copyleft-audit 0.1.0__tar.gz

copyleft_audit-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 copyleft-audit contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

copyleft_audit-0.1.0/PKG-INFO

@@ -0,0 +1,175 @@
+Metadata-Version: 2.4
+Name: copyleft-audit
+Version: 0.1.0
+Summary: Fail your CI build when a dependency's licence breaks policy. Detects GPL, AGPL, SSPL and LGPL in installed packages. Zero dependencies, stdlib only.
+Project-URL: Homepage, https://pypi.org/project/copyleft-audit/
+Project-URL: Changelog, https://pypi.org/project/copyleft-audit/#history
+Keywords: copyleft,gpl,agpl,lgpl,sspl,license,licence,license-compliance,license-checker,open-source-compliance,sbom,ci,audit,due-diligence,dependencies
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Legal Industry
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.8
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Topic :: System :: Software Distribution
+Classifier: Topic :: Utilities
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# copyleft-audit
+
+**Fail your CI build when a dependency's licence breaks policy.**
+Detects GPL, AGPL, SSPL, LGPL, MPL and friends in the packages actually
+installed in your environment — and exits non-zero so the pipeline stops.
+
+Zero runtime dependencies. Standard library only. It will not touch your
+dependency tree, and it makes no network calls.
+
+```bash
+pip install copyleft-audit
+copyleft-audit
+```
+
+## Why this exists
+
+`pip-licenses` and similar tools *list* licences for a human to read. That is a
+different job from *enforcing* a policy in CI. If you ship closed-source
+software, the question is not "what licences are in here" but "does the build
+stop when someone adds an AGPL package". This tool answers the second question:
+one command, an exit code, no configuration file required.
+
+Typical triggers for needing it: legal asks you to prove no copyleft code ships
+in the product; an acquirer's due-diligence checklist asks the same; or you just
+want the check to run automatically instead of once a year.
+
+## Usage
+
+```
+copyleft-audit [--fail-on {strong,weak,unknown}] [--ignore PKG[,PKG...]]
+               [--format {text,json}] [--quiet]
+```
+
+| Exit code | Meaning |
+|---|---|
+| `0` | Clean — no policy violations |
+| `1` | Policy violation |
+| `2` | Usage or internal error |
+
+GitHub Actions:
+
+```yaml
+- name: Licence gate
+  run: |
+    pip install copyleft-audit
+    copyleft-audit --fail-on strong
+```
+
+Stricter, for a product that cannot even take weak copyleft or unresolvable
+metadata:
+
+```bash
+copyleft-audit --fail-on unknown --ignore mypackage,internal-sdk
+```
+
+Machine-readable output, for feeding another tool:
+
+```bash
+copyleft-audit --format json
+```
+
+```json
+{
+  "packages":  [{"name": "...", "version": "...", "license": "...",
+                 "license_source": "...", "tier": "...", "ignored": false}],
+  "violations": ["... same shape ..."],
+  "warnings":   ["... same shape ..."],
+  "summary":   {"tool_version": "...", "fail_on": "strong", "scanned": 0,
+                "unreadable": 0, "ignored": [], "counts": {}, 
+                "violation_count": 0, "warning_count": 0, "exit_code": 0}
+}
+```
+
+The JSON schema is stable within the `0.1.x` line; new keys may be added, and
+existing keys will not change meaning without a version bump.
+
+## Risk tiers
+
+| Tier | Licences | Default |
+|---|---|---|
+| `STRONG_COPYLEFT` | GPL-2.0, GPL-3.0, AGPL-3.0, SSPL, OSL, EUPL | **fail** |
+| `WEAK_COPYLEFT` | LGPL-2.1, LGPL-3.0, MPL-2.0, EPL-2.0, CDDL, CPL | warn |
+| `PERMISSIVE` | MIT, BSD, Apache-2.0, ISC, PSF, Unlicense, CC0, Zlib, … | pass |
+| `UNKNOWN` | no resolvable licence metadata | warn |
+
+`--fail-on weak` promotes weak copyleft to a failure. `--fail-on unknown`
+promotes both weak copyleft and unknown metadata to a failure.
+
+## How it decides, precisely
+
+Licence metadata is read in this order, and the first source that resolves wins:
+`License-Expression` (PEP 639) → `License ::` trove classifiers → the free-text
+`License` field. The source used is reported in `license_source`, so you can see
+what the verdict rests on.
+
+Deliberate design choices worth knowing about:
+
+- **`UNKNOWN` is a real answer.** When metadata is missing, empty, or not
+  recognised, the tool says `UNKNOWN`. It never guesses a tier. A confident
+  wrong answer here would be worse than no answer.
+- **A package whose metadata cannot be parsed is reported as `UNKNOWN`, never
+  skipped.** Silently dropping a package would produce a false clean report.
+- **`LGPL` and `AGPL` are never read as `GPL`.** Matching is on whole tokens and
+  masked phrases, not substrings — the classic mis-tiering bug in naive
+  scanners.
+- **`MIT OR GPL-3.0` resolves to permissive**, because you may take the MIT
+  option. `AND` resolves to the stricter operand. Parenthesised SPDX expressions
+  are not parsed and are scored conservatively (highest risk wins).
+- **Multiple licence classifiers are read as a choice**, so the lowest-risk one
+  governs — but every licence string found is printed, so nothing is hidden.
+
+## Limits — please read before trusting it
+
+- It reads **declared package metadata only**. It does not scan source files,
+  vendored code, bundled binaries, or transitively linked native libraries. A
+  package that declares MIT while vendoring GPL code will read as MIT.
+- It classifies what is **installed in the current environment**, so run it in
+  the same environment your build produces.
+- **This is not legal advice**, and the output is not a legal opinion. It is a
+  metadata heuristic that helps engineers catch the obvious cases early. Real
+  licence compliance decisions belong with your counsel.
+
+## Paid: auditor-ready attestation report
+
+The tool is free and stays free — nothing is gated behind payment.
+
+If you need the output as a **document you can hand to an acquirer, an auditor,
+or your own legal team**, there is a one-time paid report for a single project:
+every installed dependency with its declared licence, the metadata field that
+licence was read from, its risk tier, and an explicit list of everything that
+came back `UNKNOWN` with what is missing. Delivered as PDF plus the raw JSON.
+$149, one project, one-time.
+
+→ **[Order the attestation report](https://buy.stripe.com/3cI8wP9libJt5Xrdd7a7C08)**
+
+Same honesty applies: the report documents declared metadata, and it is not a
+legal opinion.
+
+## Disclosure
+
+This package was written by an AI agent (Claude) operating autonomously, and is
+published and maintained under human ownership. It is deliberately small,
+dependency-free and standard-library-only so that it can be read end to end and
+verified by inspection before you trust it in a pipeline. Please do read it.
+
+Licensed MIT.

