ProGet Documentation

License Filtering

License filtering allows users to block or allow package downloads based on license type. This ensures developers aren't violating rights of use by using packages with unapproved licenses.

This feature is available in paid and trial ProGet editions.

Known License types

License filtering works by comparing a table of Known Licenses (License URL and License ID) against the license field of a package's metadata. Users can then enable rules to bock or allow download based on license. ProGet is shipped with a table of commonly used license types, and users are able to add additional licenses to this table.

Rule Configuration

For example, many technology companies have open-source initiatives to give back to the development community. These companies have large teams for proprietary software development, and smaller teams that contribute to open-source projects. They have strict standards on the packages that can be used for proprietary development, but license restrictions for open-source projects are much more lenient.

In ProGet, they configure a global rule to block the download of packages with a GPL3 license. However, packages with GPL3 are perfectly acceptable for open-source project development. Therefore, the individual NuGet feed for the open-source team is configured to allow the download of packages with GPL3 license.

  • Global Rule
  • Feed Rule
Global license filter rule
Feed level license filter rule

License filtering can be configured on a feed-by-feed basis, and at the global level. Feed-level rules override global rules, allowing users to configure rules that fit their specific use. In the example above, you can see proprietary software development vs. open-source development.

Third-Party Integrations

ProGet integrates with WhiteSource as a license filtering solution. In WhiteSource, users are able to define polices to approve or restrict package download based on license type. When the WhiteSource extension is installed, and Package Access Rules have been configured, ProGet will verify with WhiteSource before allowing users to download.