode: `[MODE: ARCHITECT]` — License policy design; `[MODE: BLUE]` — Compliance auditing.

## Prerequisites

| Requirement | Details |
|---|---|
| Syft for license detection in SBOMs | Required |
| licensee or scancode-toolkit for detailed analysis | Required |
| FOSSology for comprehensive scanning (optional) | Required |
| Python 3.10+ | Required |
| jq for JSON processing | Required |

## Key Concepts

### License Detection from SBOM

```bash
# Extract licenses from CycloneDX SBOM
jq '.components[] | {name, version, licenses: [.licenses[]?.license?.id // .licenses[]?.expression // "UNKNOWN"]}' sbom.cdx.json

# Count licenses by type
jq '[.components[].licenses[]?.license?.id // "UNKNOWN"] | group_by(.) | map({license: .[0], count: length}) | sort_by(-.count)' sbom.cdx.json

# Find components with no license info
jq '.components[] | select(.licenses == null or (.licenses | length) == 0) | {name, version}' sbom.cdx.json
```

### Copyleft Detection

```bash
# Find copyleft-licensed dependencies
jq '.components[] | select(
  .licenses[]?.license?.id |
  test("GPL|AGPL|LGPL|MPL|EUPL|OSL|CPAL|CPL|EPL|CDDL"; "i")
) | {name, version, license: .licenses[0].license.id}' sbom.cdx.json

# Strong copyleft (requires full source disclosure)
# GPL-2.0, GPL-3.0, AGPL-3.0, EUPL-1.2, OSL-3.0

# Weak copyleft (only modified files)
# LGPL-2.1, LGPL-3.0, MPL-2.0, EPL-2.0
```

### License Compatibility Matrix

```
Permissive → Permissive: ✓ Always compatible
  MIT, BSD-2-Clause, BSD-3-Clause, Apache-2.0, ISC

Permissive → Weak Copyleft: ✓ Compatible
  MIT → LGPL-3.0, MIT → MPL-2.0

Permissive → Strong Copyleft: ✓ Compatible (output becomes copyleft)
  MIT → GPL-3.0 (entire work becomes GPL-3.0)

Apache-2.0 → GPL-2.0-only: ✗ INCOMPATIBLE
Apache-2.0 → GPL-3.0: ✓ Compatible

GPL-2.0-only → GPL-3.0-only: ✗ INCOMPATIBLE
GPL-2.0-or-later → GPL-3.0: ✓ Compatible
```

### Scancode Toolkit

```bash
# Full license scan of directory
scancode --license --copyright --package --classify \
  --json-pp license-report.json /path/to/project

# Quick scan
scancode --license --json license-quick.json /path/to/project

# Extract findings
jq '.files[] | select(.licenses | length > 0) | {path, licenses: [.licenses[].spdx_license_key]}' license-report.json
```

## Workflow

### Step 1: Scan Dependencies for Licenses

```bash
node scripts/agent.js --action scan --sbom /tmp/sbom.cdx.json --output /tmp/license-report.json
```

### Step 2: Check for Copyleft Contamination

```bash
node scripts/agent.js --action copyleft --sbom /tmp/sbom.cdx.json --output /tmp/copyleft.json
```

### Step 3: Generate Attribution Report

```bash
node scripts/agent.js --action attribution --sbom /tmp/sbom.cdx.json --output /tmp/ATTRIBUTION.json
```

## Verification

- [ ] All dependencies have identified licenses
- [ ] No copyleft contamination in proprietary products
- [ ] License conflicts identified and resolved
- [ ] Attribution file generated and included in distribution
- [ ] License policy documented and enforced in CI
- [ ] SBOM includes accurate license data for all components

## References

- [SPDX License List](https://spdx.org/licenses/)
- [ScanCode Toolkit](https://github.com/nexB/scancode-toolkit)
- [FOSSology](https://www.fossology.org/)
- [OpenChain ISO 5230](https://www.openchainproject.org/license-compliance)
- [choosealicense.com](https://choosealicense.com/)
