search

microsoft / license-checker-webpack-plugin

Webpack plugin that verifies licenses of all external dependencies in a compilation, and outputs them to a file.
MIT License
135 stars 28 forks source link

[Question] License Text Output When File is Missing #35

Closed nrayburn-tech closed 3 years ago

nrayburn-tech commented 3 years ago

If a package.json file specifies a license type, but a full license file is not found what should the output be?

For example this repo, https://github.com/yesmeck/mini-store. The package.json contains a license of MIT, but the repo does not provide a license file. The current output is the MIT, so I assume just the contents of the package.json license field.

If it is a common license, should the contents be replaced with the 'default' text of the license? Does the concept of a 'default' text for a license even really exist?

unindented commented 3 years ago

should the contents be replaced with the 'default' text of the license?

I thought about this. The problem is that license files have placeholders that have to be replaced by the person licensing the project. For example, the MIT license contains this line:

Copyright <YEAR> <COPYRIGHT HOLDER>

I'm not sure of the legal implications of assuming some year and some name, and generating a license from our side, but I think I want to steer away from that.

nrayburn-tech commented 3 years ago

Here is how the vscode project is handling using a dependency that doesn’t have the full license. https://github.com/microsoft/vscode/blob/fe175afdb80bd7a28caae83028e7440b45698007/cglicenses.json#L37

It just puts the MIT license, but without the copyright line. However, like you said it should have the copyright information. If you can’t be confident there aren’t any legal implications, then I think leaving it as is works best.

I think this can be closed, unless you want to investigate further into this.

Thanks for the project, it’s proven to be very useful for me.

unindented commented 3 years ago

Thank you for the feedback, and for the pointer to VSCode's handling of the issue.

I think I'll close for now, but if you have new thoughts on this, please ping me.