Skip to content

PHP#

What licenseal reads in a Composer project. The rules that hold for every ecosystem are under How a scan works.

  • Registry: Packagist, asked only for what composer.lock does not give
  • Manifests: composer.json
  • Lockfiles: composer.lock

What is read#

  • The license of a locked package is read from the license field of its composer.lock entry, and from Packagist when the entry has none or there is no lockfile.
  • A locked or exact version Packagist does not list resolves to UNKNOWN, never to the license of another release.
  • Platform packages (names without a /: php, ext-*, lib-*, hhvm) are not reported.

Dev dependencies#

require-dev in composer.json, and packages-dev in composer.lock, are dev dependencies.

Off-registry dependencies#

These are read from composer.lock and reported as off-registry dependencies:

  • a path package the scan does not read;
  • a package that comes from a version-control, package, or artifact repository declared in composer.json.

In a composer.lock with no composer.json beside it, only path packages and artifact archives are off-registry.

Not evaluated#

Without a composer.lock, licenseal cannot tell which packages a version-control or artifact repository provides. They are looked up on Packagist by name and the composer.json is an analysis gap; scanning with the composer.lock removes it.

See also#