Is there a special tooling that github linguist is using for third party software licensing?

Question

I am studying how other libraries handle third party software licensing.

I noticed that github linguist has a separate folder called vendor and inside it uses git submodules and yaml files https://github.com/github/linguist/tree/master/vendor

I notice this pattern of using vendor/licenses and having yaml files inside in other libraries as well.

I am thinking esp with the yaml files, it's meant to be consumed by some kind of tooling.

Is this a standard? What tooling is this? Can i use it for python code libraries?

Answer 1

You could just ask the linguist team to find out which tools they are using.

There is a large number of tools available which intend to help developers with documenting the libraries and dependencies they use, the respective licenses, and with fulfilling the requirements (delivering source code, copyright attribution, license language, etc.)

There are commercial tools, many of which are just an add-on to tools that focus on vulnerability management and you can tell that the FOSS License Compliance is not the initial focus.

There are many open-source solutions which (to my knowledge) as of today are good in some areas (some are just for certain programming languages or DevOp environments, but by far not universal tools, e.g. when you try to provide a licenses.md for an entire container (like Docker).

The most famous here is FOSSology, but we should not forget other projects like Licensee, OSS Review Toolkit (ORT), ScanCode toolkit, FOSSLight , License Maven Plugin, Maven Notice Plugin, Attribution Maven Plugin, License Finder. This list is in no particular order and does not claim to be complete.

I have not used all of these, and I am not recommending anything for any particular purpose. Obviously the times have gone where you had to do all of that manually, check yourself which tool is best for you.

If you know of any tool that is missing in the list you might want to leave a comment under this answer. This should, however, not be used to promote commercial tools and please do not post judgements (like Tool_A is the best, Tool_B is no good).