aboutcode-org / aboutcode-org/scancode-toolkit

Ensure the "licenseref-license" convention of npm before 3.10 is detected correctly

Open
#2,872 6 comments 0 reactions 0 assignees View on GitHub
easy good first issue license scan package scan
Dominant language
Python
Stars
2.6k
Forks
791
Avg merge
1d 12h
Merged PRs (30d)
5

Description

See https://github.com/search?p=2&q="LicenseRef-LICENSE"&type=Code

Over the years, npm had a few evolving conventions:

See https://softwareengineering.stackexchange.com/questions/285885/which-spdx-license-is-equivalent-to-all-rights-reserved

https://github.com/npm/npm/issues/8795#issuecomment-119760485

> Use "license": "LicenseRef-LICENSE" and then create a LICENSE file next to package.json with something as little as: "(c) Copyright 2015 person or company, all rights reserved.".

and https://www.bonbon.io/commercial-licenses-for-npm-packages
> This should be enough to satisfy NPM commands if you had a missing or incorrect license, and this does replace the older "license": "LicenseRef-LICENSE" of earlier NPM versions.

This legacy way should be supported. It is seen on bower packages too

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.