LizenzComplianceProgramme

LizenzCompliance is a software tool for license compliance and software governance. It helps organizations discover, inventory, and manage the licenses of open source and third-party components across codebases, containers, and build artifacts. The project is community-maintained and emphasizes interoperability with existing tooling.

Core capabilities include automated license detection from source code and packaged dependencies, support for SPDX identifiers, and the import of metadata from package managers such as npm, Maven, PyPI, and RubyGems. It provides a centralized license inventory, policy enforcement with customizable rules (for example prohibiting certain copyleft licenses for proprietary products), and risk scoring to prioritize remediation work. It can generate audit-ready reports (license summaries, attribution logs, SBOMs) and integrates with CI/CD pipelines to enforce policy during builds.

The data model centers on license metadata, dependency graphs, and policy definitions. In practice, LizenzCompliance is used to streamline compliance reviews, support due diligence for acquisitions, and facilitate collaboration between engineering and legal teams on license risk.

The project typically follows an open governance model, welcomes community contributions, and relies on standard formats such as SPDX and SBOMs for interoperability. While not a substitute for legal advice, it aims to reduce manual effort in license tracking and increase transparency across software supply chains.