licensecheck

Import licensecheck reports in JSON format. Unlike a plain licence inventory, licensecheck evaluates each dependency’s licence for compatibility with the project’s own licence.

Generate a report with:

licensecheck -f json > licensecheck.json

Severity Mapping#

licensecheck assigns no severity, but it does make a compatibility judgement per dependency, and DefectDojo maps that:

An incompatible licence is a genuine compliance finding — shipping the dependency may violate the project’s own distribution terms. Compatible dependencies are recorded as informational inventory, with the licence in vuln_id_from_tool.

DefectDojo does not decide your licence policy; licensecheck’s own compatibility matrix does. If your policy differs, triage on the recorded licence after import.

Sample Scan Data#

Sample licensecheck scans can be found here.

Default Deduplication Hashcode Fields#

By default, DefectDojo identifies duplicate Findings using these hashcode fields:

• component_name
• component_version
• vuln_id_from_tool