search

kalessil / production-dependencies-guard

MIT License
87 stars 2 forks source link

accept-licence: any-open-source wildcard #14

Closed josefsabl closed 2 years ago

josefsabl commented 4 years ago

It would be very useful if you could add something like accept-licence: any-open-source which would be same as accepting all the versions of open source licences. I have this is my list and it is a bit bothering to maintain it.

      "accept-license:Apache-2.0",
      "accept-license:BSD-2-Clause",
      "accept-license:BSD-3-Clause",
      "accept-license:GPL-2.0",
      "accept-license:GPL-2.0-only",
      "accept-license:GPL-3.0",
      "accept-license:GPL-3.0-only",
      "accept-license:ISC",
      "accept-license:LGPL-2.1-or-later",
      "accept-license:LGPL-3.0",
      "accept-license:MIT",
SunMar commented 3 years ago

This in concept is nice, in practice though who's going to decide what "any open source" means? Does that refer to licenses considered open source by the FSF, or licenses approved by OSI, or would it refer to what is generally accepted in the PHP community?

For example in your list I'm surprised to see the full GPL. If you depend on a GPL package it turns your entire project into a derivative work. You then have to distribute the whole thing under the terms of the GPL. That's why it's a very uncommon license to use for PHP packages, and also the reason why I deliberately do not allow GPL packages in my projects (the LGPL is fine though).

Also the newest license in the list is the (L)GPL 3.0 and that's already 14 years old. These things very rarely change, to be honest I can't remember the last time I had to make a change to my accept-license: list. This ticket is now over a year old, so I'm kind of curious. How much has this list changed for you since you created this ticket? 😀

josefsabl commented 2 years ago

Well, it historically changed only when new package was installed and it was licensed in a way that we didn't see before. And that was actually a motivation to write this issue.

But as I see it now I completely agree with what you say.

And thank you for the tip with the full GPL 👍 .