License Scanning with Trivy

Kreate's license scanning integration allows you to automatically verify the licenses of your project's dependencies against a list of forbidden or restricted licenses. This is critical in commercial environments to ensure legal compliance (e.g., avoiding "copyleft" licenses like GPL in proprietary software).

How it Works

The license { } block defines how Trivy analyzes your project for license compliance. Trivy specifically analyzes the .lockfile files generated by Gradle.

Configuration Example

kreate {
    project {
        trivy {
            enabled.set(true)
            license {
                // Fail the build if a forbidden license is found
                failOnForbidden.set(true)

                // Define which severities should be reported
                severity.set(listOf(
                    LicenseSeverity.CRITICAL,
                    LicenseSeverity.HIGH,
                    LicenseSeverity.UNKNOWN
                ))

                // Licenses that are explicitly allowed, even if Trivy flags them
                ignoredLicenses.set(listOf("MIT", "Apache-2.0"))
            }
        }
    }
}

License Evaluation Details

Trivy categorizes licenses based on its internal rules into several severity levels.

Severity	Meaning
`CRITICAL`	Highly restrictive licenses (e.g., AGPL) that often pose a high risk.
`HIGH`	Restrictive licenses (e.g., GPL, LGPL).
`MEDIUM`	Licenses with certain conditions (e.g., MPL).
`LOW`	Permissive licenses (e.g., BSD).
`UNKNOWN`	Licenses that Trivy cannot uniquely identify or categorize.

Tips & Best Practices

Lockfile Management: Kreate relies on Gradle lockfiles for license scanning. You must manually enable dependency locking and generate lockfiles using ./gradlew dependencies --write-locks.
Handling "Unknown": Licenses are often marked as UNKNOWN if metadata in Maven Central is incomplete. Verify these manually and add them to ignoredLicenses if they are acceptable.
Gradual Adoption: For existing projects, start with failOnForbidden.set(false) to identify issues without breaking the build, then fix or ignore them before enforcing compliance.

How to Run

To execute the license scan individually, use the following Gradle command:

./gradlew trivyLicenseScan

Alternatively, the scan is automatically included when running the lifecycle task:

./gradlew check

06 May 2026