Navigation Menu

Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

go.dev: detect licenses for modules not at their repository roots #37437

Closed
eliasnaur opened this issue Feb 25, 2020 · 6 comments
Closed

go.dev: detect licenses for modules not at their repository roots #37437

eliasnaur opened this issue Feb 25, 2020 · 6 comments
Labels
FrozenDueToAge NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. pkgsite
Milestone

Comments

@eliasnaur
Copy link
Contributor

@jba brought up an issue where pkg.go.dev fails to detect a license for a module that is not at thei repository root. Example:

https://pkg.go.dev/gioui.org/example

The reason is that while the repository for the gioui.org/example module,

https://git.sr.ht/~eliasnaur/gio/tree

does have detectable licenses, the module rooted at

https://git.sr.ht/~eliasnaur/gio/tree/master/example

doesn't.

@jba points out that pkg.go.dev works in terms of module zip files, which only contain files in the module tree. The module zip for gioui.org/example does not contain the UNLICENSE nor LICENSE-MIT files from the parent directory.

However, forcing licensing files at every module root feels like bending too much for the licensing detection tool. I don't particularly mind copying the license files to my nested modules gioui.org/example and gioui.org/cmd, but I would not appreciate this restriction if I had an otherwise non-Go repository that happened to contain a minor Go module in a subdirectory.

What did you expect to see?

A license detected on https://pkg.go.dev/gioui.org/example.

What did you see instead?

No licenses detected for https://pkg.go.dev/gioui.org/example.

@gopherbot gopherbot added this to the Unreleased milestone Feb 25, 2020
@myitcv
Copy link
Member

myitcv commented Feb 25, 2020

@jba points out that pkg.go.dev works in terms of module zip files, which only contain files in the module tree. The module zip for gioui.org/example does not contain the UNLICENSE nor LICENSE-MIT files from the parent directory

I personally think this is the correct position; otherwise if I install/use the module via proxy.golang.org there will be no license distributed with the code I am using, which seems wrong.

The module is the unit of source code exchange and versioning; it seems a sensible requirement to have the license be part of that.

@mvdan
Copy link
Member

mvdan commented Feb 25, 2020

I agree that this is a bit bizarre, though. Do we expect an open source monorepo with dozens of published modules to contain dozens of exact copies of its license? If that's what we expect, I don't think it has been communicated well enough.

@heschi
Copy link
Contributor

heschi commented Feb 25, 2020

Note that this is all confused by the fact that the go command automatically propagates LICENSE files -- not LICENCE, not LICENSE.md, just LICENSE -- from the repository root to nested modules, and that decision can't be changed because it would break checksums.

@eliasnaur
Copy link
Contributor Author

I didn't know about the LICENSE propagation. That's sort of good news. For me in particular if pkg.go.dev supports dual-licensed projects where the licenses are merged into one LICENSE file.

@eliasnaur
Copy link
Contributor Author

I created a testing branch of gioui.org with the merged LICENSE file, here, tagged "license-debug".

Is there a way to test whether pkg.go.dev accepts the merged LICENSE without pushing the change to master? licensecheck doesn't seem offer a cli version.

@julieqiu julieqiu added the NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. label Mar 16, 2020
@eliasnaur
Copy link
Contributor Author

I'm lazy, so I opted to simply merge the licenses into LICENSE and push to master. It worked! See

https://pkg.go.dev/mod/gioui.org?tab=licenses
and the submodules
https://pkg.go.dev/mod/gioui.org/example?tab=licenses
https://pkg.go.dev/mod/gioui.org/cmd?tab=licenses

I'm closing this issue because I'm happy: license propagation works without awkward duplication and the licensing babble is confined to a single file, LICENSE. Thanks for the tip, @heschik.

@golang golang locked and limited conversation to collaborators Apr 2, 2021
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
FrozenDueToAge NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. pkgsite
Projects
None yet
Development

No branches or pull requests

6 participants