Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add mojo for checking license compatibility and include as part of the license report #427

Open
SingingBush opened this issue Apr 25, 2022 · 0 comments

Comments

@SingingBush
Copy link

I'd like to ensure that my projects don't breach and software licensing rules. It would be really handy if the plugin could detect incompatibility of the projects license with any of the licenses that are used by dependencies or between the dependencies themselves.

For example, mixing code under the original BSD license with code under the GPL (GNU General Public License) would violate license terms or mixing code under the Apache 2.0 license with that of GPL v2.

It would be great to have these issues be made apparent. At the very least it should be logged as a warning but as licensing rules are a legal issue, I'd prefer the default behaviour to fail the build if an incompatibility is found.

At the minute this can be achieved somewhat using excludedLicenses option with failOnBlacklist set to true:

<plugin>
    <groupId>org.codehaus.mojo</groupId>
    <artifactId>license-maven-plugin</artifactId>
    <version>2.0.0</version>
    <executions>
        <execution>
            <id>add-third-party</id>
            <phase>compile</phase>
            <goals>
                <goal>add-third-party</goal>
            </goals>
            <configuration>
                <includeTransitiveDependencies>true</includeTransitiveDependencies>
            </configuration>
        </execution>
    </executions>
    <configuration>
        <failOnMissing>true</failOnMissing>
        <excludedLicenses>Some License that cannot be used in my project</excludedLicenses>
        <failOnBlacklist>true</failOnBlacklist>
    </configuration>
</plugin>

but it's not ideal. Not only does this require licenseMerges to get things working correctly but it's also down to the user to make sure they exclude licenses correctly. Some default rules could be handled by license-maven-plugin for the more common licenses.

Please add support for failOnIncompatibility

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant