---
title: "Licence compliance"
---

# Licence compliance

The image's licence manifest evaluated against the company's licence policy, the build's INCOMPATIBLE_LICENSE and archiver settings beside it, the source delivery with SHA-256, releases compared, and INCOMPATIBLE_LICENSE written after a confirmation.

The licence review reads what the build wrote (`license.manifest`, `image_license.manifest`, the licence texts and the archiver's `deploy/sources`) on the build host. It is a review aid for the engineer, not legal advice, and does not replace the company's legal review.

**State:** modelled: the expression reading equals OE-Core's `oe.license` on all 239 LICENSE values of poky scarthgap; manifests written by OE-Core's own `write_license_files`; settings from BitBake 2.8.1 `bitbake -e`; written lines read back by BitBake as the value in effect; the archiver's real output with SHA-256 checked; the running app against a local sshd. Not run on a real image's manifest, with the archiver's patched or configured mode, on Windows, against a real build server, on Wind River Linux, or with the build history comparison on a real repository. Buildroot `legal-info` is not built.

## The company policy

The policy is a file in the workspace, `.neuralinverse/license-policy.json`. **Create Policy...** in the editor starts one; **Open Policy** opens it. Its keys:

```json
{
  "name": "Gateway programme licence policy",
  "version": "1",
  "allowed": ["MIT", "BSD-3-Clause", "Apache-2.0"],
  "review": ["LGPL-2.1-only"],
  "forbidden": ["GPL-3.0-only", "LGPL-3.0-only"],
  "unlisted": "review",
  "sourceRequired": ["GPL-2.0-only"],
  "exceptions": [
    { "package": "example-pkg", "licenses": ["LGPL-3.0-only"], "reason": "...", "approver": "...", "date": "2026-10-01", "expires": "2027-10-01" }
  ]
}
```

`unlisted` is `allowed`, `review` or `forbidden`. An exception names a `package` (patterns allowed) or a `recipe`, the licences it allows, a reason, the approver, and optionally its date and expiry.

## Review an image

1. Run **Open Licence Review** and pick the image's manifest (newest first).
2. Each package's licence expression is evaluated (Yocto `&` and `|`, and SPDX AND, OR and WITH; the best alternative chosen and the others listed) against the policy: allowed, needs review, forbidden or not listed. Each package shows its recipe, layer, licence texts, the archiver's sources and the SBOM's licence.
3. **Policy Findings** lists the violations with package, recipe and layer.
4. **The Build's Settings (bitbake -e)** shows INCOMPATIBLE_LICENSE, INCOMPATIBLE_LICENSE_EXCEPTIONS, the archiver mode and COPYLEFT_LICENSE_INCLUDE with their files and lines, beside the policy, with the differences (licences the build lets in that the policy forbids, and the other way round).
5. **Source Delivery** lists the source archives the policy requires, with each archive's SHA-256 computed on the build host.

## Make the build enforce it

**Write INCOMPATIBLE_LICENSE** writes the policy's forbidden licences into the product distribution or `local.conf`, after a confirmation with the exact lines; BitBake then refuses a package with a forbidden licence.

## Export and compare

- **Export Licence Record (Markdown)...** or **(CSV)...** writes the record with each required source archive's SHA-256.
- **Compare with an earlier manifest...**, or **Compare in Build History** between two builds, then **Export Comparison**.

## Agent tools

Five read-only tools and one confirmed write.

Next: [Sources and mirrors](https://neuralinverse.com/docs/modules/embedded-linux/sources-and-mirrors/).