copyleft_audit-0.1.0/README.md

@@ -0,0 +1,146 @@
+# copyleft-audit
+
+**Fail your CI build when a dependency's licence breaks policy.**
+Detects GPL, AGPL, SSPL, LGPL, MPL and friends in the packages actually
+installed in your environment — and exits non-zero so the pipeline stops.
+
+Zero runtime dependencies. Standard library only. It will not touch your
+dependency tree, and it makes no network calls.
+
+```bash
+pip install copyleft-audit
+copyleft-audit
+```
+
+## Why this exists
+
+`pip-licenses` and similar tools *list* licences for a human to read. That is a
+different job from *enforcing* a policy in CI. If you ship closed-source
+software, the question is not "what licences are in here" but "does the build
+stop when someone adds an AGPL package". This tool answers the second question:
+one command, an exit code, no configuration file required.
+
+Typical triggers for needing it: legal asks you to prove no copyleft code ships
+in the product; an acquirer's due-diligence checklist asks the same; or you just
+want the check to run automatically instead of once a year.
+
+## Usage
+
+```
+copyleft-audit [--fail-on {strong,weak,unknown}] [--ignore PKG[,PKG...]]
+               [--format {text,json}] [--quiet]
+```
+
+| Exit code | Meaning |
+|---|---|
+| `0` | Clean — no policy violations |
+| `1` | Policy violation |
+| `2` | Usage or internal error |
+
+GitHub Actions:
+
+```yaml
+- name: Licence gate
+  run: |
+    pip install copyleft-audit
+    copyleft-audit --fail-on strong
+```
+
+Stricter, for a product that cannot even take weak copyleft or unresolvable
+metadata:
+
+```bash
+copyleft-audit --fail-on unknown --ignore mypackage,internal-sdk
+```
+
+Machine-readable output, for feeding another tool:
+
+```bash
+copyleft-audit --format json
+```
+
+```json
+{
+  "packages":  [{"name": "...", "version": "...", "license": "...",
+                 "license_source": "...", "tier": "...", "ignored": false}],
+  "violations": ["... same shape ..."],
+  "warnings":   ["... same shape ..."],
+  "summary":   {"tool_version": "...", "fail_on": "strong", "scanned": 0,
+                "unreadable": 0, "ignored": [], "counts": {}, 
+                "violation_count": 0, "warning_count": 0, "exit_code": 0}
+}
+```
+
+The JSON schema is stable within the `0.1.x` line; new keys may be added, and
+existing keys will not change meaning without a version bump.
+
+## Risk tiers
+
+| Tier | Licences | Default |
+|---|---|---|
+| `STRONG_COPYLEFT` | GPL-2.0, GPL-3.0, AGPL-3.0, SSPL, OSL, EUPL | **fail** |
+| `WEAK_COPYLEFT` | LGPL-2.1, LGPL-3.0, MPL-2.0, EPL-2.0, CDDL, CPL | warn |
+| `PERMISSIVE` | MIT, BSD, Apache-2.0, ISC, PSF, Unlicense, CC0, Zlib, … | pass |
+| `UNKNOWN` | no resolvable licence metadata | warn |
+
+`--fail-on weak` promotes weak copyleft to a failure. `--fail-on unknown`
+promotes both weak copyleft and unknown metadata to a failure.
+
+## How it decides, precisely
+
+Licence metadata is read in this order, and the first source that resolves wins:
+`License-Expression` (PEP 639) → `License ::` trove classifiers → the free-text
+`License` field. The source used is reported in `license_source`, so you can see
+what the verdict rests on.
+
+Deliberate design choices worth knowing about:
+
+- **`UNKNOWN` is a real answer.** When metadata is missing, empty, or not
+  recognised, the tool says `UNKNOWN`. It never guesses a tier. A confident
+  wrong answer here would be worse than no answer.
+- **A package whose metadata cannot be parsed is reported as `UNKNOWN`, never
+  skipped.** Silently dropping a package would produce a false clean report.
+- **`LGPL` and `AGPL` are never read as `GPL`.** Matching is on whole tokens and
+  masked phrases, not substrings — the classic mis-tiering bug in naive
+  scanners.
+- **`MIT OR GPL-3.0` resolves to permissive**, because you may take the MIT
+  option. `AND` resolves to the stricter operand. Parenthesised SPDX expressions
+  are not parsed and are scored conservatively (highest risk wins).
+- **Multiple licence classifiers are read as a choice**, so the lowest-risk one
+  governs — but every licence string found is printed, so nothing is hidden.
+
+## Limits — please read before trusting it
+
+- It reads **declared package metadata only**. It does not scan source files,
+  vendored code, bundled binaries, or transitively linked native libraries. A
+  package that declares MIT while vendoring GPL code will read as MIT.
+- It classifies what is **installed in the current environment**, so run it in
+  the same environment your build produces.
+- **This is not legal advice**, and the output is not a legal opinion. It is a
+  metadata heuristic that helps engineers catch the obvious cases early. Real
+  licence compliance decisions belong with your counsel.
+
+## Paid: auditor-ready attestation report
+
+The tool is free and stays free — nothing is gated behind payment.
+
+If you need the output as a **document you can hand to an acquirer, an auditor,
+or your own legal team**, there is a one-time paid report for a single project:
+every installed dependency with its declared licence, the metadata field that
+licence was read from, its risk tier, and an explicit list of everything that
+came back `UNKNOWN` with what is missing. Delivered as PDF plus the raw JSON.
+$149, one project, one-time.
+
+→ **[Order the attestation report](https://buy.stripe.com/3cI8wP9libJt5Xrdd7a7C08)**
+
+Same honesty applies: the report documents declared metadata, and it is not a
+legal opinion.
+
+## Disclosure
+
+This package was written by an AI agent (Claude) operating autonomously, and is
+published and maintained under human ownership. It is deliberately small,
+dependency-free and standard-library-only so that it can be read end to end and
+verified by inspection before you trust it in a pipeline. Please do read it.
+
+Licensed MIT.

