Add a lint for license files

[foolip]

No description provided.

[foolip]

@jgraham do you want to give this another look now that I've updated lint.ignore? It makes it a lot clearer what the current state of the repo is, at least.

[jgraham]

So I see the intent, but it seems like one effect might be that people add third party code without copying the license file in order to silence the lint. So instead of helping it will just cause a worse kind of problem.

Can we require any third_party sub-directory to contain a LICENSE file and also lint that directories other than third_party/<foo> and the root don't have LICENSE files?

If we want to specifically audit every license is acceptable and so require an explicit rule for each we could have two lint rules, one to check that the license exists and one for unaudited license. Then we should divide the allow list up into specific license types (MIT, BSD, etc.) so it's obvious what's acceptable.

[foolip]

So I see the intent, but it seems like one effect might be that people add third party code without copying the license file in order to silence the lint. So instead of helping it will just cause a worse kind of problem.

That would be bad, and does seem like a real risk.

Can we require any third_party sub-directory to contain a LICENSE file and also lint that directories other than third_party/<foo> and the root don't have LICENSE files?

I think that'd have to be an all_paths_lints like check_css_globally_unique, right? I can't see any other lint concerned with directories, but we could find all third_party directories given all paths, at least.

A problem I anticipate is that the existing *: */third_party/* line in lint.ignore will silence the error. I don't think we have a syntax for "only this lint", so should we add that, or hardcode special rules for the license lint?

If we want to specifically audit every license is acceptable and so require an explicit rule for each we could have two lint rules, one to check that the license exists and one for unaudited license. Then we should divide the allow list up into specific license types (MIT, BSD, etc.) so it's obvious what's acceptable.

Do you mean that every LICENSE file that does exist and we should accept should still be a lint error, so that we have to list it? Like, LICENSE-MIT, LICENSE-BSD and finally LICENSE-UNKNOWN?

[jgraham]

A problem I anticipate is that the existing *: /third_party/ line in lint.ignore will silence the error. I don't think we have a syntax for "only this lint", so should we add that, or hardcode special rules for the license lint?

Hmm, good point. I'm not sure. Might be easiest to hardcode special rules, unless you want to add a more generic mechanism.

Do you mean that every LICENSE file that does exist and we should accept should still be a lint error, so that we have to list it? Like, LICENSE-MIT, LICENSE-BSD and finally LICENSE-UNKNOWN?

I just meant in the ignore file having something like

# Verified MIT LICENSE
LICENSE-ALLOWED: tools/third_party/mit_project


# Verified BSD LICENSE
LICENSE-ALLOWED: tools/third_party/bsd_project

So it wouldn't actually do any verification that the license is the right kind, but a human adding a dep could see what precedent exists, and a reviewer could manually verify the claim.

[foolip]

I've sent #23593 to remove these 3 files.

[foolip]

James filed https://bugzilla.mozilla.org/show_bug.cgi?id=1637924 about this file.

[foolip]

I sent #23592 to move this into third_party

[Hexcles]

I think we need more context here. Maybe include "Do not add new third-party code without going through the RFC process". Otherwise, people might just add dependencies without LICENSE.

[foolip]

I've stopped working on this, because it turned into a lint that needs to determine which directories exist and which files in them don't, which is unlike any other lint. The ignore rule would also have to be for a directory, which is also something we don't have.