v0.8.0

v0.8.0 - 2026-07-19

Added

• Added a notices command that generates a release-ready THIRD_PARTY_NOTICES-style file from locked dependencies, grouping shared licence text while preserving package-specific NOTICE and COPYING content. It supports GitHub, Codeberg, and GitLab sources, falls back to canonical SPDX text when needed, caches results across runs, and writes to stdout or --output PATH; use --no-cache to bypass caching.
• Added -v as an alias for the global --verbose flag and detailed notices progress showing per-package source selection, licence-file discovery, and processing steps.

Installation

Download the self-contained archive for your platform, extract it, and place
licence_audit somewhere on your PATH. These Queso-built executables bundle
the Erlang runtime, so Erlang/OTP does not need to be installed on the target
machine.

Windows ARM64 (aarch64-windows) is not published yet because Queso requires an
explicit Windows ARM64 ERTS and there is no trustworthy pinned prebuilt OTP 28
archive for that target.

Linux x86_64 (glibc)

curl -fsSL -o licence_audit.tar.gz \
  "https://github.com/tylerbutler/licence_audit/releases/download/v0.8.0/licence_audit-v0.8.0-x86_64-linux-glibc.tar.gz"
tar -xzf licence_audit.tar.gz --strip-components=1
chmod +x licence_audit
./licence_audit --help

Windows x86_64

Invoke-WebRequest `
  -Uri "https://github.com/tylerbutler/licence_audit/releases/download/v0.8.0/licence_audit-v0.8.0-x86_64-windows.zip" `
  -OutFile licence_audit.zip
Expand-Archive licence_audit.zip -DestinationPath .
.\licence_audit.exe --help

Escript compatibility install

The release also keeps the original escript archive and bare licence_audit
escript. The escript runs on any platform with Erlang/OTP 28.x or newer.

curl -fsSL -o licence_audit-escript.tar.gz \
  "https://github.com/tylerbutler/licence_audit/releases/download/v0.8.0/licence_audit-v0.8.0.tar.gz"
tar -xzf licence_audit-escript.tar.gz --strip-components=1
chmod +x licence_audit
./licence_audit --help

With mise

If you use mise, install this release with the
github: provider:

mise use -g "github:tylerbutler/licence_audit@v0.8.0[asset_pattern=licence_audit,bin=licence_audit]"

The asset_pattern=licence_audit option selects the bare escript asset, avoiding
ambiguity with the per-arch Queso archives. For a project-local install, omit -g.
This mise path uses the escript and still needs Erlang/OTP 28.x or newer on your PATH; if you manage Erlang
with mise, install it too:

mise use -g erlang@28

Verify the download

# Checksums (run from the directory containing the artifacts)
sha256sum -c checksums.txt

# Build provenance + SBOM attestations for a native archive...
gh attestation verify licence_audit-v0.8.0-x86_64-linux-glibc.tar.gz --repo tylerbutler/licence_audit

# ...or for the bare escript binary
gh attestation verify licence_audit --repo tylerbutler/licence_audit