copyleft_audit-0.1.0/copyleft_audit/__init__.py

@@ -0,0 +1,30 @@
+"""copyleft-audit: fail a CI build when a dependency's licence breaks policy.
+
+Zero runtime dependencies, standard library only. This is a metadata-based
+heuristic aid for engineers, not legal advice.
+"""
+
+from __future__ import annotations
+
+__version__ = "0.1.0"
+
+from .classify import (  # noqa: F401
+    PERMISSIVE,
+    STRONG_COPYLEFT,
+    TIER_RISK,
+    UNKNOWN,
+    WEAK_COPYLEFT,
+    classify_metadata,
+    classify_text,
+)
+
+__all__ = [
+    "__version__",
+    "STRONG_COPYLEFT",
+    "WEAK_COPYLEFT",
+    "PERMISSIVE",
+    "UNKNOWN",
+    "TIER_RISK",
+    "classify_text",
+    "classify_metadata",
+]

copyleft_audit-0.1.0/copyleft_audit/__main__.py

@@ -0,0 +1,10 @@
+"""Allow `python -m copyleft_audit` as well as the console script."""
+
+from __future__ import annotations
+
+import sys
+
+from .cli import main
+
+if __name__ == "__main__":
+    sys.exit(main())

copyleft_audit-0.1.0/copyleft_audit/classify.py

@@ -0,0 +1,256 @@
+"""Classify a licence string into a copyleft risk tier.
+
+Pure standard library. This module performs no I/O of any kind: no network
+access, no filesystem access, no subprocesses. It is a *metadata heuristic*
+and not a legal determination.
+
+Design rules, in order of importance:
+
+1. Never guess. If a licence string is absent, empty, or not recognised, the
+   answer is ``UNKNOWN``. A confident wrong answer is worse than no answer.
+2. Be conservative inside a single licence name: if several markers appear in
+   one string, the highest-risk one wins.
+3. Treat an SPDX ``OR`` as a genuine choice: ``MIT OR GPL-3.0`` resolves to the
+   lowest-risk operand, because the user may take that operand. ``AND``
+   resolves to the highest-risk operand.
+4. Never rely on substring matching for ``GPL``. ``AGPL`` and ``LGPL`` both
+   contain the substring ``GPL`` and mis-tiering them is the classic failure
+   of naive licence scanners. Matching here is on whole tokens and on masked
+   phrases, so ``LGPL`` can never be read as ``GPL``.
+"""
+
+from __future__ import annotations
+
+import re
+
+__all__ = [
+    "STRONG_COPYLEFT",
+    "WEAK_COPYLEFT",
+    "PERMISSIVE",
+    "UNKNOWN",
+    "TIER_RISK",
+    "classify_text",
+    "classify_metadata",
+]
+
+STRONG_COPYLEFT = "STRONG_COPYLEFT"
+WEAK_COPYLEFT = "WEAK_COPYLEFT"
+PERMISSIVE = "PERMISSIVE"
+UNKNOWN = "UNKNOWN"
+
+#: Ordering used by min()/max(). UNKNOWN sits between permissive and weak so
+#: that it sorts sensibly, but it is excluded from every comparison that
+#: resolves an expression -- see _known().
+TIER_RISK = {PERMISSIVE: 0, UNKNOWN: 1, WEAK_COPYLEFT: 2, STRONG_COPYLEFT: 3}
+
+#: Some projects paste an entire licence text into the free-text ``License``
+#: metadata field. Only the head of such a blob is classified, because the body
+#: of the LGPL quotes the GPL repeatedly and would otherwise mis-tier.
+MAX_TEXT = 300
+
+# Phrases are matched most-specific-first and masked out once matched, so that
+# "Lesser General Public License" can never also fire "General Public License".
+_PHRASES = (
+    ("AFFERO GENERAL PUBLIC LICENSE", STRONG_COPYLEFT),
+    ("SERVER SIDE PUBLIC LICENSE", STRONG_COPYLEFT),
+    ("OPEN SOFTWARE LICENSE", STRONG_COPYLEFT),
+    ("EUROPEAN UNION PUBLIC LICENCE", STRONG_COPYLEFT),
+    ("EUROPEAN UNION PUBLIC LICENSE", STRONG_COPYLEFT),
+    ("LESSER GENERAL PUBLIC LICENSE", WEAK_COPYLEFT),
+    ("LIBRARY GENERAL PUBLIC LICENSE", WEAK_COPYLEFT),
+    ("GENERAL PUBLIC LICENSE", STRONG_COPYLEFT),
+    ("MOZILLA PUBLIC LICENSE", WEAK_COPYLEFT),
+    ("ECLIPSE PUBLIC LICENSE", WEAK_COPYLEFT),
+    ("COMMON DEVELOPMENT AND DISTRIBUTION LICENSE", WEAK_COPYLEFT),
+    ("COMMON PUBLIC LICENSE", WEAK_COPYLEFT),
+    ("PYTHON SOFTWARE FOUNDATION LICENSE", PERMISSIVE),
+    ("APACHE SOFTWARE LICENSE", PERMISSIVE),
+    ("BOOST SOFTWARE LICENSE", PERMISSIVE),
+    ("UNIVERSAL PERMISSIVE LICENSE", PERMISSIVE),
+    ("HISTORICAL PERMISSION NOTICE", PERMISSIVE),
+    ("ZOPE PUBLIC LICENSE", PERMISSIVE),
+    ("ACADEMIC FREE LICENSE", PERMISSIVE),
+    ("PUBLIC DOMAIN", PERMISSIVE),
+    ("BSD LICENSE", PERMISSIVE),
+    ("MIT LICENSE", PERMISSIVE),
+    ("MIT NO ATTRIBUTION", PERMISSIVE),
+)
+
+# Whole-token markers, applied after digits are stripped and a trailing "v"
+# (as in GPLv3 -> GPLV -> GPL) is removed.
+_WORDS = {
+    "AGPL": STRONG_COPYLEFT,
+    "SSPL": STRONG_COPYLEFT,
+    "OSL": STRONG_COPYLEFT,
+    "EUPL": STRONG_COPYLEFT,
+    "LGPL": WEAK_COPYLEFT,
+    "GPL": STRONG_COPYLEFT,
+    "MPL": WEAK_COPYLEFT,
+    "EPL": WEAK_COPYLEFT,
+    "CDDL": WEAK_COPYLEFT,
+    "CPL": WEAK_COPYLEFT,
+    "MIT": PERMISSIVE,
+    "BSD": PERMISSIVE,
+    "APACHE": PERMISSIVE,
+    "ISC": PERMISSIVE,
+    "PSF": PERMISSIVE,
+    "NCSA": PERMISSIVE,
+    "AFL": PERMISSIVE,
+    "ZLIB": PERMISSIVE,
+    "UNLICENSE": PERMISSIVE,
+    "WTFPL": PERMISSIVE,
+    "POSTGRESQL": PERMISSIVE,
+}
+
+# Tokens whose digits are meaningful and must not be stripped. "CC" on its own
+# is deliberately absent: CC0 is a public-domain dedication, but CC-BY-NC is
+# not a permissive software licence, so anything else Creative Commons stays
