License Control

Controlling Third Party Licenses

The License Control Add-on completes the Artifactory Build Integration Add-on allowing you full control over the licenses of the dependencies used by your builds (and eventually in your software).

This Add-on is part of the Artifactory Pro Power Pack.

As part of the Build Server deployment to Artifactory, it analyzes the used dependencies and tries to match them against a set of license management rules.

Notifications can be sent to a selected list of recipients about dependencies with unknown or unapproved license information.

To support this feature Artifactory includes a new license management facility where rules about license matching and approval status are defined. These rules are consulted as part of the license analysis.

How does license analysis work?

Automatic analysis is performed upon deployment by examining information found in artifact module files. Currently Maven POM, Ivy Descriptor, NuGet, and RPM files are supported.

You can always override the automatic results and assign license information manually to dependencies. You can also compare the current license status to the auto calculated one and decide what results of the automatic analysis to accept.

License information is stored with the artifact and reused by the automatic license analysis on subsequent builds.

Page Contents

Central License Management

Licenses are managed in the Admin module under Configuration | Licenses.

License Management

You can add a new license by clicking New or edit the information for a license by selecting its License Key in the list.

Artifactory comes preconfigured with all the common OSI licenses and JFrog has already tuned these licenses against common project builds.

By selecting Export, you can also export the license list.

Editing License Information

Create or edit a license

License Key	A unique identifier for this license in Artifactory
Long Name	A description of the license
URLs	The URL that describes the terms of the license
Notes	Additional notes
RegExp	The regular expression by which to match the license (by comparing it to license information in module files). If you leave the regexp field blank, Artifactory attempts an exact match against the license key.
Approved	When set, this license is approved which means you allow the use of components that come with this license.

Using Build Licenses

Build Server Configuration

When you run a build from your CI server (Hudson, TeamCity or Bamboo), configure the Artifactory Plugin to run license checks as part of the build.

Below is a sample section from the Hudson configuration of the Artifactory Plugin:

You can configure whether or not you wish license checks to take place as part of deploying Build Info to Artifactory (the Build Info Bill of Materials must be deployed to Artifactory for license checks to run).

You can also set a list of recipients to be notified about license violations as soon as they occur. This way whenever a dependency with an unknown or unapproved license is added to the build recipients receive an immediate email notification and can tend to any potential license violation.

Sending license violation notifications is performed through Artifactory and requires a valid mail server to be configured.

Not failing the build

Currently, Artifactory does not fail the build as a result of license violations.

This is an informed decision in the spirit of allowing technical development to continue, while alerting others about the advent of unauthorized dependencies in near or real-time, so they can be addressed early on by the appropriate parties.

Examining Build Licenses

Once the build has finished on the build server and Build Info has deployed to Artifactory, license checks are run.

You can view detailed license information in the Licenses tab of the Build Browser. This tab displays information about all the dependencies used in the build and the license they are associated with. To group the information by Scope or License click the corresponding column header.

Build Info Licenses

The summary panel displays the overall count of licenses by status and inside the table itself, licenses are displayed in different colors according to their status:

License Status	Description
Unapproved	The license found is not an approved license
Unknown	License information was found but cannot be related to any license managed in Artifactory
Not Found	No license information could be found for the artifact.
Neutral	The license found is unapproved, however another approved license was found for the artifact (Only applicable for artifacts that are associated with multiple licenses)
Approved	The license found is an approved license

Inline License Editing

From the Build Browser, an Artifactory administrator can manually change the license information for any artifact displayed. Clicking the entry under the License column for any artifact will display the Edit 'artifactory.licenses' Property dialog where the administrator can specify the licenses for that artifact. For example, clicking the Public Domain license entry from the screenshot above will display the following dialog:

Edit License Property

Running Manual License Discovery

You can manually run the license discovery rules after a build has already run. There are several reasons why you may want to do this:

License rules (configured licenses and regular expressions) have changed and you want to compare the existing build licenses with the results of the new rules, or use them to complete missing license information.
To test the current rules against the dependencies and tweak the rules, if necessary.
To check which license information can come from rules and which license information must be set manually.

To trigger license discovery select the "Auto-find Licenses" button.

Any license conflicts are displayed to the right of the table. You can override the existing license information with the discovered license by checking the corresponding checkbox (you must have annotate permissions for the artifacts for which you want to override licenses).

Setting License Information Manually

To set license information for artifacts manually, when viewing an artifact's details in the Artifact Repository Browser, in the General tab Licenses entry, click Add.

This will display the Add Artifactory Licenses Property dialog where you can specify the licenses for the selected artifact.

Multiple licenses

Note that an artifact may be associated with multiple licenses

Scanning artifact Maven/Ivy model for license

Another option for editing the license information is by scanning the Maven/Ivy model for licenses, that is, looking for an existing pom matching the artifact.

Once you have the artifact selected in the tree browser go to the General tab and under the License label choose Scan and confirm licenses found in the scan results, if any.

Yet another option would be to use the 'Search For Archive License File' link, which will scan the artifact archive for a 'License' or 'License.txt' entry and ask for confirmation, if found.

License Information as Properties

Internally, license information is stored as regular properties, using the built-in artifactory.licenses property name.

Therefore, all operations with properties are available to license information (searches, recursive assignment, property-based deployment and resolution etc.)

Licenses are properties

Licenses REST API

License-oriented searches and management operations are available through the REST API.

Refer to the REST API Documentation for usage information.

License Control

Controlling Third Party Licenses

Central License Management

Editing License Information

License Key

Long Name

URLs

Notes

RegExp

Approved