Run conda list with the fields option and ask for name, version, license and channel. Conda prints one row per installed package. It is a quick start for a license review, but the field comes from package metadata, so treat it as a first pass and not a legal conclusion.
The command
The conda list reference documents a fields option that takes a comma separated list. Valid values include name, version, license, license_family, channel, md5, sha256, url and several others.
conda list --fields name,version,license,channel
conda list --json
The second command emits the full records as JSON, which is easier to feed into a script or a spreadsheet.
Reading the result
| Field | Why a reviewer cares |
|---|---|
| license | The declared license text, which may be an identifier or free text |
| license_family | A coarse grouping that helps sort quickly |
| channel | Where the package came from, which affects trust |
| sha256 | Lets you tie the row to an exact archive |
Sort by license_family first. Look for packages with empty or unusual values, and look at anything you plan to redistribute, such as inside a container image or an application bundle.
Gaps to expect
- Packages installed with pip appear in conda list too, unless you use the option that excludes them, but their license data comes from a different source.
- A declared license is the packager's statement. It may not match the upstream project text exactly.
- Dual licensed or multi component packages can be summarised in a way that hides detail.
- The command lists packages, not the data sets or models your notebooks download, which carry their own terms. See /resources/blog/which-license-fields-to-record-for-a-model-and-its-datasets.
An example of what to look for
Suppose the table shows one package with a blank license, one with a copyleft family, and the rest permissive. The blank one needs a person to open the package page or source and read the real terms. The copyleft one matters mainly if you redistribute it, for instance by shipping a container image to customers. The permissive rest usually need only an attribution notice, which your policy should name. The point is to sort a long list into three short piles quickly.
A review routine
- Export the table for each environment you ship or share.
- Flag blank values and uncommon licenses for a person to read.
- Check redistribution cases against your policy before they ship.
- Store the table with the build, so you can answer a customer question later.
- Repeat when the environment changes.
This is a compliance workflow, not legal advice. Ask counsel about obligations for any license you do not already understand.
Where Safeguard fits
Safeguard's compliance and evidence automation and its SBOM features give you a place to keep such inventories. The free scan at gold.safeguard.sh/scan is a way to start with a project.
Try it yourself
Click through it at your own pace, or open it full screen. Notice how each package carries its own metadata, which is where license data lives.
Quick check
Does conda list show licenses by default?
Not in the default view. Ask for the license field with the fields option.
Can I rely on the license field for a legal decision?
No. It is declared metadata. Use it to triage, then have a person read the actual terms.
Sources
- conda list, conda documentation, fetched 19 October 2026.
Last reviewed: 19 October 2026.
