License Conclusion
Learn how Xray license conclusion picks a final SBOM license from priority.
License Conclusion is available in JFrog Xray 3.124.x and later. You can use it to choose a final license for a specific software bill of materials (SBOM) entry, automatically or manually, without removing the licenses that were originally declared.
Xray can conclude a license from priority instead of discarding conflicting or multiple declared licenses.
Conflicting licenses in an SBOM are common. For example, a package declared under both the MIT and Apache 2.0 licenses can make the compliance obligation unclear. When you combine open source and proprietary components, a clear concluded license helps you meet your obligations and describe them accurately.
Benefits
- Improves legal clarity by distinguishing between declared and concluded licenses
- Supports compliance teams with more accurate reporting and audit readiness
- Allow to better communicate the actual combined license obligations of a certain artifact
How It Works
- Xray concludes the license from the assigned license "priority" value. A lower value is better.
- Each license has a default priority based on its license category. You can override that default with the Set License Priority API endpoint.
- You can set a custom priority to distinguish licenses in the same category. For example, MIT and ISC are 2 permissive licenses with the same default priority.
The following table lists the default priority for each license category.
| License Category | Priority | Description |
|---|---|---|
| CLA | 5 | Contributor License Agreement. An administrative legal instrument defining the terms of contribution to a project, not usage. Often signals corporate ownership and potential future relicensing risk. While not a blocker for usage, it requires review to ensure the project structure aligns with long-term dependency goals. |
| Copyleft Limited | 3 | The Component-Level Compromise. Also known as "Weak Copyleft." Mandates that source code modifications to the specific library be shared, but allows the library to be linked to proprietary applications without the "viral" spread of the license to the main codebase. Requires developmental discipline (dynamic linking) and is mainly useful in dynamic-linked languages . Includes LGPL, MPL, EPL. |
| Proprietary Free | 5 | Closed-Source Freeware. Software provided at no cost but with no source code and strict prohibitions on modification or reverse engineering. Carries high operational risk ("Abandonware"): if the vendor disappears, the user cannot fix bugs or patch security holes. A "Black Box" dependency. |
| Permissive | 2 | The "Do-Anything" Standard. Grants broad rights to use, modify, and redistribute with minimal obligations (typically just copyright attribution). It allows for "freedom to close," meaning code can be incorporated into proprietary products without problems. Ideal for commercial development. Includes MIT, BSD, and Apache 2.0. |
| Patent License | 5 | Invention Rights Only. A specific grant of patent rights, distinct from copyright. It acts as a covenant not to sue for patent infringement. Categorized as high priority because these licenses are often complex, may contain defensive termination clauses ("if you sue us, this license ends"), and often appear alongside, but separate from, usage licenses. |
| Source-available | 4 | Don't Resell This Software category. Source code is viewable and often modifiable for internal use, but the license contains discriminatory restrictions (e.g., prohibiting SaaS competition or commercial exploitation). Breaks the "Open Source Definition." Used by vendors (MongoDB, Elastic) to protect business models. Risk depends on the user's business model. |
| Free Restricted | 4 | Free with Strings Attached. Free of charge but imposes field-of-use restrictions. Includes "Ethical Source" (e.g., no military use) or industry-specific limitations (e.g., no nuclear use). These restrictions create binary compliance risks—the software is legally forbidden for specific sectors, requiring careful vetting of the user's domain. |
| Unstated License | 5 | No License Found Components found without any explicit license file or header. Extremely Risky to use since author intentions are completely unknown |
| Copyleft | 5 | The Viral Licenses. Strong Copyleft (GPL, AGPL) mandates that any derivative work (often including statically linked applications) be licensed under the same terms. For AGPL, this extends to network access (SaaS). This is a "poison pill" for proprietary software, frequently forcing full source disclosure of the user's application. |
| Commercial | 5 | Pay-to-Play. Proprietary software requiring a purchased license. Usage without a valid contract constitutes theft. |
| Public Domain | 1 | The Zero-Restriction Licenses. Software where the author has waived all copyright, or rights have expired (e.g., CC0, Unlicense). Effectively the most permissive state possible. |
REST API Support
Related Topics
Updated 24 days ago
Did this page help you?