xi2 License Dependency

[ukclivecox]

This project as xi2/xz as a dependency

archiver/go.mod

Line 14 in 25e050d

github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8

However, that project has not used a standard license:

https://github.com/xi2/xz/blob/master/LICENSE

This is causing us problems with 3rd party open source dependency license validation. Is there any possibility of forking that library to republish it with a standard license? I have added an issue to their project xi2/xz#10 but it seems inactive.

[mholt]

I hadn't noticed... are you really not able to use software in the public domain?

[ukclivecox]

We are and our software is open source but unless a software project we use has a legally well known and clarified license it makes things less clear and harder to verify its status.

[coolaj86]

@mholt I think the problem is that "Public Domain" is not a license that can be detected with automated tooling.
The MIT license et al can be automatically detected with tooling because they use exact phrases and wording.

[ukclivecox]

Another issue is marketplaces such as Google accept a limited set of well established licences. By taking the approach of creating a custom license with "reasonable sounding" words makes it harder for these software projects to be accepted when scrutinized in strict environments. Its a shame as I am sure the xi2 project would probably be happy with MIT or Apache 2.0 wording.

[coolaj86]

Having not heard anything back from the project's author, I created a fork with the LICENSE:

https://github.com/therootcompany/xz

Perhaps you could use the replace directive in go.mod?

[mholt]

Fixed in #302.

Tried using a replace directive but got this error:

go: finding module for package github.com/therootcompany/xz
go: found github.com/therootcompany/xz in github.com/therootcompany/xz v1.0.1
go: github.com/therootcompany/[email protected] used for two different module paths (github.com/therootcompany/xz and github.com/xi2/xz)

so I had to just swap it out entirely, nbd. Thanks!