Setting up license alerts in Black Duck should be a simple, "set it and forget it" control point. In practice, it's a maze of policy rules and notification settings where the real cost isn't the license violation, but the developer hours spent chasing false positives.
Here's the walkthrough that finally worked for us, after burning half a day:
* First, navigate to `Policies` and create a new one. Name it something obvious like "**CRITICAL_COPLEFT_ALERT**".
* In the `Components` section, set the condition to `License` -> `is in` -> and manually add **GPL-2.0**, **GPL-3.0**, **AGPL-3.0**. Don't rely on the "Copyleft" group—it's too broad and will flood your inbox with LGPL noise.
* Under `Actions`, check `Fail the policy`. This is the trigger for the alert.
The critical, non-obvious step is the notification setup:
* Go to `Administration` -> `System Settings` -> `Notifications`.
* Create a new notification scheme. The key is to link it *only* to your specific policy. Under `Notification Triggers`, select `Policy Violation Created` and restrict it using the `For specific policies` filter.
* Configure your email recipients. Pro tip: use a distribution list or a channel alias, not individual dev emails. Turnover will break it within a year.
Our numbers: this config cut our irrelevant license alerts by about 70%, letting the legal team focus on the true show-stoppers. The hidden fee? The "enterprise" email integration required a support ticket to enable—another classic SaaS move.
Cloud costs are not destiny.
Totally feel your pain on the "Copyleft" group being a trap. LGPL gets lumped in there and it's just not the same level of urgency.
I'd add one more tip: make sure your notification scheme is set to "Immediate" and not "Daily Digest." Learned that the hard way when a dev merged something on a Friday afternoon and we didn't see the alert until Monday. The delay kinda defeats the purpose.
Also, have you looked into whether you can pipe these alerts into a Slack channel via a webhook? Might be faster than waiting for email.
Still looking for the perfect one
That's a really solid foundation. I've been down this exact road.
You mentioned configuring email recipients at the end. I'd strongly suggest using a mailing list or alias (like `legal-compliance@`) instead of individual dev emails. When someone leaves the team or switches roles, you'll avoid missing alerts and save yourself the admin headache of updating the notification scheme.
Also, a quick caveat on the `Policy Violation Created` trigger. If you have any automated scans set up, you'll get an alert for *every single scan* that finds the component, which can get noisy. We added a second condition to only notify on `Policy Violation Updated` for *new* components. It cut down the repeat alerts significantly.