Checks a package's dependencies for compliance with a specified licensing policy.
Abogado inspects the license type of each Node package dependency referenced by a given package. You can define a policy of allowed/denied licenses and/or individual packages, and abogado will identify any violations to that policy. A detailed report of the audit can be also generated for later review or further action.
For example, this would work very well incorporated into an automated build process so that the build can be failed if a dependency is introduced for which your organization cannot comply with the license terms.
Installation using NPM
Install as a local dependency
npm install abogado
npm install abogado -g
Usage: abogado [options] Options: --allow-licenses <licenses> List of licenses to allow (supports RegEx patterns) --allow-packages <packages> List of packages to allow (supports RegEx patterns) --deny-licenses <licenses> List of licenses to deny (supports RegEx patterns) --deny-packages <packages> List of packages to deny (supports RegEx patterns) -p, --package-dir <path> Directory of package to audit (must contain package-lock.json) (default: .) -o, --output-path <path> Path to report output file -v, --verbose Enable verbose logging -h, --help output usage information
abogado reviews dependencies by reading the project-lock.json file for the specified package. Therefore, the package being checked MUST be installed prior to running this utility.
Refer to licenses using their SPDX identifiers. The list of licenses available are here: https://spdx.org/licenses
Alternatively, configuration options can be read from an
abogado.json file located in the package root directory.
In combination, options can also be specified on the command-line to override those options found in the file.
See Configuration File Schema for more details.
You can reference SPDX identifiers for the licenses you want to allow or deny. Alternatively, you can use RegEx patterns to match multiple licenses or package names.
Allow only MIT and any version of the Apache license in the current package
abogado . --allow-licenses MIT,Apache-
Allow any license but the Affero GPL
abogado . --deny-licenses AGPL-1.0