License Attribution Report

The License Attribution Report lists the open source components bundled in an artifact or release, with the license obligations and attribution requirements for each component. Xray collects this information into one PDF or text file you can use for distribution, audits, or legal reviews. The report is available in Xray 3.124.x and later.

Most open source licenses, such as MIT, Apache-2.0, and BSD, require you to include attribution information when you redistribute the software. These obligations typically require you to preserve the license text, credit the original authors, and, in some cases, include additional notices or disclaimers.

You can generate the report in either of the following ways.

• REST API: The report is available from the Legal Attribution Report REST API.
• Xray UI: Support starts in Xray 3.130.5. The report is available from the resource export dialog.

The report has the following setup requirements.

• The JFrog Catalog service is required for self-managed instances. For more information, see the catalog installation guide.
• The sbom.retrieveCopyrightsFromCatalog feature flag must be set to true in the JFrog Xray system.yaml file.

Supported Packages

The attribution report is currently available for the following package types:

• npm
• Maven
• Go
• PyPI
• NuGet
• Debian and Ubuntu

The following package types are coming soon.

• Alpine

What’s Included in the Report

Each License Attribution Report includes the following elements for each component:

• Component identifier: Includes the package name, version, and package type. For example, npm:[email protected].
• Associated licenses: Lists all licenses declared for the component. For example, MIT and Apache-2.0.
• Copyright information: Xray extracts this information from license files, source code headers, or manifest files.
• Full license text: This element is the complete, unmodified license text from the original open source package.
• Required notices: Coming soon. For licenses such as Apache-2.0 that require a NOTICE file, this section captures and displays that file.

Related Topics

• License Compliance
• License Studio
• License Conclusion
• How to View and Modify Licenses in the SBOM Tab