查找 JAR 库的许可证
我使用 Maven 构建我的 Web 应用程序项目，当我向 pom 文件添加一些依赖库时，它会再次递归地向项目添加一些更多依赖的 jar。有没有办法找出或限制只应包含具有某种许可证类型的 jar - 例如 Apache 许可证、BSD 等。或者有没有办法找出 jar 文件是否属于 GPL/ASL 等，而无需访问应用程序中每个 jar 的网站？
I use Maven to build my web app projects, when I add some dependent library to the pom file, it again adds some more dependent jars to the project recursively. Is there a way to find out or restrict that only jars having a certain type of license - say Apache License, BSD etc should be included. Or is there a way to find out that a jar file is under GPL/ASL etc without going to the website for each jar in the application?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
在收购我工作的公司期间，收购公司使用以下软件/咨询来完成您所描述的操作。
http://www.blackducksoftware.com/transact
虽然我猜测您可能正在寻找免费替代品。可能还有其他方法，但该公司通过这样做赚钱的事实表明，替代方法可能不太彻底/准确。
During the acquisition of a company I was working for, the acquiring company used the following software / consultancy to do what you're describing.
http://www.blackducksoftware.com/transact
Although I'm guessing you were probably looking for a free alternative. There may be other methods, but the fact this company makes money doing this suggests an alternative is probably less thorough/accurate.
我还发现此网站 (https://www.versioneye.com) 提供了许可证信息。例如， https://www.versioneye.com/java/tomcat :jasper-runtime/5.5.23 表示许可证：Apache License 2.0
I also find this website (https://www.versioneye.com) provides license info. For instance, https://www.versioneye.com/java/tomcat:jasper-runtime/5.5.23 says License: Apache License 2.0
许可证扫描仪的免费替代品是“scancode-toolkit”。它能够扫描您的代码库以获取版权信息、许可证文本等。
但是就像 @Stephen C 在他的回答中提到的那样，它并不总是能够检测依赖项的许可证。
https://github.com/nexB/scancode-toolkit
A free alternative for a license scanner is the "scancode-toolkit". It is able to scan your codebase for copyright information, license texts etc.
But like @Stephen C mentioned in his answer, it won't be always able to detect the license for a dependency.
https://github.com/nexB/scancode-toolkit
Maven "Project Info Reports" 插件 生成一个 依赖项报告，其中包含依赖项的许可证。这是示例。
显然，这取决于依赖的 POM 是否正确声明了它们的依赖关系，并且需要您“在线”构建站点文档。
The Maven "Project Info Reports" plugin produces a Dependencies report that includes the Licenses for the dependencies. Here's an example.
Obviously, this depends on the dependent POMs declaring their dependencies properly, and it requires that you build your site documentation "online".