Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add license to package.json #33

Closed
wants to merge 1 commit into from

Conversation

silverwind
Copy link

It's useful so tools can automatically detect it.

@fabiospampinato
Copy link
Owner

Thanks, but I've explicitly deleted those redundant fields from package.json in my repos.

I think it's better to read the license file directly, even if that is harder to do or more time consuming.

@silverwind
Copy link
Author

silverwind commented Nov 20, 2022

Tools like https://github.com/microsoft/license-checker-webpack-plugin do not read files in the package and you will likely receive warnings for the package being unlicensed by various tools like npm.

Guess we are forced to overwrite this one package out of hundrets others that manage to have the field.

@fabiospampinato
Copy link
Owner

fabiospampinato commented Nov 20, 2022

Sorry about that, but:

  1. That and other tools could just be written better and support this use case too, like github can still detect the license of the repository and the code they use for doing that is open-source.
  2. Those kind of tools IMO are partially useless, if the goal is to output a 100% correct report. For example to the best of my knowledge package.json just doesn't support specifying the license for code shipped with the package that doesn't come neither from the author of the package nor from its NPM dependencies, like it's often the case in WASM ports of libraries coming from other ecosystems. Like if you import my zstandard-wasm and you rely on one of those tools to generate your dependency report the report will be incorrect, even if I had accepted this PR, because the tool doesn't understand that there's a dependency on zstd. And even in the case where I accepted this PR, package.json added a way to support this, and I used that new feature, one just can't trust that everybody will use it. So if 100% correctness is the goal (as I guess it is otherwise what's the point), those tools can't be fully trusted anyway.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants