Pivotal Labs have a similar problem -- ensuring that only whitelisted licenses are represented in a codebase -- and developed License Finder for this kind of au

Pivotal Labs have a similar problem -- ensuring that only whitelisted licenses are represented in a codebase -- and developed License Finder for this kind of auditing: https://github.com/pivotal/LicenseFinder https://github.com/pivotal/LicenseFinder We also use it for Cloud Foundry. It's fairly robust. I work for Pivotal, but not on LF.