Show information of all dependencies

[gnzlbg]

It would be nice to have an option to recursively query information of all dependent crates.

Imagine I want to ship a binary, and would like to include the license / copyright of all crates that the binary uses. Ideally, I should be able to just do cargo info --license --all and that should output it to the screen.

Another user would be crates.io itself. Lot's of crates say they have the Apache license, but then rely on dependencies with licenses that I bet nobody has checked, or that might change between releases.

I would like crates.io to tell me that a package has the Apache license, and that all its dependencies have so as well, so that I know that by using it I wouldn't be pulling in any crate with an incompatible license.

This would make it much easier to use Rust / cargo in companies that ship software.

[maghoff]

I've started on something to this effect. I tailor-made it to my present use-case, but it might be reusable or extendible beyond that. In case it is of interest: https://github.com/maghoff/cargo-license-hound

[lunixbochs]

I couldn't get cargo-license-hound to work on my mac, so I wrote this, which just uses cargo metadata and github to get the actual license text and print it, preferring MIT when dual licensed where possible just to limit the number of long licenses.

https://bochs.info/p/nhgj9h

[epage]

We offer cargo metadata to get a certain form of dependency information. We lack the more particulars of platform/build-target/feature combinations but have issues on those.

cargo info is being tracked in #948. Doing all of the licensing work for you is unlikely to happen though.

Some existing tools that resolve the licensing workflows

• https://github.com/EmbarkStudios/cargo-deny can help with license verification
• https://github.com/EmbarkStudios/cargo-about can help with generating notices

As this issue seems to be focused on the querying of dependencies and that is offered, I'm going to go ahead and close this. If there is interest in resolving specific use cases (generating notices, license verification), I'd recommend creating dedicated issues.