6 ms·

Why don't npm-like package managers have settings for licenses in applications (as opposed to libraries)? Settings like "no AGPL" or "no copyleft dependencies"

Why don't npm-like package managers have settings for licenses in applications (as opposed to libraries)? Settings like "no AGPL" or "no copyleft dependencies" would allow easy vendoring with modifications. This (disabled by default) feature might break some proprietary code, but if it does, that indicates you were not following copyright law prior. Obviously this doesn't solve the general quality problem with dependencies that the author notes, but it fixes some licensing issues.

arnon 7y ago
Node's popular `pm2` itself is AGPL. I don't think they're too fussed about copyleft.
- correct_horse 7y ago
  > I don't think they're too fussed about copyleft. Yeah, and I'm not either. I have never decided to vendor dependencies, and my only modifications to GPL code were to upstream (so I didn't have a legal obligation to distribute the modified code - the distributors of the code I modified do). I just think automated license compatibility checking could be a good move for the ecosystem. Also to be clear, I was talking about npm-like ecosystems. In my mind this includes npm, poetry and cargo (and probably more).
  - oaiey 7y ago
    I hope on your comment you do not mix up LGPL and GPL.
- baybal2 7y ago
  Node has tons of AGPL packages which seem to be uses by quite a lot things. I myself saw a pm2 error message in Linkedin's error 500 output
  - oaiey 7y ago
    A GPL or AGPL software should not exist on NPM for libraries. For tools yes, but GPL for libraries is for 99% of the users a non-starter. It just does not belong into a library ecosystem. To be clear: everyone has the free right to license their stuff how they like. I just think NPM as a ecosystem should be opinionated (and it is... Towards MIT. Just not completely).
fmajid 7y ago
There are over 200 OSI-certified open source licenses, and no automatable way to handle them.
- thenewnewguy 7y ago
  I (and I'm sure many others) would gladly take an option to provide a whitelist of acceptable licenses.
- correct_horse 7y ago
  I count 97 (https://opensource.org/licenses/alphabetical https://opensource.org/licenses/alphabetical), but point taken. Maybe there should be an organized effort to make some sort of compatibility matrix for all the OSI licenses...
- andrey_utkin 7y ago
  Gentoo's package management system has neat automatable way to handle package licenses. See https://www.gentoo.org/glep/glep-0023.html https://www.gentoo.org/glep/glep-0023.html
antoncohen 7y ago
Yarn has `yarn licenses list`[1], which is very useful. And there is an accepted RFC for `yarn licenses check`[2] they would check against a list of allowed licenses. [1] https://yarnpkg.com/lang/en/docs/cli/licenses/ https://yarnpkg.com/lang/en/docs/cli/licenses/ [2] https://github.com/yarnpkg/rfcs/blob/master/accepted/0000-license-check.md https://github.com/yarnpkg/rfcs/blob/master/accepted/0000-li...

arnon 7y ago

Node's popular `pm2` itself is AGPL. I don't think they're too fussed about copyleft.

correct_horse 7y ago
> I don't think they're too fussed about copyleft. Yeah, and I'm not either. I have never decided to vendor dependencies, and my only modifications to GPL code were to upstream (so I didn't have a legal obligation to distribute the modified code - the distributors of the code I modified do). I just think automated license compatibility checking could be a good move for the ecosystem. Also to be clear, I was talking about npm-like ecosystems. In my mind this includes npm, poetry and cargo (and probably more).
- oaiey 7y ago
  I hope on your comment you do not mix up LGPL and GPL.
baybal2 7y ago
Node has tons of AGPL packages which seem to be uses by quite a lot things. I myself saw a pm2 error message in Linkedin's error 500 output
- oaiey 7y ago
  A GPL or AGPL software should not exist on NPM for libraries. For tools yes, but GPL for libraries is for 99% of the users a non-starter. It just does not belong into a library ecosystem. To be clear: everyone has the free right to license their stuff how they like. I just think NPM as a ecosystem should be opinionated (and it is... Towards MIT. Just not completely).

fmajid 7y ago

There are over 200 OSI-certified open source licenses, and no automatable way to handle them.

thenewnewguy 7y ago
I (and I'm sure many others) would gladly take an option to provide a whitelist of acceptable licenses.
correct_horse 7y ago
I count 97 (https://opensource.org/licenses/alphabetical https://opensource.org/licenses/alphabetical), but point taken. Maybe there should be an organized effort to make some sort of compatibility matrix for all the OSI licenses...
andrey_utkin 7y ago
Gentoo's package management system has neat automatable way to handle package licenses. See https://www.gentoo.org/glep/glep-0023.html https://www.gentoo.org/glep/glep-0023.html

antoncohen 7y ago

Yarn has `yarn licenses list`[1], which is very useful. And there is an accepted RFC for `yarn licenses check`[2] they would check against a list of allowed licenses. [1] https://yarnpkg.com/lang/en/docs/cli/licenses/ https://yarnpkg.com/lang/en/docs/cli/licenses/ [2] https://github.com/yarnpkg/rfcs/blob/master/accepted/0000-license-check.md https://github.com/yarnpkg/rfcs/blob/master/accepted/0000-li...