search

wgnf / liz

liz (ˈlɪz) is a tool to extract license-information from your project/solution aimed on a fast and correct process. Whether it's via a dotnet-CLI-Tool, Cake-Addin or Nuke-Addon
MIT License
9 stars 0 forks source link

Get License Information for Dependency - SDK-Style #9

Closed wgnf closed 2 years ago

wgnf commented 2 years ago

idk how this might work, i know of these locations where Licenses might be:

wgnf commented 2 years ago

To download a NuGet Package maybe use this command:

dotnet add package <NAME> -v -n --prerelease -f <TARGET FRAMEWORK> --package-directory <PACKAGE_DIRECTORY>

On a dummy project and use PACKAGE_DIRECTORY as a point to refer to the downloaded package

More information see here

wgnf commented 2 years ago

But what's with a possible nuget.config? For that I might need to add this dummy project in the actual source structure... But I also want to be non-invasive 🤔

wgnf commented 2 years ago

OH!

Maybe dotnet restore --packages <PACKAGE_DIRECTORY> might work?

This'll definitely utilize everything that there is (nuget.config, cached packages on the system, ...) and will be offered for the .NET (Core) CLI

Does this work non-SDK-Style projects too?

wgnf commented 2 years ago

Yes, dotnet restore works. Following needs to be done for downloading packages:

There are some catches, though:

wgnf commented 2 years ago

Getting the License-Text should also be "two-stepped"

  1. Is there a License already embedded in the NuGet-Package?
  2. Download from the URL-Source provided

Getting the License-Type should be done, by:

  1. Has the nuspec a "License Expression"?
  2. ...
  3. Get it from the internal/manually provided URL to Type Mapping
  4. Get it from the License-Text (Keywords, see #10)
wgnf commented 2 years ago

Yes, dotnet restore works. Following needs to be done for downloading packages:

  • Non-SDK-Style: nuget restore -Force -OutputDirectory <FOLDER> -Recursive
  • SDK-Style: dotnet restore --packages <FOLDER> --force /p:DisableImplicitNuGetFallbackFolder=true

There are some catches, though:

  • Structure:
    • dotnet restore: Package-Name (lower-case) --> Version --> All data (nupkg, nuspec, license, ...)
    • nuget restore: Package-Name + Version (i.e. Autofac.4.9.4) --> Some data (nupkg, license, ...)

Problem with using restore is just that every package will be downloaded, even though we might just need a few, depending on the cache (see #1) and additionally restore might take pretty long in some cases (idk why)

Maybe looking for the package in the package file-package-sources

And then downloading directly might be a better option

Or really just using dotnet add or something on a dummy project (inside the obj folder maybe) for packages that are really needed might be the better option

wgnf commented 2 years ago

Maybe there's a package that can do this? 🤔

wgnf commented 2 years ago

These are the ways licenses can be specified (as far as i found out so far) - information are in the .nuspec file:

1:

2:

3:

4:

5:

wgnf commented 2 years ago

Best way to do it would be to have a number of sources:

... so that we get more and more information with each step/source, until we eventually, hopefully, have everything that we need

wgnf commented 2 years ago

Other TODOs: