Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use Google's licensecheck to identify licenses #107

Merged
merged 6 commits into from
May 21, 2022
Merged

Conversation

fgksgf
Copy link
Member

@fgksgf fgksgf commented May 18, 2022

  • Use Google's licensecheck to identify licenses, which is used by pkg.go.dev
  • Add binary licenses by dep resolve (dogfooding)

@fgksgf fgksgf added the enhancement New feature or request label May 18, 2022
@fgksgf fgksgf added this to the 0.4.0 milestone May 18, 2022
@fgksgf
Copy link
Member Author

fgksgf commented May 18, 2022

When execute ./bin/darwin/license-eye dep resolve -o dist/licenses -s dist/LICENSE.tpl, got:

Failed to resolve the license of <github.com/kr/[email protected]>: cannot find license file 
Failed to resolve the license of <github.com/pascaldekloe/[email protected]>: cannot identify the license, coverage: 21.6% 

Then I explored their repositories and found that they add their licenses recently, but the versions that we depend on do not have valid licenses.

So do we need add their current licenses or not? @kezhenxu94

@kezhenxu94
Copy link
Member

When execute ./bin/darwin/license-eye dep resolve -o dist/licenses -s dist/LICENSE.tpl, got:


Failed to resolve the license of <github.com/kr/[email protected]>: cannot find license file 

Failed to resolve the license of <github.com/pascaldekloe/[email protected]>: cannot identify the license, coverage: 21.6% 

Then I explored their repositories and found that they add their licenses recently, but the versions that we depend on do not have valid licenses.

So do we need add their current licenses or not? @kezhenxu94

Can we try to upgrade to the newer versions that have licenses? That would be more safe

@fgksgf
Copy link
Member Author

fgksgf commented May 18, 2022

Can we try to upgrade to the newer versions that have licenses? That would be more safe

Since we depend on them indirectly, I executed go get -u ./... && go mod tidy to upgrade all dependencies. Then we still have one dependency (indirect) that can not resolve the license:

Failed to resolve the license of <github.com/chzyer/[email protected]>: cannot find license file

@kezhenxu94
Copy link
Member

Can we try to upgrade to the newer versions that have licenses? That would be more safe

Since we depend on them indirectly, I executed go get -u ./... && go mod tidy to upgrade all dependencies. Then we still have one dependency (indirect) that can not resolve the license:

Failed to resolve the license of <github.com/chzyer/[email protected]>: cannot find license file

@fgksgf I just wanted to suggest you to add the following config into .licenserc.yaml but found it doesn't work for this dependency due tu #108

dependency:
  files: #...
  licenses:
    - name: github.com/chzyer/logex
      version: v1.1.10
      license: MIT

@kezhenxu94
Copy link
Member

For this kind of old dependencies, we need the licenses config to manually identify the licenses

kezhenxu94
kezhenxu94 previously approved these changes May 19, 2022
Copy link
Member

@kezhenxu94 kezhenxu94 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This solution is much more neat than before and we don't have to maintain the ugly rules... Thanks for doing this @fgksgf just some nits that you might want to improve

pkg/license/identifier.go Show resolved Hide resolved
pkg/license/identifier.go Outdated Show resolved Hide resolved
@fgksgf
Copy link
Member Author

fgksgf commented May 19, 2022

Good catch, I will handle this at the weekend. @kezhenxu94

@kezhenxu94 kezhenxu94 merged commit 9af283d into main May 21, 2022
@kezhenxu94 kezhenxu94 deleted the licensecheck branch May 21, 2022 09:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants