Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR removes the
NOASSERTION
license type from Licensee output. We take license types from various manifest files as well as trying to auto-detect from a LICENSE file (if present); theNOASSERTION
license type represents a failed parse of a LICENSE file.After discussion with our legal counsel we determined that we can include packages so long as we can prove we made a 'best effort' to represent the author's intent in licensing. Since we take the license from their other assertions in package manifests, and since Licensee is an automated tool that can fail to parse license files that humans would recognize as conveying meaning, we can drop these parsing failures -- we have an alternate way to determine the license (the manifest files'
license
fields).Filtering this license type from the Licensee output prevents a NOASSERTION from failing the SPDX license check, so a good number of packages that were previously failing are now passing. Note: this does not allow packages that only specify a license via a LICENSE file through if the parse fails; that results in a package being listed as having no valid license at all. So we're still only accepting licensed packages.
Helps fix #250, and closes #266, because now only packages with invalid dependencies are being dropped -- and that means only
purescript-prettier
is going to be dropped, which is pretty good!