search

sstadick / cargo-bundle-licenses

Generate a THIRDPARTY file with all licenses in a cargo project.
Apache License 2.0
86 stars 6 forks source link

Running with `--previous` copies over licenses that didn't replace a "NOT FOUND" #21

Open jwodder opened 1 year ago

jwodder commented 1 year ago

When I generated a THIRDPARTY.toml file with cargo bundle-licenses --format toml --output THIRDPARTY.toml, the Unicode-DFS-2016 license for unicode-ident:1.0.8 was not found, though the package's other licenses (MIT and Apache-2.0) were, so I manually filled in the missing license text in THIRDPARTY.toml. When I then ran cargo bundle-licenses --format toml -o CI.toml --previous THIRDPARTY.toml, part of the output was:

[2023-05-07T15:58:25Z WARN  bundle_licenses_lib::found_license] No license found for Unicode-DFS-2016 license in unicode-ident:1.0.8 - /Users/jwodder/.cargo/registry/src/github.com-1ecc6299db9ec823/unicode-ident-1.0.8/Cargo.toml
[2023-05-07T15:58:25Z INFO  bundle_licenses_lib::bundle] Using previous license text for MIT license unicode-ident:1.0.8
[2023-05-07T15:58:25Z INFO  bundle_licenses_lib::bundle] Using previous license text for Apache-2.0 license unicode-ident:1.0.8
[2023-05-07T15:58:25Z INFO  bundle_licenses_lib::bundle] Using previous license text for Unicode-DFS-2016 license unicode-ident:1.0.8

As can be seen, cargo-bundle-licenses copied over the text of the MIT and Apache-2.0 licenses from the previous file even though those licenses were found in the unicode-ident:1.0.8 source. I believe this is the wrong thing to do, as it can lead to upstream changes to license text being discarded.

sstadick commented 1 year ago

I disagree, but also see what you mean. --previous should favor the previous over anything found. But having a --copy-from-previous-if-missing or something like that would be very useful and more clear / fit the patter of how to use this tool as outlined in the README a bit better.

For this, and all the other open issues, I'm not sure when I'll get to them, I'm always open to PRs, and do use this tool myself to maintain projects. This issue in particular is at the top of the queue to work on when I come around to this tool again.