Node-fs-extra: Clarify vendored code licenses

[cassierecher]

I'd love to use this in a project, but the vendored copies of of ncp and node-mv, along with the license mismatch between this project and mv, clash with company policies. Could those dependencies be obtained by require() instead?

[jprichardson]

No. ncp and mv are broken. You'll see a lot of fixes to those. ncp is deprecated. If there is a licensing mismatch or something is incorrect, that is 100% unintentional and I'm willing to clear that up / fix that. Let me know your thoughts.

[cassierecher]

Thanks for addressing this so quickly!

In particular, the project has a LICENSE file asserting MIT, but index.js claims BSD. Is this file offered under different terms?

[jprichardson]

In particular, the project has a LICENSE file asserting MIT, but index.js claims BSD. Is this file offered under different terms?

I did that because I wasn't sure if I could relicense under different terms. If the code has changed substantially enough or a rewrite, I could.

I just want to write code and solve problems. So if something is not compliant, I'm happy to change - I'd appreciate your thoughts and direction.

[jprichardson]

"All code in this project is licensed under MIT, unless explicitly stated differently in the individual file." - does that suffice?

[RyanZim]

@chrisrecher ping?

[RyanZim]

If I don't get a response from @chrisrecher in a few days, I will close.

[binki]

Please include all of the necessary license quips in LICENSE. It is already hard enough to ensure that license info gets displayed properly in those “see OSS licenses” dialogs, we’re lucky if people even bother to look at LICENSE. But if LICENSE doesn’t have everything to begin with, properly extracting that information from a project is that much harder. Some people do care about trying to respect “The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.” and digging around in a module’s source to find things makes this quite hard.

I also see that an outdated version of rimraf is inlined. Could this be switched to an external module to? Are you working with upstreams to fix their bugs so that this library can be kept more pure and benefit from upstream bugfixes?

[RyanZim]

I also see that an outdated version of rimraf is inlined. Could this be switched to an external module to? Are you working with upstreams to fix their bugs so that this library can be kept more pure and benefit from upstream bugfixes?

@binki It's not an outdated version of rimraf. It is a modification of the latest version to remove glob support (since we don't need that). You can see more details at https://github.com/jprichardson/node-fs-extra/pull/300. @jprichardson is "watching" the rimraf repo, if there was a bugfix, he would port it to our inlined version.

---

@jprichardson @binki Should we add this line to LICENSE?

All code in this project is licensed under MIT, unless explicitly stated differently in the individual file.

[jprichardson]

@jprichardson @binki Should we add this line to LICENSE?

I'm okay with this.

[RyanZim]

@binki Would that be satisfactory? If so, PR welcome.

[binki]

@jprichardson @RyanZim I would much rather this be added to LICENSE:

«Existing node-fs-extraLICENSE»

This project includes code covered by the following license:

rimraf:

The ISC License

Copyright (c) Isaac Z. Schlueter and Contributors

Permission to use, copy, modify, and/or distribute this software for any
purpose with or without fee is hereby granted, provided that the above
copyright notice and this permission notice appear in all copies.

THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

ncp:

# MIT License

###Copyright (C) 2011 by Charlie McConnell

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.

etc., etc.…

Maybe because both your project and ncp is MIT you could just list all of the copyright lines and then the MIT and do a separate one for all ISC projects, but idk if there’s some magic copyright law stuff about that. It’s easier/safer to just include the whole blobs. I could PR for this and try to find all of the inlined code if this would be acceptable, but I will not be able to get to it immediately.

EDIT: I accidentally called this project rimraf in my original example, sorry.

[RyanZim]

I don't know what you think @jprichardson, but I would favor having the MIT license in LICENSE and leaving a note that ncp, rimraf, etc. use different licenses and put a LICENSE file in the subdirectories in lib/ or print the entire license in the header (ISC is even shorter than MIT).

[binki]

Another thought is to also move all vendored code to a vendor directory, each project to its own directory with its own LICENSE too. That way you can clearly separate what code is original and belonging to this project from that which is copied.

I still would like this projects LICENSE to have the full licenses of copied projects in it though because I am thinking of the possibility of trying to automatically scrape LICENSE files from projects which would break if the top LICENSE didn’t include everything.

[RyanZim]

Ping @jprichardson for the final decision.

[jprichardson]

ncp in fs-extra is significantly different than the original. rimraf is starting to be different. At what point is it not considered 'vendored' anymore?

I want to be in compliance with licenses and am fine with doing what it takes, but honestly, without legal expertise here, some of this feels like bikeshedding.

but I would favor having the MIT license in LICENSE and leaving a note that ncp, rimraf, etc. use different licenses and put a LICENSE file in the subdirectories in lib/

I'd be okay with this. After awhile though, they'll be different enough that they'll be considered a rewrite in which case, they'd fall under the fs-extra license.

[binki]

I'd be okay with this.

OK, I’ll see when I get put together a PR.

After awhile though, they'll be different enough that they'll be considered a rewrite in which case, they'd fall under the fs-exra license.

I’m not sure how that sort of thing is supposed to work. It would be easiest/safest to just create blind reimplmentations if possible :-/. It’s not like the particular tricks those libraries use to get past things can’t be copied, but the structure maybe? xD

[RyanZim]

It would be easiest/safest to just create blind reimplmentations if possible

• Safest, yes.
• Easiest: I don't know about that. rimraf would be hard. :wink:

[binki]

Easier than becoming a lawyer? :-p

[RyanZim]

Given that no one has taken action on this since 2016; I'm gonna close this out.