> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/software-supply-chain-assurance/use-scs/open-source-management/license-conditions.md).

# License Conditions

Learn how SCS determines, displays, classifies, and filters license conditions for dependencies in an SBOM.

{% hint style="success" %}
This feature is in Limited GA and requires enablement. [View all early access features.](/release-notes/features.md)

{% @harness-feature-flag-access/request-feature-flag-access module="supply-chain-security" pagePath="supply-chain-security/use-scs/open-source-management/license-conditions" featureFlags="%5B%7B%22name%22%3A%22SCS%20License%20Conditions%22%2C%22key%22%3A%22SCS\_LICENSE\_CONDITIONS%22%2C%22status%22%3A%22LIMITED\_GA%22%2C%22description%22%3A%22Enables%20viewing%20license%20obligations%2C%20permissions%2C%20and%20limitations%20for%20SBOM%20dependencies%20and%20filtering%20dependencies%20by%20those%20conditions%20in%20the%20SCS%20SBOM%20view.%22%7D%5D" %}
{% endhint %}

Software licenses define the conditions under which open source components can be used and distributed. However, the SBOM component view currently displays only the license name, such as MIT or GPL-2.0, without showing the obligations, permissions, or limitations associated with that license. Users must look up this information separately to understand the compliance requirements for each component.

License Conditions provides this information directly in the SBOM view. It displays the conditions associated with a component's license and lets you filter components by specific conditions. The specific conditions can include requirements to attribute the license, include a copy of the license with distributions, state changes made to the software, or make source code available. This helps compliance and development teams identify components with specific license requirements without manually cross-referencing each license externally.

### What will you learn in this topic? <a href="#what-will-you-learn-in-this-topic" id="what-will-you-learn-in-this-topic"></a>

By the end of this topic, you will be able to:

* Understand the license conditions associated with dependencies in an SBOM.
* Understand how Supply Chain Security (SCS) determines license information for dependencies from the license data provided in the SBOM.
* Distinguish between license condition categories.
* View license conditions for a dependency.
* Filter dependencies by one or more license conditions.

***

### Before you begin <a href="#before-you-begin" id="before-you-begin"></a>

* Make sure that your source code management (SCM) provider is integrated with the platform to generate SBOMs for your code repositories. You can do this in one of the following ways:
  * Repository onboarding through RSPM currently supports GitHub and Bitbucket.
    * To integrate your GitHub account and onboard the repositories, go to [Onboard GitHub Repositories](https://developer.harness.io/docs/software-supply-chain-assurance/open-source-management/integrations/github).
    * To integrate your Bitbucket account and onboard the repositories, go to [Onboard Bitbucket Repositories](https://developer.harness.io/docs/software-supply-chain-assurance/open-source-management/integrations/bitbucket).
  * SBOMs can be generated through pipeline execution. Harness supports pipeline-based SBOM generation for all SCM providers it supports. For more information, go to [What's Supported by Harness CI](https://developer.harness.io/continuous-integration/new-to-harness-ci/ci-supported-platforms). To generate SBOMs via pipeline execution, refer to the [Generate SBOM for Repositories](https://developer.harness.io/docs/software-supply-chain-assurance/open-source-management/generate-sbom-for-repositories) documentation.
* Make sure that SBOMs are generated for your container artifacts. For more information, go to [Generate SBOM for Artifacts](https://developer.harness.io/docs/software-supply-chain-assurance/open-source-management/generate-sbom-for-artifacts).

***

### Understand License Conditions <a href="#understand-license-conditions" id="understand-license-conditions"></a>

License Conditions provide information about the conditions associated with the licenses of dependencies in an SBOM. SCS uses the license associated with each dependency to determine the applicable conditions and displays the available conditions along with their descriptions.

For each license, SCS displays the applicable conditions in the *License Conditions* view. The conditions specify what the license requires, permits, or limits regarding how you use, modify, or distribute the associated open-source software.

You can also use the *License Conditions* filter in the SBOM view to find dependencies based on their license conditions. The filter lets you select one or more conditions and displays the dependencies whose licenses have those conditions.

The following table provides a structured overview of why License Conditions are used, when they should be used, and how to leverage them within SCS to understand and filter components by their license conditions.

| Why use it?                                                                                                                                                                       | When to use it?                                                                                                                                                                     | How can you leverage it?                                                                                                                                                                  |
| --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| <ol><li>Understand the obligations, permissions, and limitations associated with dependency licenses.</li><li>Reduce the need to manually look up license requirements.</li></ol> | <ol><li>When you need to understand the conditions associated with a dependency's license.</li><li>When you need to identify components with specific license conditions.</li></ol> | <ol><li>View the conditions associated with a dependency's license in the <em>License Conditions</em> view.</li><li>Filter SBOM dependencies by one or more license conditions.</li></ol> |

#### Determine license conditions <a href="#determine-license-conditions" id="determine-license-conditions"></a>

SCS associates license conditions with a component based on the dependency’s SPDX license identifier. The feature uses a predefined mapping of 184 SPDX licenses to the supported license conditions. This mapping is stored as a static resource and is used to look up the conditions for each license. For more information on license identifier, go to [SPDX License List](https://spdx.org/licenses/).

For example, if a component uses the `BSD-2-Clause` license, SCS uses that license identifier to retrieve the conditions mapped to `BSD-2-Clause` and displays them in the *License Conditions* view. The condition information includes a name, a description, and a message. The application uses this information to explain what each condition means for the associated license.

#### License condition classification <a href="#license-condition-classification" id="license-condition-classification"></a>

License conditions are classified into categories based on what they describe. This classification helps you distinguish between actions required by a license, actions permitted by a license, and rights or limitations associated with a license. Conditions are classified into the following categories:

* **Obligations:** Conditions that require you to take specific actions when using or distributing the software.
* **Permissions:** Conditions that describe what you are allowed to do with the software.
* **Grants and Limitations:** Conditions that describe rights granted by the license and limitations that apply to its use.

The following table describes the license conditions included in each category and explains what each condition means.

<table><thead><tr><th>Category</th><th>Condition</th><th>Description</th></tr></thead><tbody><tr><td rowspan="4">Obligations</td><td>Need to Attribute</td><td>Distribution requires attribution through a copyright notice, as specified by the license.</td></tr><tr><td>Need to Include License</td><td>Future distributions must include a copy of the license.</td></tr><tr><td>State Changes</td><td>Future distributions with material changes to the OSS-licensed code must describe the changes made to it.</td></tr><tr><td>Include Source</td><td>Source code must be made available when distributing the software. For GPL, only the source for the relevant library must be made available.</td></tr><tr><td rowspan="6">Permissions</td><td>Commercial Use</td><td>The software and derivatives may be used for commercial purposes.</td></tr><tr><td>Allows Distribution</td><td>The licensee may distribute software that incorporates, modifies, or is derived from the OSS-licensed software.</td></tr><tr><td>Allows Modification</td><td>The licensee may modify the OSS-licensed software and create derivative works.</td></tr><tr><td>Private Use</td><td>The licensee is free to use, modify, or incorporate the source code without distributing it to others.</td></tr><tr><td>Sub-License</td><td>The license allows the licensee to sub-license the OSS-licensed code to third parties under the same license or different but compatible terms.</td></tr><tr><td>Linking Exception</td><td>A program that links to OSS-licensed code, either dynamically or through a shared library, will not incur all requirements normally associated with the GPL or other copyleft licenses.</td></tr><tr><td rowspan="3">Grants and Limitations</td><td>Patent Grant</td><td>The license contains an express grant of patent rights from the owner of the OSS-licensed software.</td></tr><tr><td>No Liability</td><td>The owner of the OSS-licensed code disclaims all warranties and liabilities.</td></tr><tr><td>No Trademark License</td><td>The license expressly prohibits use of the names, logos, or trademarks related to the OSS-licensed code without express permission.</td></tr></tbody></table>

***

### View a license condition <a href="#view-a-license-condition" id="view-a-license-condition"></a>

View license conditions for a dependency to understand the specific requirements, permissions, and limitations associated with its license before using or distributing the dependency. To view the license conditions for a dependency, complete the following steps:

1. On the sidebar navigation of your SCS account, under the **Supply Chain** section, navigate to the **Code Repositories** or **Artifacts** page based on your requirements.
2. Select your repository or artifact (along with the digest).\
   The **Overview** tab opens by default.
3. Select the **SBOM** tab to view the list of dependencies in the form of a table.
4. Select the dependency for which you want to view license conditions to open the side panel.\
   The **Overview** tab opens by default and the **Details** section displays one or multiple licenses associated with the dependency.
5. Click each license to view the associated license conditions.

<figure><img src="https://234451070-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSN2B2M5cFWy0hhD0xTuE%2Fuploads%2FCkqOb24esRVOit51lBn9%2Fview-license-conditions.png?alt=media&amp;token=8369f275-c5eb-414b-abf0-5757ba0b59cd" alt="License Conditions of a dependency"><figcaption><p>License Conditions of a dependency</p></figcaption></figure>

***

### Filter dependencies by license condition <a href="#filter-dependencies-by-license-condition" id="filter-dependencies-by-license-condition"></a>

Filter dependencies by license conditions to quickly identify dependencies with specific license requirements, permissions, or limitations and assess their licensing implications. To filter dependencies by license conditions, complete the following steps:

1. On the sidebar navigation of your SCS account, under the **Supply Chain** section, navigate to the **Code Repositories** or **Artifacts** page based on your requirements.
2. Select your repository or artifact (along with the digest).\
   The **Overview** tab opens by default.
3. Click the **License Condition** dropdown menu and select the following:
   1. Under **Obligations**, choose the condition you want to filter by:
      * **Need to Attribute** to filter dependencies that require attribution.
      * **Need to Include License** to filter dependencies that require the license to be included with distributions.
      * **State Changes** to filter dependencies that require changes to be stated.
      * **Need to Share Source Code** to filter dependencies that require source code to be shared.
   2. Under **Permissions**, choose the condition you want to filter by:
      * **Commercial Use** to filter dependencies that allow commercial use.
      * **Allows Distribution** to filter dependencies that allow distribution.
      * **Allows Modification** to filter dependencies that allow modification.
      * **Private Use** to filter dependencies that allow private use.
      * **Sub-License** to filter dependencies that allow sublicensing.
      * **Linking Exception** to filter dependencies that have a linking exception.
   3. Under **Grants and Limitations**, choose the condition you want to filter by:
      * **Patent Grant** to filter dependencies with a patent grant.
      * **No Liability** to filter dependencies with a no-liability condition.
      * **No Trademark License** to filter dependencies with a no-trademark-license condition.

<figure><img src="https://234451070-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSN2B2M5cFWy0hhD0xTuE%2Fuploads%2FmVVUhmCM5iYzUc7aIf74%2Ffilter-license-conditions.png?alt=media&amp;token=7f5850cf-aa2a-4268-a7cd-c2ac14cc8f7b" alt="Filter license conditions"><figcaption><p>Filter License Conditions</p></figcaption></figure>

{% hint style="info" %}
A dependency may have a license with more than one condition. You can select multiple conditions to filter dependencies.
{% endhint %}

***

### Next steps

* [License Family](https://developer.harness.io/software-supply-chain-assurance/use-scs/open-source-management/license-family): Categorize individual licenses into standard families to quickly understand their impact and risk.
* [OSS Risks Remediation](https://developer.harness.io/software-supply-chain-assurance/use-scs/open-source-management/oss-risks-remediation): Remediate detected open-source software (OSS) risks across your repositories and artifacts to strengthen your software supply chain security.