Is it possible to gather all licenses for the dependencies of a given component?

[thomasjm]

There's a passing reference to license gathering in the "motivation" section of the documentation but I can't find anything else on it.

I poked around in nix repl and it seemed like this should be straightforward but I couldn't quite figure it out. I'm hoping for something along the lines of the stack ls dependencies --license command. Thanks!

[thomasjm]

To answer my own question, I've written a function to generate a nice YAML file of dependencies and licenses like this:

let

  pkgSetToLicenseFile = filename: pkgSet:
    let licenseFn = (k: v: if k == "base" || k == "ghc-heap" then "" else v.package.license);
        nameToLicense = lib.generators.toJSON {} (lib.mapAttrs licenseFn pkgSet);
    in
      runCommand filename { buildInputs = [yq-go]; } ''
        yq r --prettyPrint ${writeText "temp.yaml" nameToLicense} > $out
      '';

in

pkgSetToLicenseFile "licenses.yaml" my-project.components.exes.my-executable.project.pkg-set.config.packages;

Note how I had to ignore base and ghc-heap, in order to avoid a Nix error like "getting status of .../base.nix: No such file or directory".

Hopefully using .project.pkg-set.config.packages like this is picking up the right dependencies...

[thomasjm]

Actually no, it seems to be actually grabbing all dependencies in the Stackage snapshot. Back to the drawing board...

[thomasjm]

Aha, it seems mapping over the component's buildInputs gets the dependencies I want. I wrote a function like this to generate a map from dependency name to license:

componentToLicenseMap = component: 
  lib.listToAttrs (map (x: lib.nameValuePair x.identifier.name x.meta.license) component.buildInputs);

[michaelpj]

I think something like this should be in haskell.nix, ideally for the whole project.

[michaelpj]

We might also want something like an allowedLicenses/disallowedLicenses predicate to cabalProject, in order to enforce a policy.

[michaelpj]

Ideas:

• A function that takes a component and produces a dependency-pkgid -> license map (or tree?)
• A function that processes the output of that making an assertion on the licenses

Then you can more-or-less roll your own by just mapping over your project components. But we might want something that goes all the way up to cabalProject to make this as easy as possible.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.