Check whether extension has an OSI approved license

[filiptronicek]

Fixes #510

How to test

1. Add the following to extensions.json

  "filiptronicek.unlicensed": {
    "repository": "https://github.com/filiptronicek/test-unlicensed-repo"
  },

2. Execute this command and watch the terminal output (also add your own GITHUB_TOKEN, so that the script can request the GitHub API for the license)

GITHUB_TOKEN=xxx EXTENSIONS=filiptronicek.unlicensed node publish-extensions

ToDo

• Make sure licenses are checked in every case, including fetching from GitHub releases
  • Using the GitHub API to check the license should be a last resort, because it is not possible to query a license for a specific time

[filiptronicek]

Published https://www.npmjs.com/package/osi-license-checker

[akosyakov]

Should not we check a revision form which we build vsix file?

[filiptronicek]

Great catch, @akosyakov, I was thinking about doing that, settled on "licenses don't change from commit to commit, right?". In edge cases where a license might be changed, added, or removed, I'll integrate it into the resolveVersion function to avoid otherwise duplicating the code over and over.

publish-extensions/lib/resolveExtension.js

Lines 60 to 71 in 4d65730

	async function resolveVersion(ref) {
	try {
	await exec(`git reset --hard ${ref} --quiet`, { cwd: repoPath, quiet: true });
	const manifest = JSON.parse(await fs.promises.readFile(packagePath, 'utf-8'));
	if (`${manifest.publisher}.${manifest.name}`.toLowerCase() !== id.toLowerCase()) {
	return undefined;
	}
	return manifest.version;
	} catch {
	return undefined;
	}
	}

[filiptronicek]

Just looked into this again, and it seems there is no way to fetch the license for a specific time in the repository, just the current state. I checked with both the REST and GraphQL APIs, the only parameters allowed are name and owner.