Added '--from=all' option

[cdce8p]

At the moment pip-licenses can only output either the metadata or the classifier license information. This PR adds the --from=all option that displays both license information at the same time .

Background PEP 639 specified how Python packages are supposed to define license information going forward. The preferred way is to use the license metadata field with SPDX license expression syntax. Although not officially deprecated, the trove classifiers will slowly be phased out and won't receive any more updates. Since the PEP is only from Aug-2019, most packages still use the trove class and/or have outdated/invalid metadata license information. With the proposed option, it will be easier to compare the used licenses.

Going forward

• --from=mixed still prefers the classifier over metadata information. Changing this would be a big breaking change and probably confuse many users. Therefore I'm not sure if it will be worth it. At least not for now.
• Update the metadata license information for pip-licenses to just MIT to conform with the SPDX identifier.
• Try parsing the metadata license field and extracting SPDX identifiers.

Ideas

• Add option to auto-convert classifier to SPDX identifier (when possible, eg. only in simple cases)
• Parse SPDX license expression to better evaluate fail / allow
• Add license pinning, would be useful for CI integrations to require manual approval if license for specific package changes. This would probably work best with a config file.

--

Next steps for this PR

• [x] Finalize implementation details
• [x] Add test case(s)

[codecov[bot]]

Codecov Report

Merging #86 (45098f7) into master (5ae0255) will increase coverage by 0.01%. The diff coverage is 100.00%.

@@            Coverage Diff             @@
##           master      #86      +/-   ##
==========================================
+ Coverage   98.86%   98.87%   +0.01%     
==========================================
  Files           1        1              
  Lines         353      357       +4     
==========================================
+ Hits          349      353       +4     
  Misses          4        4              

Impacted Files	Coverage Δ
piplicenses.py	98.87% <100.00%> (+0.01%)	:arrow_up:

---

Continue to review full report at Codecov.

Legend - Click here to learn more Δ = absolute <relative> (impact), ø = not affected, ? = missing data Powered by Codecov. Last update 5ae0255...45098f7. Read the comment docs.

[raimon49]

@cdce8p Thanks for the info on PEP 639. I will review and feedback on your branch at a later date.

• Update the metadata license information for pip-licenses to just MIT to conform with the SPDX identifier.

Yes, this will be a task I will tackle when I release the next version 😉

[raimon49]

This discussion is also related to issue #72 .

[raimon49]

@cdce8p I've checked your patch. I'm glad you worked with attention to compatibility.

I am positive that I will merge this patch. I hope to move on to the next step.

[cdce8p]

Thanks for taking the time to review my changes. I went ahead and added a test case for the change. The PR should be good on my part now. Let me know if there is anything else I should do.

[raimon49]

Version 3.2.0 has just been released! https://pypi.org/project/pip-licenses/3.2.0/