EmbarkStudios / cargo-about

📜 Cargo plugin to generate list of all licenses for a crate 🦀
http://embark.rs
Apache License 2.0
545 stars 32 forks source link

Add filtering of `NOASSERTION` #216

Closed Jake-Shadle closed 1 year ago

Jake-Shadle commented 1 year ago

If using https://clearlydefined.io to gather license information, that service will conservatively add NOASSERTION to the expression for files that contain license like data, but an SPDX license ID could not be confidently ascribed to it. This can result in the license expression for the crate to contain 1 or more NOASSERTION identifiers, which would require the user to accept that (not really valid) ID to pass the license check. By setting this field to true, files that have a NOASSERTION id will instead be scanned locally, which will generally either figure out the license, or else skip that file.

For a real world example of what this looks like, webpki:0.22.0's LICENSE file is an ISC license, however it has a preamble that is not part of the ISC license that trips up clearly defined's inspection, causing it to be attributed with ISC AND NOASSERTION. Locally scanning the file will be more tolerant and just attribute it with ISC.

This also makes it so that we actually run cargo about on itself in CI to check that our config is actually good :stuck_out_tongue: