Skip to content

trustedlicenses

trustedlicenses checks that every package installed in your Python project has a license you've agreed to allow, so you can gate a CI build on it.

# pyproject.toml
[tool.trustedlicenses]
allowed-categories = ["Permissive", "Public Domain", "Copyleft Limited"]
ignored-packages = ["mypy-extensions"]

$ uv run trustedlicenses
Checking dependency licenses...
✗ Disallowed or undetectable licenses in 2 of 134 packages:
  certifi: detected MPL-2.0 (categories: Copyleft Limited) -- from declared metadata
    -> add "Copyleft Limited" to allowed-categories, or "certifi" to ignored-packages, to allow this
  fqdn: detected MPL-2.0 (categories: Copyleft Limited) -- from license files: LICENSE
    -> add "Copyleft Limited" to allowed-categories, or "fqdn" to ignored-packages, to allow this

Why not just read pip list's license column?

Most Python license tools (pip-licenses, licensecheck) only read what a package says its license is, in its own metadata — the License-Expression field, License :: classifiers, or the free-text License field. That's usually right, but a meaningful slice of installed packages either predate PEP 639 or declare nothing usable at all.

trustedlicenses does that same check first, then — only when a package hasn't declared anything usable — falls back to matching the actual license text it bundles in its .dist-info directory against the official SPDX license-list-data corpus, via a small Rust matcher. No system dependencies, no network calls, no rule-engine to install.

See Comparison to Alternatives for how this stacks up against pip-licenses, licensecheck, liccheck, and ScanCode Toolkit-based tools, and Performance for measured speed on a 425-package real-world environment.

Installation

uv add --dev trustedlicenses

trustedlicenses is not a lawyer and does not give legal advice. Its output — detected licenses, categories, and policy pass/fail — is a best-effort technical signal, not a legal opinion. See the README for the full disclaimer before relying on it for a compliance decision.

API Reference

Browse the API Reference for full documentation of all public classes and functions.