+# UNKNOWN rather than being guessed at.
+_EXACT_TOKENS = {"CC0": PERMISSIVE}
+
+_OR_RE = re.compile(r"\s+OR\s+", re.IGNORECASE)
+_AND_RE = re.compile(r"\s+AND\s+", re.IGNORECASE)
+_WITH_RE = re.compile(r"\s+WITH\s+.*$", re.IGNORECASE | re.DOTALL)
+_TOKEN_RE = re.compile(r"[A-Z0-9]+")
+_NON_ALPHA_RE = re.compile(r"[^A-Z]+")
+_DIGIT_RE = re.compile(r"[0-9]")
+
+
+def _known(tiers):
+    """Drop UNKNOWN, which must never win a min()/max() against a real tier."""
+    return [t for t in tiers if t != UNKNOWN]
+
+
+def _norm_token(token):
+    """GPLV3 -> GPL, 0BSD -> BSD, LGPL-2.1 -> LGPL."""
+    stripped = _DIGIT_RE.sub("", token)
+    if stripped.endswith("V"):
+        stripped = stripped[:-1]
+    return stripped
+
+
+def _atom_tier(text):
+    """Highest-risk tier detectable within a single licence name.
+
+    Conservative on purpose: within one name, any strong-copyleft marker wins.
+    """
+    upper = text.upper()
+    found = []
+
+    for token in _TOKEN_RE.findall(upper):
+        if token in _EXACT_TOKENS:
+            found.append(_EXACT_TOKENS[token])
+
+    norm = " " + " ".join(_NON_ALPHA_RE.sub(" ", upper).split()) + " "
+    for phrase, tier in _PHRASES:
+        padded = " " + phrase + " "
+        if padded in norm:
+            found.append(tier)
+            norm = norm.replace(padded, " ")
+
+    for token in norm.split():
+        word = _norm_token(token)
+        if word in _WORDS:
+            found.append(_WORDS[word])
+
+    known = _known(found)
+    if not known:
+        return UNKNOWN
+    return max(known, key=lambda t: TIER_RISK[t])
+
+
+def _conjunction_tier(text):
+    """Resolve an SPDX AND: the strictest operand governs."""
+    tiers = [_atom_tier(_WITH_RE.sub("", part)) for part in _AND_RE.split(text)]
+    known = _known(tiers)
+    if not known:
+        return UNKNOWN
+    return max(known, key=lambda t: TIER_RISK[t])
+
+
+def classify_text(text):
+    """Classify one licence string. Returns a tier constant.
+
+    Handles whitespace-delimited SPDX ``OR`` / ``AND`` operators. Parenthesised
+    expressions are not parsed -- SPDX grouping is out of scope for a
+    dependency-free heuristic -- so a string containing parentheses is scored
+    conservatively as a single atom (highest risk wins). This is also what
+    makes PyPI trove classifiers such as
+    ``GNU General Public License v3 (GPLv3)`` behave correctly.
+    """
+    if not text:
+        return UNKNOWN
+    raw = text.strip()
+    if not raw:
+        return UNKNOWN
+    if len(raw) > MAX_TEXT:
+        raw = raw[:MAX_TEXT]
+    if "(" in raw or ")" in raw:
+        return _atom_tier(raw)
+    tiers = [_conjunction_tier(part) for part in _OR_RE.split(raw)]
+    known = _known(tiers)
+    if not known:
+        return UNKNOWN
+    return min(known, key=lambda t: TIER_RISK[t])
+
+
+def _classifier_tail(classifier):
+    """'License :: OSI Approved :: MIT License' -> 'MIT License'."""
+    parts = [p.strip() for p in classifier.split("::")]
+    return parts[-1] if parts else ""
+
+
+def _shorten(text, limit=120):
+    flat = " ".join((text or "").split())
+    if len(flat) <= limit:
+        return flat
+    return flat[: limit - 3] + "..."
+
+
+def classify_metadata(expression=None, classifiers=None, license_field=None):
+    """Classify one distribution from its metadata fields.
+
+    Sources are consulted in the order defined by PEP 639 practice:
+    ``License-Expression`` first, then ``License ::`` trove classifiers, then
+    the free-text ``License`` field. The first source that yields anything
+    other than UNKNOWN wins.
+
+    Several licence classifiers on one distribution are read as a disjunction
+    (the project offers a choice), so the lowest-risk one governs -- but every
+    licence string found is returned for display, so nothing is hidden from
+    the reader.
+
+    Returns ``(tier, licence_string, source)``.
+    """
+    if expression and expression.strip():
+        tier = classify_text(expression)
+        if tier != UNKNOWN:
+            return tier, _shorten(expression), "License-Expression"
+
+    licence_classifiers = [
+        c for c in (classifiers or [])
+        if c and c.strip().upper().startswith("LICENSE ::")
+    ]
+    if licence_classifiers:
+        tails = [_classifier_tail(c) for c in licence_classifiers]
+        tiers = [classify_text(t) for t in tails]
+        known = _known(tiers)
+        if known:
+            tier = min(known, key=lambda t: TIER_RISK[t])
+            return tier, _shorten("; ".join(tails)), "Classifier"
+
+    if license_field and license_field.strip():
+        tier = classify_text(license_field)
+        if tier != UNKNOWN:
+            return tier, _shorten(license_field), "License"
+
+    # Nothing conclusive. Show whatever was declared so a human can judge.
+    if licence_classifiers:
+        shown = _shorten("; ".join(_classifier_tail(c) for c in licence_classifiers))
+    elif license_field and license_field.strip():
+        shown = _shorten(license_field)
+    elif expression and expression.strip():
+        shown = _shorten(expression)
+    else:
+        shown = ""
+    return UNKNOWN, shown, "none"

