Hacker News Reader

Comment by correct_horse | Hacker News Reader

Why don't npm-like package managers have settings for licenses in applications (as opposed to libraries)? Settings like "no AGPL" or "no copyleft dependencies" would allow easy vendoring with modifications. This (disabled by default) feature might break some proprietary code, but if it does, that indicates you were not following copyright law prior.

Obviously this doesn't solve the general quality problem with dependencies that the author notes, but it fixes some licensing issues.

View on HN

Yarn has `yarn licenses list`[1], which is very useful. And there is an accepted RFC for `yarn licenses check`[2] they would check against a list of allowed licenses.

[1] https://yarnpkg.com/lang/en/docs/cli/licenses/

[2] https://github.com/yarnpkg/rfcs/blob/master/accepted/0000-li...

Node's popular `pm2` itself is AGPL. I don't think they're too fussed about copyleft.

> I don't think they're too fussed about copyleft.

Yeah, and I'm not either. I have never decided to vendor dependencies, and my only modifications to GPL code were to upstream (so I didn't have a legal obligation to distribute the modified code - the distributors of the code I modified do). I just think automated license compatibility checking could be a good move for the ecosystem.

Also to be clear, I was talking about npm-like ecosystems. In my mind this includes npm, poetry and cargo (and probably more).

I hope on your comment you do not mix up LGPL and GPL.

Node has tons of AGPL packages which seem to be uses by quite a lot things.

I myself saw a pm2 error message in Linkedin's error 500 output

A GPL or AGPL software should not exist on NPM for libraries. For tools yes, but GPL for libraries is for 99% of the users a non-starter. It just does not belong into a library ecosystem.

To be clear: everyone has the free right to license their stuff how they like. I just think NPM as a ecosystem should be opinionated (and it is... Towards MIT. Just not completely).

There are over 200 OSI-certified open source licenses, and no automatable way to handle them.

I (and I'm sure many others) would gladly take an option to provide a whitelist of acceptable licenses.

I count 97 (https://opensource.org/licenses/alphabetical), but point taken.

Maybe there should be an organized effort to make some sort of compatibility matrix for all the OSI licenses...

Gentoo's package management system has neat automatable way to handle package licenses. See https://www.gentoo.org/glep/glep-0023.html

Reply on news.ycombinator.com