How to Create Curation Policies for Custom Licenses

Use case: Your organization uses proprietary or non-standard licenses that aren't detected by standard scanners. You want to block or allow package downloads based on these custom licenses defined in JFrog Catalog.

Workflow Steps:

1. Create a Custom License in JFrog Catalog

   • Navigate to Catalog > License Settings.
   • Click Create License.
   • Enter the license Name, Full Text, Category, and optionally set an Expiration Date.
   • Click Create.

   For more information, see Create and Assign Custom Licenses.

2. Assign the Custom License to Packages

   • From the License Settings page, select the license and click Assign to Packages to assign it to multiple packages at once (Global Flow).
   • Alternatively, navigate to the package detail page in Catalog, open the Licenses tab, and click Assign Custom License to assign it to a specific version or all versions (Package Flow).
   • Choose whether to Add the custom license alongside the detected license or Replace the detected license entirely.

3. Create a Curation Policy Using the Custom License

   • Navigate to Administration > Curation > Policies Management.
   • Click Create Policy.
   • In the Scope step, select the repositories or package types to enforce the policy on.
   • In the Condition step, select one of the following:
     • Block list by License — Add your custom license to the banned list. Packages assigned this license are blocked from download.
     • Allow list by License — Add your custom license to the allowed list. Only packages with an allowed license (including your custom one) can be downloaded.
   • Custom licenses appear in the license selection dropdown alongside standard detected licenses.
   • In the Action step, choose Block or Dry Run and configure notifications.
   • Click Save.

4. Test the Policy

   • Try downloading a package that has the custom license assigned.
   • Confirm the request is blocked (or flagged in Dry Run mode).
   • View blocked package details under Curation > Audit.

How Policy Evaluation Works with Custom Licenses

When a developer requests a package download, Curation evaluates licenses as follows:

1. Checks JFrog Catalog for any custom license assignments on the package or version.
2. If a custom license is assigned:
   • In Add mode — The custom license is evaluated alongside the detected public license.
   • In Replace mode — Only the custom license is evaluated (the detected license is ignored for policy purposes).
3. The combined or overridden license set is checked against the policy's banned or allowed list.
4. If a violation is found, the download is blocked (or logged in Dry Run mode).

Example Scenarios

The following table describes common scenarios for using custom licenses with Curation policies.

License Expressions

If a package has multiple custom licenses assigned, the license expression (And/Or) determines how they are evaluated:

• And — All assigned licenses must pass the policy condition for the package to be allowed.
• Or — At least one assigned license must pass the policy condition.

For more information on available conditions, see List of Available Conditions.