Licensee works by taking a detected license file, and comparing the contents to a short list of known licenses.
Licensee uses a series of regular expressions to score files in the project’s root as potential license files. Here’s a few examples of files that would be detected:
:warning: If the project has multiple license matches (e.g. a package file match, a file named license or similar that matches the regular expressions) that don’t only match one well known license (see below), Licensee won’t return a license for the project, but all matches are returned in the licenses array.
Licensee relies on the crowdsourced license content and metadata from
The LICENSE file is platform-agnostic, and most popular licenses today require that the license itself be distributed along side the software. Simply putting the letters “MIT” or “GPL” in a configuration file doesn’t really meet that requirement. Those files are designed to be read by computers (who can’t enter into contracts), not humans (who can).
From a practical standpoint, every language has its own package manager (some even have multiple). That means that if you want to detect the license of an arbitrary project, you’ll have to implement 100s of package-manager-specific detection strategies.
License metadata in package manager files can complement detection from
LICENSE files through license expressions (e.g., is a
or-later-versions, or do multiple
LICENSE files indicate disjunctive choice) but licensee currently does not parse these expressions.
There are lots of ways of saying a project or some portion of it is under a license in natural language, and that’s what is often found in a
README file. Licensee can’t reliably parse natural language.
However, licensee does optionally look for license indicators in
README files. Just don’t expect that it will detect most statements found in such files, and expect to review any that it finds.
It’s a lot of work, as there’s no standardized, cross-platform way to describe a project’s license within a source file comment. (Adding a SPDX License Idenfifier to source code comments can clarify what license applies to a single source file, but licensee reports on licenses at a project level.)
Scanning every source file for potential legal notices is a useful part of a license compliance program, but there are other tools that specialize in that.