fosslight_dependency_scanner icon indicating copy to clipboard operation
fosslight_dependency_scanner copied to clipboard

Dependency scanner for pub can't load Copyright Text

Open namkyu1999 opened this issue 4 years ago • 6 comments

Describe the bug I'm using dependency_scanner for my flutter project. I 'm generate oss license file like below image

When i run fosslight_dependency_scanner, this software generate file without copyright text. I don't know why because my dart file have license text. Is there any other reason? image

namkyu1999 avatar Aug 10 '21 11:08 namkyu1999

I found it . This code is written like below.

https://github.com/fosslight/fosslight_dependency_scanner/blob/0a4e9e2c8a94f8a426b09cee6a6b955ebf17cd65/src/fosslight_dependency/analyze_dependency.py#L797

Any plans to support this feature?

namkyu1999 avatar Aug 11 '21 03:08 namkyu1999

@namkyu1999 Thanks for the reporting it!

The output file of flutter dependency scanning ('oss_licenses.dart') has the element of license and it contains the license text. It means that the license could not include copyright text. (Because license text could contain the copyright text or not.)

Also it needs to detect the copyright text in license. We used the 'nomos standalone binary' for detecting license name with license. If you know the tools that detect the copyright text, please let me know. Then we will support it.

dd-jy avatar Aug 11 '21 06:08 dd-jy

How about using scancode-toolkit? Your team already used this package in 'fosslight_source_scanner'.

namkyu1999 avatar Aug 12 '21 14:08 namkyu1999

In fact, scancode-toolkit is a bit heavy for fosslight_dependency_scanner to use. But it would be nice if the tools could be unified and the copyright could also be detected. We will consider to replace it.

dd-jy avatar Aug 13 '21 00:08 dd-jy

How about using scancode-toolkit? Your team already used this package in 'fosslight_source_scanner'.

scancode-toolkit maintainer here. Tell me if I can help.

scancode-toolkit is a bit heavy

It has a few dependencies but it has quite decent license and copyright detection support, IMHO ;)

pombredanne avatar Aug 26 '21 23:08 pombredanne

@pombredanne We are still on the fence whether this function will be performed in the dependency scanner or in the upper scanner. I think it will take some time. I'll tell you if I need help later.

dd-jy avatar Aug 27 '21 00:08 dd-jy