bbc / apache2-license-checker Goto Github PK

View Code? Open in Web Editor NEW

0.0 70.0 1.0 32 KB

Automated license checker for validating project dependencies for compatible Apache2 licenses.

License: Apache License 2.0

JavaScript 100.00%

tv-and-radio complaints tool tv

apache2-license-checker's Introduction

Apache2 License Checker

Automated license checker for validating project dependencies for compatible Apache2 licenses.

Use with your project

Run npm install @bbc/apache2-license-checker --save-dev
Modify your package.json to include apache2-license-checker as part of your test script

For example:

...
  "scripts": {
    "test": "mocha && npm run check-licenses",
    "check-licenses": "apache2-license-checker"
  },
...

The license checker will fail with an exit code of 1 if there are any problems with the license, and will pass with an exit code of 0 if all checks are ok.

A temporary file licenses.json will be created containing a full license analysis based on output from the license-checker tool. You will probably want to .gitignore this file.

Creating Exceptions

If the license checker throws errors, and you've verified the errors as acceptable risks, then you may want to create an exceptions file in your local project. For example:

`license-exceptions.json`

{
  "exceptions": {
    "cosmos-deploy@*": {
      "reason": "Not required, acceptable use for BBC internal deployments"
    },
    "[email protected]": {
      "reason": "Public Domain; see: https://github.com/dscape/cycle/"
    },
    "[email protected]": {
      "reason": "MIT License; see: https://github.com/dominictarr/map-stream"
    },
    "[email protected]": {
      "reason": "Public Domain; see https://github.com/faisalman/ua-parser-js"
    }
  }
}

Development

To support

Check out the code
Run npm install
Run npm test

Modify scripts/whitelist.js to allow additional licenses or license combinations.

Modify scripts/exceptions.js to allow specific modules for a given reason.

Please push to a branch and raise a pull request, or fork and do the same.

Example output

In normal usage running npm run check-licenses produces an output similar to:

Acceptable project licenses (uses):
  (MIT AND CC-BY-3.0) (1)
  Apache-2.0 (3)
  BSD-2-Clause (1)
  BSD-3-Clause (1)
  ISC (15)
  MIT (23)
  Unlicense (1)
  WTFPL (1)

Acceptable project license exceptions:
  [email protected]
    Reason: Not required, acceptable use for BBC internal deployments
  [email protected]
    Reason: Public Domain; see: https://github.com/dscape/cycle/
  [email protected]
    Reason: MIT License; see: https://github.com/dominictarr/map-stream

All licenses ok Licensed (46) Exceptions (0) Problems (0)

If there is a problem with the licenses, then expect an output similar to:

Acceptable project licenses (uses):
  Apache-2.0 (3)
  BSD-2-Clause (1)
  BSD-3-Clause (1)
  CC-BY-3.0 (1)
  CC0-1.0 (1)
  ISC (16)
  MIT (25)

Acceptable project license exceptions:
  [email protected]
    Reason: Public Domain; see https://github.com/kemitchell/spdx-exceptions.json

Problems with the licenses for these dependencies:
  [email protected]
    License:     CC0-1.0
    Repository:  https://github.com/shinnn/spdx-license-ids
    Publisher:   Shinnosuke Watanabe
    Url:         https://github.com/shinnn


Licenses not ok Licensed (46) Exceptions (1) Problems (1)

apache2-license-checker's People

Contributors

Watchers

Forkers

iptvreleaseonly

apache2-license-checker's Issues

Error when running `apache2-license-checker`

Tried running against https://github.com/bbc/simorgh.

$ apache2-license-checker
Checked for local license-exceptions.json; but no file was found.
/Users/ashtoc03/Sites/bbc/simorgh/node_modules/@bbc/apache2-license-checker/scripts/check-licenses.js:16
  return exceptions[key] || exceptions[anyVersionKey]
                   ^

TypeError: Cannot read property '[email protected]' of undefined
    at inExceptionList (/Users/ashtoc03/Sites/bbc/simorgh/node_modules/@bbc/apache2-license-checker/scripts/check-licenses.js:16:20)
    at Object.keys.forEach (/Users/ashtoc03/Sites/bbc/simorgh/node_modules/@bbc/apache2-license-checker/scripts/check-licenses.js:34:25)
    at Array.forEach (<anonymous>)
    at checkLicenses (/Users/ashtoc03/Sites/bbc/simorgh/node_modules/@bbc/apache2-license-checker/scripts/check-licenses.js:28:25)
    at ChildProcess.command.on (/Users/ashtoc03/Sites/bbc/simorgh/node_modules/@bbc/apache2-license-checker/run.js:23:3)
    at emitTwo (events.js:126:13)
    at ChildProcess.emit (events.js:214:7)
    at maybeClose (internal/child_process.js:925:16)
    at Socket.stream.socket.on (internal/child_process.js:346:11)
    at emitOne (events.js:116:13)

Generic license compatibility checker?

