liccheck

library0.9.2pypypiunverified

liccheck is a Python library and command-line tool that checks package licenses listed in a requirements.txt file or pyproject.toml and their dependencies against a user-defined strategy. This strategy includes lists of authorized and unauthorized licenses, as well as explicitly authorized packages. The current version is 0.9.2, with a fairly active release cadence addressing features like Poetry support and improved license parsing.

testing devops

pip install liccheck

github ↗package ↗

INSTALL

IMPORT

SIG · LICCHECK

liccheck

testingpythonv0.9.2

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

This quickstart demonstrates how to use `liccheck` as a command-line tool. It creates a mock `requirements.txt` and `liccheck.ini` strategy file, then executes `liccheck` to verify licenses. For a real-world scenario, ensure the packages listed in `requirements.txt` are actually installed in the same Python environment where `liccheck` is run.

import os # Create dummy requirements.txt with open('requirements.txt', 'w') as f: f.write('Flask\nrequests==2.31.0\n') # Create dummy liccheck.ini for configuration # Authorized and unauthorized licenses in LOWER CASE with open('liccheck.ini', 'w') as f: f.write(''[Licenses]\n'') f.write(''authorized_licenses: mit, bsd new, apache 2.0, python software foundation license, isc license (iscl)\n'') f.write(''unauthorized_licenses: gpl v3, agpl\n\n'') f.write(''[Authorized Packages]\n'') f.write(''; Example: Specify exact version or range using PEP-0440\n'') f.write(''requests: >=2.31.0,<3.0.0\n'') print("Running liccheck. This assumes 'Flask' and 'requests' are installed in the current environment.") print("To run this properly, ensure `pip install Flask requests liccheck` is executed first.") print("--- Output from liccheck ---") # Use os.system for demonstration as it's primarily a CLI tool os.system('liccheck --strategy-ini-file liccheck.ini --requirement-txt-file requirements.txt') print("---------------------------") # Clean up dummy files os.remove('requirements.txt') os.remove('liccheck.ini')

liccheck --version

Debug

Known issues

breakingStarting with version 0.9.2, `liccheck` officially dropped support for Python 2. Projects still using Python 2 will need to use an older version (pre-0.9.2) or migrate to Python 3.

fix

Upgrade to Python 3.5+ or pin `liccheck<0.9.2` for Python 2 projects.

affects: <0.9.2

gotcha`liccheck` must be installed in the *same* Python (virtual) environment as the packages it needs to check. This is because it uses `pkg_resources` to access installed package metadata and license information directly.

fix

Install `liccheck` alongside your project's dependencies: `pip install -r requirements.txt liccheck`.

affects: All

gotchaA license strategy file (`liccheck.ini` or `pyproject.toml`) is mandatory for `liccheck` to operate correctly. Without it, the tool cannot determine authorized or unauthorized licenses and packages, often leading to errors or unhelpful output.

fix

Always provide a strategy file, either explicitly via `--strategy-ini-file` or by placing `liccheck.ini` or a `[tool.liccheck]` section in `pyproject.toml` in the current working directory. Refer to documentation for example configurations.

affects: All

gotchaOlder versions of `liccheck` (prior to 0.9.1) had limitations or incorrect behavior when dealing with multiple licenses, especially those combined with SPDX `OR` operators. This was addressed in version 0.9.1.

fix

Ensure you are using `liccheck` version 0.9.1 or newer for accurate handling of complex license expressions.

affects: <0.9.1

gotchaWhile `liccheck.ini` is a valid configuration file, modern Python projects increasingly prefer `pyproject.toml`. `liccheck` supports a `[tool.liccheck]` section in `pyproject.toml` since version 0.9.0.

fix

For new projects or migration, consider using `pyproject.toml` for your `liccheck` configuration. For older `liccheck` versions, `.ini` files are the primary option.

affects: <0.9.0

Errors

Common errors & fixes

ModuleNotFoundError: No module named 'liccheck'

The `liccheck` package is not installed in the current Python environment or the Python interpreter cannot find it.

fix

Install the package using pip: `pip install liccheck`

FileNotFoundError: [Errno 2] No such file or directory: 'requirements.txt'

The `liccheck` command was executed without specifying a requirements file, and it could not find a `requirements.txt` file in the current directory, which is its default behavior.

fix

Ensure a `requirements.txt` file exists in the current directory or specify its path using the `-r` option: `liccheck -r path/to/your/requirements.txt`

Error: No license strategy file found

The `liccheck` command could not find a strategy file (e.g., `liccheck.ini` or `pyproject.toml`) in the current directory or the specified path, which defines authorized/unauthorized licenses and packages.

fix

Create a `liccheck.ini` (or `pyproject.toml` with `tool.liccheck` section) in the current directory, or specify the strategy file's path using the `-s` option: `liccheck -s path/to/your/strategy.ini`

Unknown license

During its analysis, `liccheck` encountered a package whose license it could not identify or map to a known license type.

fix

Manually investigate the license of the reported package. If it's a valid license you wish to permit, add it to the `authorized_licenses` section in your strategy file. If it's an internal package or one you want to explicitly allow, add it to the `authorized_packages` section. You may need to specify the license string exactly as `liccheck` reports it for recognition.

VersionConflict: zipp

This error typically indicates conflicting versions of dependencies in your Python environment, often involving `setuptools` and its related packages like `zipp` or `importlib-metadata`, preventing `liccheck` from correctly resolving package metadata.

fix

Try upgrading or downgrading `setuptools` and related packages (`pip install --upgrade setuptools`, `pip install 'setuptools<60.0.0'`) or run `liccheck` in a fresh virtual environment to isolate its dependencies. Using the `--no-deps` option might also help in some cases if the conflict is within the dependencies rather than the top-level packages.

Upgrade

Version history

0.9.2latest on PyPI · released Sep 22, 2023

Audit

Dependencies

pythonrequiredRequires Python 3.5 or newer.

Agent activity

3 hits · last 30 days

node

Resources

githubhttps://github.com/dhatim/python-license-check ↗

packagehttps://pypi.org/project/liccheck/ ↗