Skip to content

Remove inappropriate dependency license exception entries from Licensed configuration #840

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jan 30, 2025

Conversation

per1234
Copy link
Contributor

@per1234 per1234 commented Jan 30, 2025

The Licensed tool is used to check for incompatible licenses in the project dependencies. The tool can be configured to ignore incompatible license types for specific dependencies. This is done by adding an entry for the dependency to the reviewed entry in the Licensed configuration file.

Such exceptions should be added only when the project maintainer has determined the following things to be true:

  • dependency license is not one of the standard compatible types (as defined by the allowed mapping in the config)
  • dependency license is compatible with the licensing of the project (e.g., dependency uses a non-standard but compatible license)

Licensed uses the licensee tool to automatically determine the license type based on metadata provided by the dependency author. This metadata must be in a standardized format without any modifications. In cases where that wasn't done, "Licensed" will identify the license type as "other". In this case, the project maintainer must manually determine the license type. If the license is determined to have a standard type, then the maintainer must manually set the correct license type in the license cache metadata for the dependency. The dependency exception system should not be used in this case.

Exceptions were inappropriately set up for dependencies with compatible license types not automatically identifiable by Licensed/licensee (#761). These exceptions are hereby removed from the Licensed configuration file and the manually determined license types defined in the license metadata cache for the dependencies.

…ed configuration

The "Licensed" tool is used to check for incompatible licenses in the project dependencies. The tool can be configured
to ignore incompatible license types for specific dependencies. This is done by adding an entry for the dependency to
the `reviewed` entry in the "Licensed" configuration file.

Such exceptions should be added only when the project maintainer has determined the following things to be true:

* dependency license is not one of the standard compatible types (as defined by the `allowed` mapping in the config)
* dependency license is compatible with the licensing of the project (e.g., dependency uses a non-standard but
  compatible license)

"Licensed" uses the licensee tool to automatically determine the license type based on metadata provided by the
dependency author. This metadata must be in a standardized format without any modifications. In cases where that wasn't
done, "Licensed" will identify the license type as "other". In this case, the project maintainer must manually determine
the license type. If the license is determined to have a standard type, then the maintainer must manually set the
correct license type in the license cache metadata for the dependency. The dependency exception system should not be
used in this case.

Exceptions were inappropriately set up for dependencies with compatible license types not automatically identifiable by
"Licensed"/"licensee". These exceptions are hereby removed from the "Licensed" configuration file and the manually
determined license types defined in the license metadata cache for the dependencies.
@per1234 per1234 added topic: infrastructure Related to project infrastructure type: imperfection Perceived defect in any part of project labels Jan 30, 2025
@per1234 per1234 self-assigned this Jan 30, 2025
@per1234 per1234 merged commit 51cdd16 into arduino:main Jan 30, 2025
10 checks passed
@per1234 per1234 deleted the remove-dep-license-exceptions branch January 30, 2025 09:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
topic: infrastructure Related to project infrastructure type: imperfection Perceived defect in any part of project
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant