Open Source License Attribution

[TylorS]

Most open-source licenses require being distributed with your software to abide by their terms. I think that it'd be amazing if snowpack were capable of using its dependency tree to find licenses and generate a proper OSS attribution file. What do y'all think?

Some light reading

https://boadweelaw.com/open-source-attribution-tips/
https://www.nexb.com/blog/oss_attribution_obligations.html

An index of open-source licenses

https://spdx.org/licenses/

[sourcevault]

I used :

https://www.npmjs.com/package/concat-licenses ( written by @TheGuardianWolf) to create a file , but it was ~ 500 kB.

How would it be served client side ?!? file would very quickly get large.

I though about this problem for a while, and the only reasonable fix it is to add a disclaimer that says that only copyright notice is okay if code is served on a browser.

( it shouldn't matter server side - no way your server performance gets effected by having a 5 MB file sitting besides your minified code ) .

But it would require authors to explicitly add the clause ( new License ? ) to their projects.

Or else minification will always void MIT/BSD -clause !

There is another option , the apple way.

Where your website has an explicit page with the concated LICENCES.

https://www.apple.com/legal/internet-services/maps/oss-acknowledgements/

I am sure Apple lawyers have spent a lot of time thinking about this, ( best practice for now ? ).

[FredKSchott]

Strong +1! I'd love to help make this easier. Since esinstall (our internal npm package -> ESM converter) is powered by Rollup internally, I wonder if https://www.npmjs.com/package/rollup-plugin-license could give us what we want here. If we can get esinstall creating a license file in your web_modules installed folder, then we'd just need to have Snowpack include it in your final build.

Is anyone interested in taking a look at adding?

[TylorS]

Hey @FredKSchott 👋

Thanks for the response. I'd definitely be interested in contributing this feature.

I was just taking a look at rollup-plugin-license. My thoughts were initially to expose just the subset of the thirdParty API as that was the kind of thing I was thinking of to begin with. I'm not sure if there's an existing pattern for doing this kind of integration?

[lastmjs]

Did anything ever happen here?