Download the PHP package k2gl/composer-license-gate without Composer
On this page you can find all versions of the php package k2gl/composer-license-gate. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download k2gl/composer-license-gate
More information about k2gl/composer-license-gate
Files in k2gl/composer-license-gate
Package composer-license-gate
Short Description Composer plugin that checks your dependencies' licenses against an allow/deny policy and can fail the install on a violation.
License MIT
Homepage https://github.com/k2gl/composer-license-gate
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package composer-license-gate
composer-license-gate
A Composer plugin that checks your dependencies' licenses against an allow/deny policy as they're installed — and, in enforce mode, fails the install on a violation. It runs inside Composer's install/update lifecycle, so a disallowed license (say, GPL creeping into a proprietary product through a transitive dependency) is caught automatically in local installs and in CI, without a separate command to remember.
Unlike report-only license checkers you invoke by hand, this is a gate: the
policy lives in composer.json and is enforced on every composer install and
composer update.
Install
Configure
All configuration lives under extra.k2gl-license-gate in your root
composer.json:
modewarn(default) — report violations but don't stop.enforce— fail the install when a package violates the policy.off— do nothing.
allow— an allow-list. If set, a package is accepted only when every declared license matches one of these patterns. Takes precedence overdeny.deny— a deny-list. A package is rejected if any declared license matches one of these.allow-packages— package names (vendor/name) exempt from the check, for the odd dependency you've reviewed and accepted.require-license— treat a package that declares no license as a violation.
Patterns are SPDX identifiers, matched case-insensitively, with a trailing * as
a prefix wildcard — GPL-* matches GPL-2.0-only, GPL-3.0-or-later, and so on.
Use either allow (a strict whitelist — safest) or deny (block known-bad
licenses, permit the rest). If both are set, allow wins.
What you'll see
Under enforce, a violation aborts the install:
Under warn, the same line is printed but the install continues.
Notes
- A dual-licensed package (e.g.
MIT OR GPL-3.0) is read conservatively: if any of its licenses is disallowed, it's flagged. Accept it deliberately withallow-packagesonce you've confirmed you're using it under the allowed option. - Checks run per package as Composer installs or updates it, so only the packages
actually being changed are checked — a full audit happens naturally on a clean
composer install.
Requirements
- PHP 8.1+
- Composer 2 (
composer-plugin-api ^2.0)
License
MIT
All versions of composer-license-gate with dependencies
ext-json Version *
composer-plugin-api Version ^2.0