packaging/guidelines

Fork 17

Node.js: Check that License field is synced with bundled licenses #1525

Open

mavit wants to merge 1 commit from nodejs-licence-check into main

mavit commented

2026-02-13 14:12:43 +00:00

Member

It would be easy to overlook a change/addition to the bundled licences, so suggest an automated check that they’re still as specified in the .spec.

It would be easy to overlook a change/addition to the bundled licences, so suggest an automated check that they’re still as specified in the `.spec`.

yselkowitz commented

2026-02-13 18:25:29 +00:00

Member

Just jq please.

Just `jq` please.

yselkowitz commented

2026-02-16 16:57:38 +00:00

Member

IMO this should be made into a macro in nodejs-packaging, and the dependency added there.

decathorpe commented

2026-03-11 21:48:52 +00:00

Owner

Note that the current implementation is also a bit simplistic, and will break as soon as one of the components is dual-licensed (among other things).

join(" AND ") only works for simple cases like "MIT" or "BSD-3-Clause" but it is not uncommon for projects to be dual-licensed these days (like MIT OR Apache-2.0), and the simple "concatenate with " AND "" will result in broken SPDX expressions, and cannot match the License tag of the package (or rather, it shouldn't - because if it did, then the package's License tag would be wrong, too).

Note that the current implementation is also a bit simplistic, and will break as soon as one of the components is dual-licensed (among other things). `join(" AND ")` only works for simple cases like "MIT" or "BSD-3-Clause" but it is not uncommon for projects to be dual-licensed these days (like `MIT OR Apache-2.0`), and the simple "concatenate with `" AND "`" will result in broken SPDX expressions, and cannot match the License tag of the package (or rather, it shouldn't - because if it did, then the package's License tag would be wrong, too).

gotmax23 commented

2026-05-01 04:11:00 +00:00

Owner

It would be good to make a more robust implementation (i.,e., not just simple string " AND " joining) and put it in a macro (like yselkowitz suggested) instead of copying long jq invocations into the Guidelines and then every specfile.

In case it helps, the https://github.com/aboutcode-org/license-expression Python library is what go-vendor-tools uses to combine and compare license expressions, and it's worked pretty well for us.

It would be good to make a more robust implementation (i.,e., not just simple string " AND " joining) and put it in a macro (like yselkowitz suggested) instead of copying long `jq` invocations into the Guidelines and then every specfile. In case it helps, the https://github.com/aboutcode-org/license-expression Python library is [what go-vendor-tools uses](https://gitlab.com/fedora/sigs/go/go-vendor-tools/-/blob/main/src/go_vendor_tools/licensing.py?ref_type=heads) to combine and compare license expressions, and it's worked pretty well for us.

This pull request is broken due to missing fork information.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin nodejs-licence-check:nodejs-licence-check

git switch nodejs-licence-check

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff nodejs-licence-check

git switch nodejs-licence-check

git rebase main

git switch main

git merge --ff-only nodejs-licence-check

git switch nodejs-licence-check

git rebase main

git switch main

git merge --no-ff nodejs-licence-check

git switch main

git merge --squash nodejs-licence-check

git switch main

git merge --ff-only nodejs-licence-check

git switch main

git merge nodejs-licence-check

git push origin main

No reviewers

No milestone

No project

No assignees

4 participants

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

packaging/guidelines!1525

No description provided.

Rows
Columns