cargo-deny "unlicensed" crate blocks the check in CI

By Daniel Zoghalchali·Latchkey

cargo-deny could not determine a license for a crate: its Cargo.toml has no license or license-file, and no license text matched above the confidence threshold. It reports the crate as unlicensed and fails the check.

What this error means

The licenses check prints an "unlicensed" error for a specific crate. This is common for workspace-internal crates or crates that rely on a license-file cargo-deny cannot resolve.

error[unlicensed]: unlicensed
   crate = internal-crate 0.1.0
   = no license expression was specified and no license files were found

Common causes

The crate declares no license

A crate with no license and no license-file in Cargo.toml has nothing for cargo-deny to evaluate, so it is unlicensed.

A license-file path could not be matched

A crate points at a license file whose text does not match a known license above the threshold, so cargo-deny cannot attribute it.

How to fix it

Declare the license on your own crate

1. Add a license (SPDX) or license-file to the crate's Cargo.toml.
2. For workspace crates, set it at the package level so cargo-deny reads it.
3. Re-run the licenses check to confirm it is no longer unlicensed.

# Cargo.toml
[package]
name = "internal-crate"
license = "MIT OR Apache-2.0"

Clarify a third-party crate

For an external crate you cannot change, add a clarify entry so cargo-deny knows its license and stops reporting it as unlicensed.

# deny.toml
[[licenses.clarify]]
name = "some-crate"
expression = "MIT"
license-files = [{ path = "LICENSE", hash = 0x00000000 }]

How to prevent it

• Require a license field in every workspace crate template.
• Clarify third-party crates rather than lowering the threshold globally.
• Run cargo-deny in CI so unlicensed crates never merge.

Frequently asked questions

Related guides

References

• The Cargo Book
• GitHub Actions documentation