Licence compliance

The licence review reads what the build wrote (license.manifest, image_license.manifest, the licence texts and the archiver's deploy/sources) on the build host. It is a review aid for the engineer, not legal advice, and does not replace the company's legal review.

State: modelled: the expression reading equals OE-Core's oe.license on all 239 LICENSE values of poky scarthgap; manifests written by OE-Core's own write_license_files; settings from BitBake 2.8.1 bitbake -e; written lines read back by BitBake as the value in effect; the archiver's real output with SHA-256 checked; the running app against a local sshd. Not run on a real image's manifest, with the archiver's patched or configured mode, on Windows, against a real build server, on Wind River Linux, or with the build history comparison on a real repository. Buildroot legal-info is not built.

The company policy

The policy is a file in the workspace, .neuralinverse/license-policy.json. Create Policy... in the editor starts one; Open Policy opens it. Its keys:

{
  "name": "Gateway programme licence policy",
  "version": "1",
  "allowed": ["MIT", "BSD-3-Clause", "Apache-2.0"],
  "review": ["LGPL-2.1-only"],
  "forbidden": ["GPL-3.0-only", "LGPL-3.0-only"],
  "unlisted": "review",
  "sourceRequired": ["GPL-2.0-only"],
  "exceptions": [
    { "package": "example-pkg", "licenses": ["LGPL-3.0-only"], "reason": "...", "approver": "...", "date": "2026-10-01", "expires": "2027-10-01" }
  ]
}

unlisted is allowed, review or forbidden. An exception names a package (patterns allowed) or a recipe, the licences it allows, a reason, the approver, and optionally its date and expiry.

Review an image

1. Run Open Licence Review and pick the image's manifest (newest first).
2. Each package's licence expression is evaluated (Yocto & and |, and SPDX AND, OR and WITH; the best alternative chosen and the others listed) against the policy: allowed, needs review, forbidden or not listed. Each package shows its recipe, layer, licence texts, the archiver's sources and the SBOM's licence.
3. Policy Findings lists the violations with package, recipe and layer.
4. The Build's Settings (bitbake -e) shows INCOMPATIBLE_LICENSE, INCOMPATIBLE_LICENSE_EXCEPTIONS, the archiver mode and COPYLEFT_LICENSE_INCLUDE with their files and lines, beside the policy, with the differences (licences the build lets in that the policy forbids, and the other way round).
5. Source Delivery lists the source archives the policy requires, with each archive's SHA-256 computed on the build host.

Make the build enforce it

Write INCOMPATIBLE_LICENSE writes the policy's forbidden licences into the product distribution or local.conf, after a confirmation with the exact lines; BitBake then refuses a package with a forbidden licence.

Export and compare

• Export Licence Record (Markdown)... or (CSV)... writes the record with each required source archive's SHA-256.
• Compare with an earlier manifest..., or Compare in Build History between two builds, then Export Comparison.

Agent tools

Five read-only tools and one confirmed write.

Next: Sources and mirrors.