Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

test_js_license_set is bogus and unreliable #12266

Open
mattpap opened this issue Jul 27, 2022 · 3 comments
Open

test_js_license_set is bogus and unreliable #12266

mattpap opened this issue Jul 27, 2022 · 3 comments

Comments

@mattpap
Copy link
Contributor

mattpap commented Jul 27, 2022

After changes to bokehjs' build setup, package.json files, etc., license-checker returns bogus results in production mode, which the test uses:

~/repo/bokeh/bokehjs$ npx license-checker --summary --production
└─ BSD-3-Clause: 1

Otherwise, it returns a lot of licenses that aren't present in bokehjs' bundles:

~/repo/bokeh/bokehjs$ npx license-checker --summary
├─ MIT: 265
├─ ISC: 28
├─ BSD-3-Clause: 15
├─ BSD-2-Clause: 12
├─ Apache-2.0: 11
├─ UNLICENSED: 5
├─ 0BSD: 2
├─ (Unlicense OR Apache-2.0): 1
├─ Python-2.0: 1
├─ (MIT OR Apache-2.0): 1
├─ (MIT OR CC0-1.0): 1
└─ MIT*: 1

Additionally, it reports different licenses in CI and locally.

I disabled this test in PR #12219, to allow to merge this PR. We will have to figure out a more robust way of checking licenses. Also, minified bundles are stripped of licences, whereas unminified bundles contain them.

@bryevdv
Copy link
Member

bryevdv commented Sep 11, 2022

Also, minified bundles are stripped of licences.

This should not be done. People have loudly complained about it in the past. Most licenses are clear about being distributed with published derivative works.

@bryevdv
Copy link
Member

bryevdv commented Feb 10, 2023

I was going to move this out of 3.1 milestone but we need to first confirm that bundles do not strip out licenses.

@mattpap
Copy link
Contributor Author

mattpap commented Feb 10, 2023

I visually confirmed that bokeh*.min.js bundles contain third-party licenses, though it looks like not all of them. It may be due to the minifier not being able to recognize comments with license information (it's customary to use /*! style comments for comments that are expected to be preserved, but not everyone uses those), or such information is not provided in source files.

@ianthomas23 ianthomas23 modified the milestones: 3.1, 3.2 Feb 22, 2023
@mattpap mattpap modified the milestones: 3.2, 3.3 Jun 8, 2023
@mattpap mattpap modified the milestones: 3.3, 3.x Oct 4, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants