Cargo IANAL

[Stebalien]

It would be really nice to have a cargo command that analizes all dependencies and:

1. Verifies that the licenses are compatible.
2. Informs the user about any additional use/distribution restrictions.
3. Helps the user choose an appropriate license (if not already specified).

This doesn't have to cover all licenses, just the common ones (MIT, Apache2, the GPLs, the BSDs, etc...).

[huonw]

Do you know of any preexisting data for 1 and 2 that cargo can reuse?

[Stebalien]

For 1, there's this for GPL compatibility... That's why I said we should start with common ones. Unfortunately, license compatibility is not transitive so a full license compatibility matrix is very verbose.

[ticki]

Big 👍. It would be very nice to have such feature.

[rphmeier]

This, or something like it, is really necessary in my eyes. Since you can easily rack up tons of transitive dependencies with just a couple direct ones, it would be nice to have a tool like this.

I don't know if there's a 'crates.io user agreement' but there should also be some kind of terms you have to agree to before uploading your crate which states that the license you specify in your Cargo.toml overrides any other licenses in your repository, for those rare cases someone might put down MIT and actually uses GPL.

IANAL, not sure how fully legally binding that would be.

[jethrogb]

Automated license-compatibility checking is really complicated if not impossible. For example, there is no automated way to tell the difference between a derived work and a combined work. The main problem here is that you don't want Cargo to have something declared OK which turns out to be not OK.

It would be nice though to have a command that lists all dependencies and their licenses.

[Stebalien]

Automated license-compatibility checking is really complicated if not impossible.

This isn't automated license-compatibility checking. This is automated project compatibility checking using a precomputed license compatibility matrix of common licenses. (see the gnu link above). This is totally doable for a small set of well understood, common licenses.

[jethrogb]

Just came across this somewhat relevant article today: Streamlining license compliance with FOSSology 3.0

[Nemo157]

I've been meaning to do something like this for a while and finally got round to finishing my prototype and pushing it to github: https://github.com/Nemo157/cargo-lichking.

[ticki]

A basic matrix, which should cover the majority of cases:

COMPATIBLE WITH >  PD  MIT  BSD  AL  LGPL  LGPL+  LGPL3  MPL  GPL  GPL+  GPL3  AGPL
Public Domain      ✔   ✔    .    .   .     .      .      .    .    .     .     .
MIT                .   ✔    ✔    .   .     .      .      .    .    .     .     .
BSD-new            .   .    ✔    ✔   ✔     ✔      ✔      ✔    .    .     .     .
Apache 2.0         .   .    .    ✔   .     .      ✔      .    .    .     .     .
LGPLv2.1           .   .    .    .   ✔     .      .      .    ✔    ✔     .     .
LGPLv2.1+          .   .    .    .   ✔     ✔      ✔      .    ✔    .     .     .
LGPLv3(+)          .   .    .    .   .     .      ✔      .    .    .     ✔     .
MPL 1.1            .   .    .    .   .     .      .      ✔    .    .     .     .
GPLv2              .   .    .    .   .     .      .      .    ✔    .     .     .
GPLv2+             .   .    .    .   .     .      .      .    ✔    ✔     ✔     .
GPLv3(+)           .   .    .    .   .     .      .      .    .    .     ✔     ✔
AGPL               .   .    .    .   .     .      .      .    .    .     .     ✔

[tbu-]

@ticki Are these licenses really that incompatible? Can't I have a GPL program that has a Apache or MIT dependency?

[Nemo157]

@tbu- according to Wikipedia, gnu.org and http://www.dwheeler.com/essays/floss-license-slide.html you can. Maybe @ticki's matrix is assuming the compatability is transitive and not showing that explicitly?

[burdges]

@ticki's matrix is completely wrong, maybe even if you check everything under the diagonal.

If you've no problem with any common licenses, then you only need to worry about mutual incompatibilities, probably only Apache vs (L)GPLv2 and MPL 1 vs GPL. Now the GPLv3 has resolved compatibility issues with Apache and [https://www.fsf.org/blogs/licensing/mpl-2.0-release](MPL 2 resolved compatibility issues with the GPL).

At this point, I think the major source of problems for common licenses issue is Apple's AppStore restrictions, which seem incompatible with third parties developers using GPLed libraries. There are rumors the FSF might eventually develop an AppStore amenable license based around reproducible builds, but that's probably years off.

[ticki]

@burdges @Nemo157 @tbu- It is based on the fact that these licenses are transitive with each other. If you extend the set, it might not be transitive, though.

[Stebalien]

@ticki That's why we need something more extensive than a simple matrix.