How are we going to handle Repos in AboutCode

[chinyeungli]

We may have a gap in our AboutCode plan where it comes to libraries pulled from a Repo instead of a product team's own Dev codebase. It is not so clear that it will be feasible to insert the .ABOUT files into a Repo?

@pombredanne can you explain a bit more about the issue?

[pombredanne]

@chinyeungli do you mean by this a package on Maven or NPM or some remote Git repo? If this is so, the only way is keep a local ABOUT file (and/or convince upstream authors to keep a .ABOUT file in their upstream VCS).

Alternatively we could maintain a registry of .ABOUT files separately, but this is likely a lot of work vs. upstreaming IMHO

[chinyeungli]

@pombredanne I think this is not the responsibility for the tool but the user of how do they create the ABOUT file, right?

[mjherzog]

We cannot expect anyone to insert .ABOUT files into a repository with its own package manager and some metadata format for licensing. ABOUT files provide a backup for cases where there is no package manager metadata.

[chinyeungli]

obsolete