Provide a way to get dependency licenses

[i-am-the-slime]

This is something we need in order to comply with GDPR if we want to switch to Spago.

[f-f]

@i-am-the-slime how should this work?

I.e. would something like cat $(find .spago -iname 'LICENSE') be enough?

[i-am-the-slime]

I think something along those lines could work. Sounds like it could be a separate tool then. It would be nice to not include transitive dependencies if possible. That would involve parsing some spago or packages files for filtering, I guess.

[f-f]

@i-am-the-slime you can get various lists of packages, versions, etc with the list-packages command.

It has a --filter flag, so in this case we can do spago list-dependencies --filter direct to get only the direct dependencies.

Building on the bash example above we get:

#!/bin/bash

# Note: the `awk` part is to cut out only the package name
for dep in $(spago list-packages -f direct | awk '{print $1}')
do
  cat $(find ".spago/${dep}" -iname 'LICENSE')
done

I'd like to avoid baking this kind of functionality into Spago, as:

1. it's achievable with some lines of bash vs more lines into Spago
2. the desidered output might not be the same for different usecases, so this way of doing it provides maximum flexibility (as you can tweak formatting, etc as desired)

[i-am-the-slime]

This is very nice, thank you very much.

[f-f]

@i-am-the-slime you're welcome! 🙂

I think this is a useful bit of information worth adding to the FAQ, so I'll add the "docs" label and keep this open

[wires]

Many package managers (cargo, elba, npm) allow you to specify the license in the package manifest, usually by specifying a license field which has some SPDX identifier as value.

Maybe it is a good idea to follow this approach?

[f-f]

@wires in this case we're talking about getting license information from dependencies, which at the time of writing are going to be 100% bower projects. So this means adapting the above bash snippet to call jq to extract the license field from the bower config instead of printing the license file.

I'm open to adding a license field to our config, but I'd say we should discuss it in another issue