Policy management

License policy

License policies define which package licenses are not permitted in your workspace. You can specify one or more licenses to deny, and choose whether packages matching the deny list are quarantined automatically.

Supported package formats

Cloudsmith will automatically match licenses for the following package formats:

Format	License Support
Alpine	✅
Cargo	✅
Cocoapods	✅
Composer	✅
Conan	✅
Conda	✅
CRAN	✅
Dart	✅
Debian	✅
Docker	❌
Generic	❌
Go	✅
Helm	✅
Hex	✅
HuggingFace	❌
LuaRocks	✅
Maven	✅
npm	✅
NuGet	✅
PowerShell Modules	❌
Python	✅
Raw	❌
RPM	✅
Ruby	✅
Swift	✅
Terraform	❌
Unity	✅
Vagrant	❌

Note
For Unity packages, the license needs to be present in the package.json file in order to be detected.

Manage license policies

To manage license policies in your workspace, go to the Policies tab of the overview page in the Cloudsmith web app and click License.

Warning
Deactivating a policy is not supported at this time, resulting in any policy created being active until deleted.

Create a license policy

To add a new license to the deny list, click + Create license policy.

You are then presented with the Create license policy form:

Here you can configure the following:

Field	Description
Name	A display name for the license policy.
Description	A description of the license policy.
Select licenses to deny	Select the licenses to be denied as part of this policy. The licenses listed in this table are sourced from the SPDX License List.
Quarantine packages that violate this policy	Set to Yes to flag and automatically quarantine any package that violates this license policy. Set to No to flag, but not automatically quarantine, packages that violate this license policy.
Allow unknown or absent licenses	Set to Yes to ignore packages with missing or unknown licenses. Set to No to flag and quarantine packages with a missing or unknown license. Note: The SPDX License List is used as the license source. If a package has a license that is not listed in the SPDX License List, it will be treated as an unknown license.

Once saved, the policy is enabled across your workspace, and the policy compliance check will be performed automatically during the package synchronization process. This process occurs when a package is uploaded, moved, copied, or cached (such as in upstream caching).

You can also manually trigger a synchronization of a package using the resync functionality. For more details, see Package resynchronization.

Policy violations

You can see license policy violations on the workspace and repository Compliance dashboards. Click the License policy violations card to display a list of all license policy violations across the workspace or repository.

Note
The License policy violations card is only visible in workspaces with active license policies. Otherwise, the card is hidden.

You can also search for license policy violations on the workspace or repository packages list view by using package search with the policy_violated:true filter for all policy violations, or license_policy_violated:true to only return license policy violations.

Logs

Logs of policy violations and quarantining actions are also displayed within the Logs > Package Logs page:

Audit logs are generated whenever users create, update, or delete a license policy.

Restore a package that violates a policy

You can remove a package from quarantine in two ways:

Change the package license to an allowed license, then manually unquarantine the package. For more details, see Edit a license and Release from quarantine.
Edit the license policy to remove the specific license from the deny list, then manually unquarantine the package.

Updated 2 weeks ago