Remark: Add `license` file to each package

[RobertBorg]

at least [email protected] is missing such a file.

[wooorm]

The readmes clearly specify the license including a link to the license file in the root of this project. Furthermore, each package.json specifies the license. So: why?

[RobertBorg]

why you'd want this

according to the MIT license
"The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software."

don't u think a package distribution is a substantial portion of the software?

why i'd want this

To be able to automatically generate a about page with 3rd party packages and to be able to fulfil those attributions.

[ChristianMurphy]

To be able to automatically generate a about page with 3rd party packages and to be able to fulfil those attributions

This is what the license field in package.json is for.

[RobertBorg]

Great then i automatically know there is a copyright notice that i'm required to reproduce. how do i get that copyright notice automatically? Anyhow if you don't think this is needed feel free to close i'll keep updating the license for this package manually.

[wooorm]

What are you using to generate? Might be something for that tool to handle

[RobertBorg]

i wasn't happy with the tools i tried so it's something i've written. I could query for a license file on the repository path but it would be specific to github and i'd have to make assumptions about your tagging. It could probably cover most cases automatically but since i've already established a manual override i'll probably stick with that for now.

[ChristianMurphy]

Using https://spdx.org/licenses or one of it's several tools like https://github.com/jslicense to read the SPDX code and output license text.

---

Not including the license text is moderately common on npm.
If you want to go to raise an issue with each repo that missing a license header (there's a lot) you can, but spdx mapping will likely produce faster/better results.

---

@wooorm when you publish, do you use lerna publish?
lerna automatically copies the license into each subproject in it's publish process https://github.com/lerna/lerna/blob/main/commands/publish/lib/get-packages-without-license.js
https://github.com/lerna/lerna/blob/main/commands/publish/lib/create-temp-licenses.js

[RobertBorg]

Using https://spdx.org/licenses or one of it's several tools like https://github.com/jslicense to read the SPDX code and output license text.

I haven't looked into this but generating the license text is one thing. Your specific copyright notice another.

Not including the license text is moderately common on npm, for example babel doesn't https://unpkg.com/browse/@babel/core@7.12.1/

https://unpkg.com/browse/@babel/core@7.12.1/LICENSE ?

If you want to go to raise an issue with each repo that missing a license header (there's a lot) you can, but spdx mapping will likely produce better results.

I do as time permits. This has however eaten quite a bit of time. If you don't want to do this it's perfectly fine. I didn't come here to fight. I was trying to help. Keep up the good work :)

[ChristianMurphy]

I do as time permits. This has however eaten quite a bit of time.

If only a lawyer who is also experience in open source created tools to help with this https://github.com/jslicense :wink: (thanks Kyle Mitchell)
Part of my recommendation comes because I've done license audits before, and know how much of a pain gathering the information can be.
I generally agree with the idea of ensuring license is included, :slightly_smiling_face:
hence the third part of my comment here: https://github.com/remarkjs/remark/issues/569#issuecomment-728970483

I didn't come here to fight.

your phrasing though does sound a lot like you came here to fight :man_shrugging:

Keep up the good work

Glad the project can help!

[wooorm]

Most packages on npm are maintained on GH. Though not always, generally a repository is set, which can be parsed with hosted-git-info. With that, you could contact GitHub’s GraphQL API, which has all the license info for a repo you could want!

---

thanks Ken Mitchell

It’s Kyle!

when you publish, do you use lerna publish?

Nope, I don’t. I manually publish with npm.

[ChristianMurphy]

Nope, I don’t. I manually publish with npm.

Ah, that'd explain it, npm doesn't handle copying the license automatically

[wooorm]

Pushed a fix, @RobertBorg! Thanks for the discussion. Next time they‘re released, they’ll have license files too