[Eyes] Generate the license file automatically

[mrproliu]

At present, the skywalking-eyes can use the dep check or dep resolve command to check the project dependencies. But now if you need to generate a LICENSE file, you still need to do it manually. So I was wondering if it is possible to make this file automatically generated.

A similar feature I have implemented in my separate PR of another project. I think it would be better to put this feature in the skywalking-eyes project. In my PR, it could do two things:

1. Using make license to generate the dependency license file automatically.
2. Check the license in each PR, to help the developer check the license before committing to make sure no license conflict.

I'd like to know what other people's opinions are, and I can plan in more detail if this feature works.

[wu-sheng]

From my understanding, I can be only sure, that Apache License 2.0 requires depedencies' license files placed and listed in the main License.

For many other licenses, I am not sure whether it is reasonable.

[mrproliu]

Yes, I think we could only deal with the project under the Apache License 2.0. For other projects. It could not use this feature for other projects, we could add it to documentation.

[wu-sheng]

In my mind, it is better to generate dependencies list with relative original licenses in a folder, than declaring generate license.
The license should not be written by project owner.

[kezhenxu94]

Currently we already have command license-eye d r -o license-directory to write all dependencies' license into dependency-name-license.txt files, in my mind the proposed changes can be generalized with an option like license-eye d r -o license-directory --summary LICENSE.tpl, where the content of LICENSE.tpl is what you proposed in PR apache/skywalking-rover#13 , the difference is that you don't always add the main license there, instead, we expose the variable LicenseContent so that for Apache project the LICENCE.tpl can be something like:

{{.LicenseContent}}

========================================================================
 {{.Name}} licenses
 ========================================================================
 {{range .Deps}}
     {{.Name}} {{.Version}} {{.Location}} {{.LicenseID}}
 {{- end }}

This is more flexible that users using other license can generate a desired summary report on their own, and it's not bound to Apache policy.

[mrproliu]

It sounds good. But I also want to mention three things:

1. For the unknown license dependency, we could just ignore them. I think we don't need to add config to configure them. WDYT?
2. Should we also need to combine similar licenses? such as MPL-2.0-no-copyleft-exception and MPL-2.0, BSD-2-Clause and BSD-3-Clause. That's why I add the group configuration.
3. If the project license is the same as the dependency license, should we add another configuration to ignore the license file written into license-directory. Such as our project is under Apache License 2.0, and the license directory doesn't need to add them again.

[kezhenxu94]

1. For the unknown license dependency, we could just ignore them. I think we don't need to add config to configure them. WDYT?

Those should be either manually processed or recognized by the license-eye tool (by modifying the rules in codes), they can't be simply ignored. Or if you want you can add a config section under dependency: (in .licenserc.yaml file) and let users map the unknown license,

header:
  # ....
dependency:
  files:
    - go.mod
  licenses:
    dependency-1: Apache-2.0
    dependency-2: MPL

2. Should we also need to combine similar licenses? such as MPL-2.0-no-copyleft-exception and MPL-2.0, BSD-2-Clause and BSD-3-Clause. That's why I add the group configuration.

That's nice to have but not required by anyone, I'd just ignore the complexity and just list them as is.

3. If the project license is the same as the dependency license, should we add another configuration to ignore the license file written into license-directory. Such as our project is under Apache License 2.0, and the license directory doesn't need to add them again.

There is a caveat that, not all Apache License 2.0 dependencies' license files don't need to be copied in the license directory, if their license file has additional content like this https://github.com/apache/skywalking/blob/7c535f8612ec741144c90ec3deb9964642883dfa/dist-material/release-docs/licenses/LICENSE-httpcomponents.txt#L178-L559

[mrproliu]

Or if you want you can add a config section under dependency: (in .licenserc.yaml file) and let users map the unknown license,

I think It also should add the license version config, Limiting the version number prevents errors from being identified due to license changes.

dependency:
  licenses:
    - name: dependency
      version: 1.0.0
      license: MPL

There is a caveat that, not all Apache License 2.0 dependencies' license files don't need to be copied in the license directory, if their license file has additional content like this https://github.com/apache/skywalking/blob/7c535f8612ec741144c90ec3deb9964642883dfa/dist-material/release-docs/licenses/LICENSE-httpcomponents.txt#L178-L559

I think in this case, the dependency license id should be Apache 2.0 and MPL 2.0? we could only exclude the same license id. If the identity is not same, also need need to write them to the license directory.

[kezhenxu94]

There is a caveat that, not all Apache License 2.0 dependencies' license files don't need to be copied in the license directory, if their license file has additional content like this https://github.com/apache/skywalking/blob/7c535f8612ec741144c90ec3deb9964642883dfa/dist-material/release-docs/licenses/LICENSE-httpcomponents.txt#L178-L559

I think in this case, the dependency license id should be Apache 2.0 and MPL 2.0? we could only exclude the same license id. If the identity is not same, also need need to write them to the license directory.

No, it's not dual-license, it's a LICENSE file that contains some extra notice or transitive license s, so you have to add them because they are not "standard" Apache license

[mrproliu]

Understand. I think we should keep all licenses file added to the directory, and let the user decide whether should keep or remove them.