BytesafeDependency Firewall
How-to guides

Enforce license policy

Block package downloads by license, with named license sets as deny or allow lists and a rule for unknown licenses.

A license policy has two parts: a license set, a named list of SPDX license IDs owned by the namespace, and a firewall rule with the license selector function that matches downloads against that set. Sets are shared across firewalls, so one "Copyleft" list can back rules in every ecosystem.

The license function runs in the download execution phase: the artifact download is blocked, versions keep appearing in metadata.

Create or edit a license set

In the dashboard, open Licenses in the sidebar. Every namespace starts with a seeded Copyleft set (GPL, AGPL, LGPL variants, SSPL-1.0, EUPL-1.2, CC-BY-SA-4.0) that you can use as-is, edit, or copy from. Sets list SPDX license IDs (GPL-3.0-only, MIT, ...); the editor autocompletes from the SPDX catalog and accepts free text. Matching is case-insensitive.

Changing sets requires the ns:update:licenses permission; via the API it is the /license-sets endpoints.

Add the rule

In the firewall's rule form, choose the License selector function. The Match select offers the three modes, with a License Set picker for the first two:

  • Block licenses in set: deny list. Matches when any of the version's licenses is in the set.
  • Block licenses NOT in set: allow list. Matches when licenses were resolved but none is in the set.
  • Block unknown licenses: matches when no license information could be resolved at all.

As JSON, a deny rule against the Copyleft set (reference the set by its ID; the seeded set's ID is generated per namespace, visible on the Licenses page):

{
  "id": "block-copyleft",
  "executionPhase": "download",
  "selector": {
    "function": {
      "name": "license",
      "options": { "licenseSet": "<license-set-id>", "mode": "deny" }
    }
  },
  "ruleEffect": { "block": true, "log": true },
  "description": "Block copyleft-licensed packages"
}

An allow-list rule uses "mode": "allow" with a set of approved licenses. The unknown rule uses { "unknown": true } and no licenseSet; a selector must have exactly one of the two. A strict policy is a pair of rules: an allow rule for the approved set, plus an unknown rule, so a package passes only with a positively approved license.

Roll out like any other policy: log without block first, watch the log, then enable blocking.

Where license data comes from

The firewall resolves a version's licenses from a public license data source first, falling back to the license declared in the package's own registry metadata (npm and NuGet; PyPI, Maven, and Go have no metadata fallback). Results are cached. Conda has no license data source in the beta: Conda versions resolve as unknown license, so only the Block unknown licenses mode has an effect there. See Conda beta limits.

License expressions are flattened: every license ID mentioned in an expression counts, without evaluating OR/AND. A package declaring MIT OR GPL-3.0-only matches a deny set containing GPL-3.0-only, even though an MIT choice exists. Use an exception for dual-licensed packages you accept.

Verify

Add the rule log-only, install a package with a matching license through the firewall, and check the log entry: its output carries the resolved licenses, the licenseSet, and the source the licenses came from. Then enable block and confirm the install fails. Client-side verification steps per ecosystem are on the ecosystem pages.

Troubleshoot

Expected: expressions are not evaluated, any mentioned license counts. If the package's license choice is acceptable, add an exception on the rule for that package.

The unknown rule matched: the license data source has no data for the version and the registry metadata declares no license (or the ecosystem has no metadata fallback). Verify the package's licensing yourself, then add an exception for it.

A set referenced by any firewall rule cannot be deleted; the API answers 409 and names the firewall. Remove or repoint the rules first.

The rule references a license set ID that does not exist in the namespace. Pick the set from the rule form, or copy the ID from the Licenses page; the set must be created before the rule.

Delay new versions

Add a delay rule that keeps newly published package versions out of your builds until they have aged.

Integrate with repository managers

Deploy the firewall together with Artifactory, Nexus, GitLab, GitHub Packages, Azure Artifacts, or AWS CodeArtifact, between them and the public registries, between developers and them, or on both sides.

On this page

Create or edit a license setAdd the ruleWhere license data comes fromVerifyTroubleshootRelated