[GitHub] [incubator-pekko] mdedetrich commented on issue #151: Investigate how to scan for problematic licenses

["mdedetrich (via GitHub)" <gi...@apache.org>]

mdedetrich commented on issue #151:
URL: https://github.com/apache/incubator-pekko/issues/151#issuecomment-1423865583

   So I am under the impression that rat and sbt-header are solving different problems. sbt-header is just checking for license text within the project as well as updating license headers when a file is touched (typical example of this is bumping the copyright year). On the other hand Apache Rat is for checking licenses although from their website it isn't clear how this is done (I haven't actually used Apache Rat), i.e. if its actually checking for dependencies (direct and transitive).
   
   If we are talking about checking for the licenses of dependencies (direct and transitive) there is also another option, [sbt-license-report](https://github.com/sbt/sbt-license-report). I have used this before in open source projects as well as companies and can vouch for it. Its configurable, both in how it does license detection and also what the generated report looks like
   
   In any case I wouldn't throw away sbt-header, its already set up and working and most importantly we know its working because its actually found cases of incorrect headers and its also integrated into our CI to make sure that no one can commit incorrect headers. If sbt-rat (which uses Apache Rat underneath) helps us get through the Incubator PMC we can look into it but depending on how Apache Rat does "license detection" there may be far simpler solutions.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@pekko.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@pekko.apache.org
For additional commands, e-mail: notifications-help@pekko.apache.org