copyleft_audit-0.1.0/copyleft_audit/cli.py

@@ -0,0 +1,286 @@
+"""Command-line interface for copyleft-audit.
+
+Reads the licence metadata of the distributions installed in the current
+environment and exits non-zero when one of them breaks the configured policy.
+Intended to be dropped into a CI job. Standard library only.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import re
+import sys
+
+from . import __version__
+from .classify import (
+    PERMISSIVE,
+    STRONG_COPYLEFT,
+    UNKNOWN,
+    WEAK_COPYLEFT,
+    classify_metadata,
+)
+
+try:  # Python 3.8+
+    from importlib import metadata as importlib_metadata
+except ImportError:  # pragma: no cover
+    importlib_metadata = None
+
+EXIT_OK = 0
+EXIT_VIOLATION = 1
+EXIT_ERROR = 2
+
+FAIL_ON_TIERS = {
+    "strong": (STRONG_COPYLEFT,),
+    "weak": (STRONG_COPYLEFT, WEAK_COPYLEFT),
+    "unknown": (STRONG_COPYLEFT, WEAK_COPYLEFT, UNKNOWN),
+}
+
+TIER_ORDER_FOR_DISPLAY = (STRONG_COPYLEFT, WEAK_COPYLEFT, UNKNOWN, PERMISSIVE)
+
+_NAME_NORM_RE = re.compile(r"[-_.]+")
+
+
+def normalize_name(name):
+    """PEP 503 name normalisation."""
+    return _NAME_NORM_RE.sub("-", (name or "").strip()).lower()
+
+
+def _get(metadata, key):
+    try:
+        return metadata.get(key)
+    except Exception:
+        return None
+
+
+def _get_all(metadata, key):
+    try:
+        return metadata.get_all(key) or []
+    except Exception:
+        return []
+
+
+def collect_packages():
+    """Return (packages, unreadable_count) for the current environment.
+
+    A distribution whose metadata cannot be parsed is reported as UNKNOWN
+    rather than skipped. Silently dropping a package would produce a false
+    clean report, which is the single worst outcome for a tool like this.
+    """
+    if importlib_metadata is None:
+        raise RuntimeError("importlib.metadata is unavailable; Python 3.8+ is required")
+
+    seen = {}
+    unreadable = 0
+    for dist in importlib_metadata.distributions():
+        try:
+            metadata = dist.metadata
+            name = _get(metadata, "Name") if metadata is not None else None
+        except Exception:
+            unreadable += 1
+            continue
+        if not name:
+            unreadable += 1
+            continue
+        key = normalize_name(name)
+        if key in seen:
+            continue
+        try:
+            tier, licence, source = classify_metadata(
+                expression=_get(metadata, "License-Expression"),
+                classifiers=_get_all(metadata, "Classifier"),
+                license_field=_get(metadata, "License"),
+            )
+            version = _get(metadata, "Version") or ""
+        except Exception:
+            tier, licence, source, version = UNKNOWN, "", "unreadable", ""
+            unreadable += 1
+        seen[key] = {
+            "name": name,
+            "version": version,
+            "license": licence,
+            "license_source": source,
+            "tier": tier,
+            "ignored": False,
+        }
+    return [seen[k] for k in sorted(seen)], unreadable
+
+
+def build_parser():
+    parser = argparse.ArgumentParser(
+        prog="copyleft-audit",
+        description=(
+            "Fail the build when an installed dependency's licence breaks policy. "
+            "Reads declared package metadata only. This is an engineering "
+            "heuristic, not legal advice."
+        ),
+        epilog="Exit codes: 0 clean, 1 policy violation, 2 usage or internal error.",
+    )
+    parser.add_argument(
+        "--fail-on",
+        choices=("strong", "weak", "unknown"),
+        default="strong",
+        help=(
+            "Lowest tier that fails the build. 'strong' (default) fails only on "
+            "strong copyleft; 'weak' also fails on weak copyleft; 'unknown' also "
+            "fails on packages with no resolvable licence metadata."
+        ),
+    )
+    parser.add_argument(
+        "--ignore",
+        default="",
+        metavar="PKG[,PKG...]",
+        help="Comma-separated distribution names to exempt from the policy check.",
+    )
+    parser.add_argument(
+        "--format",
+        dest="fmt",
+        choices=("text", "json"),
+        default="text",
+        help="Output format. 'json' emits a stable machine-readable schema.",
+    )
+    parser.add_argument(
+        "--quiet",
+        action="store_true",
+        help="Print only violations. A clean run prints nothing.",
+    )
+    parser.add_argument(
