diff --git a/Documentation/BUILD b/Documentation/BUILD
new file mode 100644
index 0000000000..98b3ce45ac
--- /dev/null
+++ b/Documentation/BUILD
@@ -0,0 +1,7 @@
+
+load("//tools/bzl:license.bzl", "license_map")
+
+license_map(
+  name = "pgm-licenses",
+  target = "//gerrit-pgm:pgm",
+)
diff --git a/gerrit-pgm/BUILD b/gerrit-pgm/BUILD
index ec86c9a1f8..895b5f112c 100644
--- a/gerrit-pgm/BUILD
+++ b/gerrit-pgm/BUILD
@@ -1,5 +1,6 @@
 load('//tools/bzl:java.bzl', 'java_library2')
 load('//tools/bzl:junit.bzl', 'junit_tests')
+load('//tools/bzl:license.bzl', 'license_test')
 
 SRCS = 'src/main/java/com/google/gerrit/pgm/'
 RSRCS = 'src/main/resources/com/google/gerrit/pgm/'
@@ -160,3 +161,7 @@ junit_tests(
     '//lib/jgit/org.eclipse.jgit.junit:junit',
   ],
 )
+
+license_test(
+  name = "pgm_license_test",
+  target = ":pgm")
diff --git a/lib/BUILD b/lib/BUILD
index 44c293d5d7..20fa1264d3 100644
--- a/lib/BUILD
+++ b/lib/BUILD
@@ -1,6 +1,11 @@
+exports_files([
+  "LICENSE-DO_NOT_DISTRIBUTE"
+])
+
 java_library(
   name = 'servlet-api-3_1',
   neverlink = 1,
+  data = [ ":LICENSE-Apache2.0" ],
   exports = ['@servlet_api_3_1//jar'],
   visibility = ['//visibility:public'],
 )
@@ -75,6 +80,7 @@ java_library(
   name = 'jsch',
   exports = ['@jsch//jar'],
   visibility = ['//visibility:public'],
+  data = [ ":LICENSE-jsch" ],
 )
 
 java_library(
diff --git a/tools/bzl/BUILD b/tools/bzl/BUILD
index e69de29bb2..01ae92c333 100644
--- a/tools/bzl/BUILD
+++ b/tools/bzl/BUILD
@@ -0,0 +1,4 @@
+
+exports_files([
+  "license-map.py",
+  "test_empty.sh"])
diff --git a/tools/bzl/license-map.py b/tools/bzl/license-map.py
new file mode 100644
index 0000000000..72c7ae8277
--- /dev/null
+++ b/tools/bzl/license-map.py
@@ -0,0 +1,25 @@
+#!/usr/bin/env python
+
+# reads a bazel query XML file, to join target names with their licenses.
+
+import sys
+import xml.etree.ElementTree as ET
+
+tree = ET.parse(sys.argv[1])
+root = tree.getroot()
+
+entries = {}
+
+for child in root:
+  rule_name = child.attrib["name"]
+  for c in child.getchildren():
+    if c.tag != "rule-input":
+      continue
+
+    license_name = c.attrib["name"]
+    if "//lib:LICENSE" in license_name:
+      assert rule_name not in entries, (license_name, entries[rule_name])
+      entries[rule_name] = license_name
+
+for k, v in sorted(entries.items()):
+  print k, v
diff --git a/tools/bzl/license.bzl b/tools/bzl/license.bzl
new file mode 100644
index 0000000000..ca6443869b
--- /dev/null
+++ b/tools/bzl/license.bzl
@@ -0,0 +1,47 @@
+
+def license_map(name, target):
+    """Generate XML for all targets that depend directly on a LICENSE file"""
+    native.genquery(
+        name = name + ".xml",
+        scope = [ target, ],
+
+        # Find everything that depends on a license file, but remove
+        # the license files themselves from this list.
+        expression = 'rdeps(%s, filter("//lib:LICENSE.*", deps(%s)),1) - filter("//lib:LICENSE.*", deps(%s))' % (target, target, target),
+
+        # We are interested in the edges of the graph ({java_library,
+        # license-file} tuples).  'query' provides this in the XML output.
+        opts = [ "--output=xml"],
+    )
+
+    # post process the XML into our favorite format.
+    native.genrule(
+        name = "gen_license_txt_" + name,
+        cmd = "python $(location //tools/bzl:license-map.py) $(location :%s.xml) > $@" % name,
+        outs = [ name + ".txt",],
+        tools = [ "//tools/bzl:license-map.py", name + ".xml"])
+
+def license_test(name, target):
+    """Generate XML for all targets that depend directly on a LICENSE file"""
+    txt = name + "-forbidden.txt"
+
+    # fully qualify target name.
+    if target[0] not in ":/":
+        target = ":" + target
+    if target[0] != "/":
+        target = "//" + PACKAGE_NAME + target
+
+    forbidden = "//lib:LICENSE-DO_NOT_DISTRIBUTE"
+    native.genquery(
+        name = txt,
+        scope = [ target, forbidden ],
+        # Find everything that depends on a license file, but remove
+        # the license files themselves from this list.
+        expression = 'rdeps(%s, "%s", 1) - rdeps(%s, "%s", 0)' % (target, forbidden, target, forbidden),
+    )
+    native.sh_test(
+        name = name,
+        srcs = [ "//tools/bzl:test_empty.sh" ],
+        args  = [ "$(location :%s)" % txt],
+        data = [ txt ],
+    )
diff --git a/tools/bzl/test_empty.sh b/tools/bzl/test_empty.sh
new file mode 100755
index 0000000000..0d4398d2bc
--- /dev/null
+++ b/tools/bzl/test_empty.sh
@@ -0,0 +1,8 @@
+#!/bin/sh
+
+if test -s $1
+then
+    echo "$1 not empty:"
+    cat $1
+    exit 1
+fi