Check that all our requirements are well defined and license-compliant

[thomass-dev]

Particular attention to jsonschema[format] .

[augustebaum]

I used pip-licenses to list the licenses of every Python dependency we currently have. The result I got with the environment described in https://github.com/probabl-ai/mandr/pull/58 is as follows:

 Count  License                                                                                                                             
 1      Apache 2.0                                                                                                                          
 11     Apache Software License                                                                                                             
 4      Apache Software License; BSD License                                                                                                
 3      Apache Software License; MIT License                                                                                                
 1      Apache-2                                                                                                                            
 8      Apache-2.0                                                                                                                          
 1      Apache-2.0 AND BSD-3-Clause AND MIT                                                                                                 
 1      Artistic License; GNU General Public License (GPL); GNU General Public License v2 or later (GPLv2+)                                 
 1      BSD                                                                                                                                 
 51     BSD License                                                                                                                         
 1      BSD-2-Clause                                                                                                                        
 1      GNU Lesser General Public License v2 or later (LGPLv2+)                                                                             
 1      GNU Lesser General Public License v3 or later (LGPLv3+)                                                                             
 1      GPL-3.0-or-later OR MIT                                                                                                             
 1      Historical Permission Notice and Disclaimer (HPND)                                                                                  
 4      ISC License (ISCL)                                                                                                                  
 2      MIT                                                                                                                                 
 72     MIT License                                                                                                                         
 1      MIT License; Mozilla Public License 2.0 (MPL 2.0)                                                                                   
 1      Mozilla Public License 2.0 (MPL 2.0)                                                                                                
 3      Python Software Foundation License                                                                                                  
 2      The Unlicense (Unlicense)                                                                                                           
 1      apache-2.0 AND bsd-simplified                                                                                                       
 1      apache-2.0 AND bsd-simplified-darwin AND (bsd-simplified AND public-domain AND bsd-new AND isc AND (bsd-new OR gpl-1.0-plus) AND bsd-original)
 1      apache-2.0 AND lgpl-2.1 and unrar and brian-gladman-3-clause                         

All dependencies have at least one clear license (if you run the command you'll see a line labelled "UNKNOWN": this is mandr itself).

Of particular importance is the fact that no dependency is licensed exclusively under the GNU Public License (GPL), which, if they were, would obligate us to use that license (by the so-called "virality" clause). The Lesser GPL (LGPL) takes the virality clause away, and every other dependency that has the GPL is also licensed under some other non-viral license.

[rouk1]

On the frontend side here is the list of used licences:

├─ MIT: 441
├─ ISC: 67
├─ BSD-3-Clause: 44
├─ BSD-2-Clause: 15
├─ Apache-2.0: 10
├─ MIT-0: 3
├─ BlueOak-1.0.0: 3
├─ Unlicense: 2
├─ Python-2.0: 1
├─ CC-BY-4.0: 1
├─ MIT*: 1
├─ UNLICENSED: 1
├─ CC0-1.0: 1
├─ 0BSD: 1
└─ (MIT OR CC0-1.0): 1

[augustebaum]

It's unclear how to make progress on this issue before we know about the business model for mandr-related services. Putting this issue on hold for now.

[tuscland]

Mandr is company-driven open-source project. We should list acceptable licenses and automate the verification that we are not using non-acceptable ones. I will revert with such a list.

[tuscland]

@augustebaum @rouk1 could you please run the analysis again given latest dependencies? It seems we would like to automate that in a distant future.

[rouk1]

npx license-checker --summary
├─ MIT: 445
├─ ISC: 68
├─ BSD-3-Clause: 50
├─ BSD-2-Clause: 16
├─ Apache-2.0: 10
├─ MIT-0: 3
├─ BlueOak-1.0.0: 3
├─ Unlicense: 2
├─ Python-2.0: 1
├─ CC-BY-4.0: 1
├─ CC0-1.0: 1
├─ UNLICENSED: 1
├─ 0BSD: 1
└─ (MIT OR CC0-1.0): 1

[thomass-dev]

In addition, we need to add a bot checking that all imported packages are explicitly in our dependencies (excepted for the one used in items).

Two related issues:

• https://github.com/probabl-ai/skore/issues/404
• https://github.com/probabl-ai/skore/issues/405