File Type Licenses

[MarvinZacher]

When I add a package as a dependency which contains a commercial license I get the error Validation for licenses of type File not yet supported

Dependency.csproj

...
<PropertyGroup>
<PackageLicenseFile>LICENSE.txt</PackageLicenseFile>
</PropertyGroup>
...
<ItemGroup>
<None Include="LICENSE.txt" Pack="true" PackagePath="" />
</ItemGroup>
...

Expected result

In the output I'd expect the json output to be something like

{
...
"License": "<first line of LICENSE.txt>",
"LicenseHeading": "<first line of LICENSE.txt, maybe this if someone parses the License field for valid license expressions>",
"LicenseUrl": "<empty or maybe from an --license-title-to-licenseurl-mappings map?>",
...
}

And the -d argument to copy the contents of the LICENSE.txt.

Remarks

As Microsoft deprecated PackageLicenseUrl only File and Expression are left. But an expression doesn't work with a custom license and results in https://learn.microsoft.com/en-us/nuget/reference/errors-and-warnings/nu5124.

I've seen that there is a override argument but this won't help if I have lots and lots of dependencies. My usecase would be automated license checking&storage in CI Pipelines.

[sensslen]

Hi @MarvinZacher, the only option you have for now is to use the override method. Implementing a way to determine the license from a file is a challenging task that has not yet been done for nuget-license. Feel free to come up with s solution and provide a PR. I'll be happy to look at it. Note that the license text will not always match 100% though, as there are fields in almost every license to contain the author and such. All this needs to be accounted for. As far as I know, GitHub provides an API to determine the license of a project so it implements a way to determine the license. Maybe this would be a viable option.

The solution you propose I think would not be a good one, as nuget-license has always been about validating licenses against a set of allowed licenses. Therefore simply printing the license will not cut it, as there is no way to verify whether the license text matches an allowed license or not.