abnobdoss commented on issue #13950: URL: https://github.com/apache/skywalking/issues/13950#issuecomment-5155106115
@wu-sheng For Rust specifically, these are the manually maintained source files: the Apache 2.0 license text and the short ASF NOTICE, copied or symlinked from the repo root into each crate directory. A published crate contains only the project's own source code and no dependency code, so its LICENSE and NOTICE never need generated dependency licenses. On the dependency side, I have definitely seen that case in the iceberg ecosystem as well. `iceberg` (Java) has had both issues: missing licenses for bundled dependencies, and dependencies with incompatible licenses. Automating those checks would clearly be valuable, but it is a much bigger feature than what I am raising here. If useful, I can open a separate issue for that conversation so it is documented even if it ends up out of scope, and if the project is open to building it I would be glad to help contribute. The issue listed here is much narrower, so maybe the real question is whether there is appetite for a slim Rust-only check: validate that each crate in a workspace ships a LICENSE and NOTICE, without going anywhere near artifact scanning. Cargo can already print the exact file list a crate would publish, so the check is just confirming those two files are in that list for each crate. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
