License in packages

[maximegmd]

Code license management is a real pain, it would be great if in packages we could tag the license of the package. That way when requiring a package it could either display the license or even depending on the license of the project itself raise an error saying that the package's license is not compatible with the project.

Suggested wording

Package declaration

package("SomePackage")
    on_load(function(package)
        package:set_license("gplv3")
     end)

Project

set_license("proprietary")

add_requires("SomePackage")

Would result in

Package "SomePackage" required with license "gplv3" incompatible with "proprietary", please use a compatible license or remove the requirement.

Regarding license files

Some licenses such as Apache License 2.0 require that the license and copyright notice be included with the source and binary version of a software, therefore it would be useful to be able to specify which files from a package are related to the license so that we the license files are included with the artifacts.

I suggest a new directory package:installDir("license") in which we would copy all license files and upon building this directory would be copied next to the generated binaries.

Reference regarding license files: https://en.wikibooks.org/wiki/FOSS_Licensing/How_to_Make_the_Source_Free_or_Open

[waruqi]

We have provided set_license() api for package() in dev branch.

package("SomePackage")
    set_license("gplv3")

And I will also consider adding set_license api and package license detection features in the project configuration.

[waruqi]

But I am not very sure which licenses are incompatible, can you help provide some relevant reference documents?

[maximegmd]

https://dwheeler.com/essays/floss-license-slide.html

As for which can be included in a proprietary I am not a specialist but I believe, MIT, apache, LGPL, BSD and public domain can be included. I think there is an exception with GPLv3 regarding linking a binary to another non GPLv3 program but I am not sure so I think it's safe to assume it's not possible until someone more knowledgeable comes along.

Edit: Some licenses have a clause specifying that you must keep the license text in the source package AND binary package so I will update my original message to make sure the license is included with the built artifacts.

[SirLynix]

Beware, LGPL can only be linked without problem if using a shared linked (dynamic linking), static linking is not supported between a properietary/mit/apache/... and LGPL (with the same restrictions as GPL).

[waruqi]

I have implemented the first version to check the compatibility between target and packages on dev branch. xmake update -s dev

case 1:

add_requires("libplist") -- LGPL-2.0
target("test")
    set_kind("binary")
    add_files("src/*.cpp")
    add_packages("libplist")

$ xmake
warning: target(test) maybe is not compatible with license(LGPL-2.1) of package(libplist),
we can use shared libraries with LGPL-2.1 or use set_license()/set_policy() to modify/disable license!

case 2:

add_requires("libplist") -- LGPL-2.0
target("test")
    set_kind("binary")
    add_files("src/*.cpp")
    add_packages("libplist")
    set_license("Apache-2.0") -- set license

$ xmake
warning: license(Apache-2.0) of target(test) is not compatible with license(LGPL-2.1) of package(libplist)
we can use shared libraries with LGPL-2.1 or use set_license()/set_policy() to modify/disable license!

If you need to improve the license detection, you can continue to improve these two script files.

https://github.com/xmake-io/xmake/blob/dev/xmake/rules/utils/check_licenses/check_licenses.lua
https://github.com/xmake-io/xmake/blob/dev/xmake/modules/core/base/license.lua