+        "--version",
+        action="version",
+        version="copyleft-audit " + __version__,
+    )
+    return parser
+
+
+def _render_text(stream, packages, violations, warnings, summary, quiet):
+    if not quiet:
+        stream.write(
+            "copyleft-audit %s | policy: fail on %s | %d distributions scanned\n"
+            % (__version__, summary["fail_on"], summary["scanned"])
+        )
+        counts = summary["counts"]
+        stream.write(
+            "  strong=%d  weak=%d  unknown=%d  permissive=%d\n"
+            % (
+                counts[STRONG_COPYLEFT],
+                counts[WEAK_COPYLEFT],
+                counts[UNKNOWN],
+                counts[PERMISSIVE],
+            )
+        )
+        if summary["unreadable"]:
+            stream.write(
+                "  note: %d distribution(s) had unreadable metadata and are "
+                "reported as UNKNOWN\n" % summary["unreadable"]
+            )
+        stream.write("\n")
+
+    if violations:
+        stream.write("VIOLATIONS (%d)\n" % len(violations))
+        for pkg in violations:
+            stream.write(
+                "  %-28s %-12s %-16s %s\n"
+                % (
+                    pkg["name"][:28],
+                    pkg["version"][:12],
+                    pkg["tier"],
+                    pkg["license"] or "<no licence metadata>",
+                )
+            )
+        stream.write("\n")
+
+    if warnings and not quiet:
+        stream.write("WARNINGS, not failing under this policy (%d)\n" % len(warnings))
+        for pkg in warnings:
+            stream.write(
+                "  %-28s %-12s %-16s %s\n"
+                % (
+                    pkg["name"][:28],
+                    pkg["version"][:12],
+                    pkg["tier"],
+                    pkg["license"] or "<no licence metadata>",
+                )
+            )
+        stream.write("\n")
+
+    if not quiet:
+        if violations:
+            stream.write("RESULT: FAIL - %d policy violation(s).\n" % len(violations))
+        else:
+            stream.write("RESULT: PASS - no policy violations.\n")
+        stream.write(
+            "Declared metadata only; no source scanning. Not legal advice.\n"
+        )
+
+
+def main(argv=None):
+    parser = build_parser()
+    try:
+        args = parser.parse_args(argv)
+    except SystemExit as exc:  # --help / --version / usage error
+        code = exc.code
+        return code if isinstance(code, int) else EXIT_ERROR
+
+    ignored = set()
+    for item in args.ignore.split(","):
+        if item.strip():
+            ignored.add(normalize_name(item))
+
+    try:
+        packages, unreadable = collect_packages()
+    except Exception as exc:  # pragma: no cover
+        sys.stderr.write("copyleft-audit: internal error: %s\n" % exc)
+        return EXIT_ERROR
+
+    fail_tiers = FAIL_ON_TIERS[args.fail_on]
+    counts = {STRONG_COPYLEFT: 0, WEAK_COPYLEFT: 0, UNKNOWN: 0, PERMISSIVE: 0}
+    violations = []
+    warnings = []
+    for pkg in packages:
+        counts[pkg["tier"]] = counts.get(pkg["tier"], 0) + 1
+        pkg["ignored"] = normalize_name(pkg["name"]) in ignored
+        if pkg["tier"] == PERMISSIVE:
+            continue
+        if pkg["ignored"]:
+            continue
+        if pkg["tier"] in fail_tiers:
+            violations.append(pkg)
+        else:
+            warnings.append(pkg)
+
+    def _sort_key(pkg):
+        return (TIER_ORDER_FOR_DISPLAY.index(pkg["tier"]), normalize_name(pkg["name"]))
+
+    violations.sort(key=_sort_key)
+    warnings.sort(key=_sort_key)
+
+    exit_code = EXIT_VIOLATION if violations else EXIT_OK
+    summary = {
+        "tool": "copyleft-audit",
+        "tool_version": __version__,
+        "fail_on": args.fail_on,
+        "scanned": len(packages),
+        "unreadable": unreadable,
+        "ignored": sorted(ignored),
+        "counts": counts,
+        "violation_count": len(violations),
+        "warning_count": len(warnings),
+        "exit_code": exit_code,
+    }
+
+    if args.fmt == "json":
+        payload = {
+            "packages": packages,
+            "violations": violations,
+            "warnings": warnings,
+            "summary": summary,
+        }
+        sys.stdout.write(json.dumps(payload, indent=2, sort_keys=True) + "\n")
+    else:
+        _render_text(sys.stdout, packages, violations, warnings, summary, args.quiet)
+
+    return exit_code
+
+
+if __name__ == "__main__":  # pragma: no cover
+    sys.exit(main())

copyleft_audit-0.1.0/copyleft_audit.egg-info/PKG-INFO

@@ -0,0 +1,175 @@
+Metadata-Version: 2.4
+Name: copyleft-audit
+Version: 0.1.0
+Summary: Fail your CI build when a dependency's licence breaks policy. Detects GPL, AGPL, SSPL and LGPL in installed packages. Zero dependencies, stdlib only.
+Project-URL: Homepage, https://pypi.org/project/copyleft-audit/
+Project-URL: Changelog, https://pypi.org/project/copyleft-audit/#history
+Keywords: copyleft,gpl,agpl,lgpl,sspl,license,licence,license-compliance,license-checker,open-source-compliance,sbom,ci,audit,due-diligence,dependencies
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Legal Industry
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.8
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Topic :: System :: Software Distribution
+Classifier: Topic :: Utilities
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# copyleft-audit
+
+**Fail your CI build when a dependency's licence breaks policy.**
+Detects GPL, AGPL, SSPL, LGPL, MPL and friends in the packages actually
+installed in your environment — and exits non-zero so the pipeline stops.
+
+Zero runtime dependencies. Standard library only. It will not touch your
+dependency tree, and it makes no network calls.
+
+```bash
+pip install copyleft-audit
+copyleft-audit
+```
+
+## Why this exists
+
+`pip-licenses` and similar tools *list* licences for a human to read. That is a
+different job from *enforcing* a policy in CI. If you ship closed-source
+software, the question is not "what licences are in here" but "does the build
+stop when someone adds an AGPL package". This tool answers the second question:
+one command, an exit code, no configuration file required.
+
+Typical triggers for needing it: legal asks you to prove no copyleft code ships
+in the product; an acquirer's due-diligence checklist asks the same; or you just
+want the check to run automatically instead of once a year.
+
+## Usage
+
+```
+copyleft-audit [--fail-on {strong,weak,unknown}] [--ignore PKG[,PKG...]]
+               [--format {text,json}] [--quiet]
+```
+
+| Exit code | Meaning |
+|---|---|
+| `0` | Clean — no policy violations |
+| `1` | Policy violation |
+| `2` | Usage or internal error |
+
+GitHub Actions:
+
+```yaml
+- name: Licence gate
+  run: |
+    pip install copyleft-audit
+    copyleft-audit --fail-on strong
+```
+
+Stricter, for a product that cannot even take weak copyleft or unresolvable
+metadata:
+
+```bash
+copyleft-audit --fail-on unknown --ignore mypackage,internal-sdk
+```
+
+Machine-readable output, for feeding another tool:
+
+```bash
+copyleft-audit --format json
+```
+
+```json
+{
+  "packages":  [{"name": "...", "version": "...", "license": "...",
+                 "license_source": "...", "tier": "...", "ignored": false}],
+  "violations": ["... same shape ..."],
+  "warnings":   ["... same shape ..."],
+  "summary":   {"tool_version": "...", "fail_on": "strong", "scanned": 0,
+                "unreadable": 0, "ignored": [], "counts": {}, 
+                "violation_count": 0, "warning_count": 0, "exit_code": 0}
+}
+```
+
+The JSON schema is stable within the `0.1.x` line; new keys may be added, and
+existing keys will not change meaning without a version bump.
+
+## Risk tiers
+
+| Tier | Licences | Default |
+|---|---|---|
+| `STRONG_COPYLEFT` | GPL-2.0, GPL-3.0, AGPL-3.0, SSPL, OSL, EUPL | **fail** |
+| `WEAK_COPYLEFT` | LGPL-2.1, LGPL-3.0, MPL-2.0, EPL-2.0, CDDL, CPL | warn |
+| `PERMISSIVE` | MIT, BSD, Apache-2.0, ISC, PSF, Unlicense, CC0, Zlib, … | pass |
+| `UNKNOWN` | no resolvable licence metadata | warn |
+
+`--fail-on weak` promotes weak copyleft to a failure. `--fail-on unknown`
+promotes both weak copyleft and unknown metadata to a failure.
+
+## How it decides, precisely
+
+Licence metadata is read in this order, and the first source that resolves wins:
+`License-Expression` (PEP 639) → `License ::` trove classifiers → the free-text
+`License` field. The source used is reported in `license_source`, so you can see
+what the verdict rests on.
+
+Deliberate design choices worth knowing about:
+
+- **`UNKNOWN` is a real answer.** When metadata is missing, empty, or not
+  recognised, the tool says `UNKNOWN`. It never guesses a tier. A confident
+  wrong answer here would be worse than no answer.
+- **A package whose metadata cannot be parsed is reported as `UNKNOWN`, never
+  skipped.** Silently dropping a package would produce a false clean report.
+- **`LGPL` and `AGPL` are never read as `GPL`.** Matching is on whole tokens and
+  masked phrases, not substrings — the classic mis-tiering bug in naive
+  scanners.
+- **`MIT OR GPL-3.0` resolves to permissive**, because you may take the MIT
+  option. `AND` resolves to the stricter operand. Parenthesised SPDX expressions
+  are not parsed and are scored conservatively (highest risk wins).
+- **Multiple licence classifiers are read as a choice**, so the lowest-risk one
+  governs — but every licence string found is printed, so nothing is hidden.
+
+## Limits — please read before trusting it
+
+- It reads **declared package metadata only**. It does not scan source files,
+  vendored code, bundled binaries, or transitively linked native libraries. A
+  package that declares MIT while vendoring GPL code will read as MIT.
+- It classifies what is **installed in the current environment**, so run it in
+  the same environment your build produces.
+- **This is not legal advice**, and the output is not a legal opinion. It is a
+  metadata heuristic that helps engineers catch the obvious cases early. Real
+  licence compliance decisions belong with your counsel.
+
+## Paid: auditor-ready attestation report
+
+The tool is free and stays free — nothing is gated behind payment.
+
+If you need the output as a **document you can hand to an acquirer, an auditor,
+or your own legal team**, there is a one-time paid report for a single project:
+every installed dependency with its declared licence, the metadata field that
+licence was read from, its risk tier, and an explicit list of everything that
+came back `UNKNOWN` with what is missing. Delivered as PDF plus the raw JSON.
+$149, one project, one-time.
+
+→ **[Order the attestation report](https://buy.stripe.com/3cI8wP9libJt5Xrdd7a7C08)**
+
+Same honesty applies: the report documents declared metadata, and it is not a
+legal opinion.
+
+## Disclosure
+
+This package was written by an AI agent (Claude) operating autonomously, and is
+published and maintained under human ownership. It is deliberately small,
+dependency-free and standard-library-only so that it can be read end to end and
+verified by inspection before you trust it in a pipeline. Please do read it.
+
+Licensed MIT.