Following on from #5 (comment), if we're expanding the API to take an exceptions.js, does it make sense to expose the whitelist.js as an overridable parameter too?

However, I think the value in apache2-license-checker vs something like license-checker or npm-license-crawler is that it's opinionated. tldrlegal (on top of legally) attempts to provide some legal clarity to license usage, but may not be quite what we're looking for.

Looking at it with naiive eyes, I'd imagine the most useful functionality would be to lose the whitelist and to simply specify what license we need to comply to (e.g. --license=MIT), and the tool would then parse the licenses of your dependencies and be opinionated about which licenses are compatible with which.

...at which point, this becomes a generic license checker and would probably want renaming from apache2-license-checker to something like license-compatibility-checker?

Has this conversation been had already? I'd be interested to hear your thoughts!

Whitelist licenses used by spdx-exceptions and spdx-license-ids

I think the CC-BY-3.0 and CC0-1.0 licenses should be whitelisted:

https://creativecommons.org/licenses/by/3.0/ (CC-BY-3.0)
- Share — copy and redistribute the material in any medium or format, Adapt — remix, transform, and build upon the material for any purpose, even commercially.
https://creativecommons.org/publicdomain/zero/1.0/ (CC0-1.0)
- Public domain dedication

This is inline the suggestion of removing the exceptions list #5

[email protected]
    License:     CC-BY-3.0
    Repository:  https://github.com/kemitchell/spdx-exceptions.json
    Publisher:   The Linux Foundation
    Url:         undefined

  [email protected]
    License:     CC0-1.0
    Repository:  https://github.com/shinnn/spdx-license-ids
    Publisher:   Shinnosuke Watanabe
    Url:         https://github.com/shinnn

Two requirements of this project fail the license checker - causing noise on the output

The same two dependencies appear each time I run the license checker. Using npm ls I determined these were dependencies of the license checker itself.

  [email protected]
    License:     undefined
    Repository:  https://github.com/kemitchell/spdx-exceptions.json
    Publisher:   The Linux Foundation
    Url:         undefined

  [email protected]
    License:     undefined
    Repository:  https://github.com/shinnn/spdx-license-ids
    Publisher:   Shinnosuke Watanabe
    Url:         https://github.com/shinnn

$ npm ls spdx-exceptions
[email protected] /Users/bradim02/workspace/act-client
└─┬ [email protected]
  └─┬ [email protected]
    └─┬ [email protected]
      └─┬ [email protected]
        └─┬ [email protected]
          └─┬ [email protected]
            └─┬ [email protected]
              └── [email protected]

$ npm ls spdx-license-ids
[email protected] /Users/bradim02/workspace/act-client
└─┬ [email protected]
  └─┬ [email protected]
    └─┬ [email protected]
      └─┬ [email protected]
        └─┬ [email protected]
          └─┬ [email protected]
            ├─┬ [email protected]
            │ └── [email protected] 
            └─┬ [email protected]
              └── [email protected]  deduped

Remove exception list, make exceptions optional

With reference to the Licence Dependency Aggregator tool:
https://github.com/bbc/licence-dependency-aggregator

I spoke with @RichardTribe and we agreed that there are separate valid use cases for an external analysis tool, and an integrated pipeline tool (this checker) that are strongly opinionated about correct and valid licenses to use with a project.

However, maintaining an exception list makes no sense - it should be down to the to the user of the library which exceptions they want to make, and not maintained as part of this tool.

NPM package is not public

This repository is public, but the published package on NPM is currently private.

https://www.npmjs.com/package/@bbc/apache2-license-checker

Please consider making it public by following these instructions: https://docs.npmjs.com/changing-package-visibility

Raised by bbc/simorgh#1357.

Thanks!