Gleam supply-chain auditing
licence_audit reports licence metadata, creates a CycloneDX SBOM, and checks your locked dependencies for known vulnerabilities. Run this small CLI locally or in CI.
$ licence_audit check PackageVersionLicencesStatus├─gleam_stdlib0.60.0Apache-2.0✓ allowed├─gleam_json3.1.0Apache-2.0✓ allowed├─gleam_http4.3.0Apache-2.0✓ allowed├─simplifile2.4.0MIT✓ allowed├─argv1.1.0Apache-2.0✓ allowed├─cowsay_gpl1.2.0GPL-3.0-only✗ denied├─tls_native0.5.0(none)? unknown└─local_helper——· skipped ✗ Policy check failed: denied dependency in tree. 1 denied · 1 unknown · 1 skipped · 5 allowed# licence_audit check exited 1
This check example finds a denied licence, an unknown licence, and a skipped path dependency. It returns exit code 1.
Run these three commands in sequence.
Run licence_audit with no arguments to report each licence in the resolved dependency tree. This command reports results and returns exit code 0.
$ gleam deps download$ licence_audit
Select the licences that you permit or deny. The command writes a [tools.licence_audit] policy to gleam.toml and preserves comments.
$ licence_audit updateRun check to fail the build when a dependency violates the policy. Add --vulns to fail on advisories at or above the specified severity.
$ licence_audit check --vulnslicence_audit reads your locked dependencies once. It writes plain text output that you can read in a terminal or log.
licence_audit gets licence metadata from Hex for each locked package and checks it against your allow and deny policy. An allow list accepts only the specified licences. A deny list rejects the specified licences.
[tools.licence_audit]allow = ["Apache-2.0", "ISC", "MIT"]deny = ["AGPL-3.0", "GPL-3.0-only"]Create a CycloneDX 1.6 document that contains package URLs, SHA-256 hashes, declared licences, external references, and the dependency graph. Use --reproducible to create byte-identical output for the same input.
{ "bom-ref": "pkg:hex/gleam_stdlib@0.60.0", "type": "library", "name": "gleam_stdlib", "version": "0.60.0", "purl": "pkg:hex/gleam_stdlib@0.60.0", "licenses": [ { "license": { "id": "Apache-2.0", "acknowledgement": "declared" } } ], "hashes": [{ "alg": "SHA-256", "content": "3e2c…9f" }]}Query OSV.dev for advisories about your Hex and GitHub dependencies. Use --vuln-severity to make CI fail at a specified severity. Advisories with unknown severity do not cause a failure.
$ licence_audit vulns ✗ tls_native 0.5.0 └─ GHSA-7f4c-9m2q-x8vp high DoS via malformed handshake · legacy_helper skipped (path dep) 16 checked · 1 affected · 15 clean
licence_audit is one executable with defined exit codes and reproducible output. Use its quiet progress mode in a pipeline.
name: licence auditon: [pull_request]
jobs: audit: runs-on: ubuntu-latest steps: - uses: actions/checkout@v6 - uses: tylerbutler/actions/setup-gleam@v1 - uses: tylerbutler/actions/setup-licence-audit@v1 - run: licence_audit checkQueso-built executables include the Erlang runtime. You do not have to install Erlang on the target machine or CI runner.
Exit code 0 means success, 1 means policy or usage failure, 2 means an input or runtime error, and 130 means user cancellation.
--reproducible uses a content hash for the serial number and SOURCE_DATE_EPOCH for the timestamp. The same input produces the same output.
licence_audit reads manifest.toml and gleam.toml. It identifies each non-Hex dependency that it skips.
Install a prebuilt executable. Then, run it in a Gleam project that has a resolved dependency tree.
mise use -g github:tylerbutler/licence_audit@latestTo install without mise, download a self-contained archive from the releases page. Put licence_audit on your PATH. For source build instructions, refer to DEV.md.
# 1. resolve deps so manifest.toml existsgleam deps download
# 2. report each licence in the dependency treelicence_audit
# 3. create and enforce a policylicence_audit updatelicence_audit check