copyleft_audit-0.1.0/copyleft_audit.egg-info/SOURCES.txt

@@ -0,0 +1,12 @@
+LICENSE
+README.md
+pyproject.toml
+copyleft_audit/__init__.py
+copyleft_audit/__main__.py
+copyleft_audit/classify.py
+copyleft_audit/cli.py
+copyleft_audit.egg-info/PKG-INFO
+copyleft_audit.egg-info/SOURCES.txt
+copyleft_audit.egg-info/dependency_links.txt
+copyleft_audit.egg-info/entry_points.txt
+copyleft_audit.egg-info/top_level.txt

copyleft_audit-0.1.0/copyleft_audit.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

copyleft_audit-0.1.0/copyleft_audit.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+copyleft-audit = copyleft_audit.cli:main

copyleft_audit-0.1.0/copyleft_audit.egg-info/top_level.txt

@@ -0,0 +1 @@
+copyleft_audit

copyleft_audit-0.1.0/pyproject.toml

@@ -0,0 +1,56 @@
+[build-system]
+requires = ["setuptools>=61.0"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "copyleft-audit"
+version = "0.1.0"
+description = "Fail your CI build when a dependency's licence breaks policy. Detects GPL, AGPL, SSPL and LGPL in installed packages. Zero dependencies, stdlib only."
+readme = "README.md"
+requires-python = ">=3.8"
+keywords = [
+    "copyleft",
+    "gpl",
+    "agpl",
+    "lgpl",
+    "sspl",
+    "license",
+    "licence",
+    "license-compliance",
+    "license-checker",
+    "open-source-compliance",
+    "sbom",
+    "ci",
+    "audit",
+    "due-diligence",
+    "dependencies",
+]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Environment :: Console",
+    "Intended Audience :: Developers",
+    "Intended Audience :: Legal Industry",
+    "License :: OSI Approved :: MIT License",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.8",
+    "Programming Language :: Python :: 3.9",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3 :: Only",
+    "Topic :: Software Development :: Quality Assurance",
+    "Topic :: System :: Software Distribution",
+    "Topic :: Utilities",
+]
+
+[project.urls]
+Homepage = "https://pypi.org/project/copyleft-audit/"
+Changelog = "https://pypi.org/project/copyleft-audit/#history"
+
+[project.scripts]
+copyleft-audit = "copyleft_audit.cli:main"
+
+[tool.setuptools]
+packages = ["copyleft_audit"]

copyleft_audit-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+