4

I'm working on a website that I plan to release as open source, and also publish it to a web host so that people can actually use it. The website uses Angular, and I used Angular CLI to create it. In order to install Angular CLI, I used npm.

I'm at the point in development where I want to host the website, but I want to make sure I comply with the licenses. It seems that when I use ng build --prod Angular CLI creates a dist folder where it puts the build files. It automatically creates a file called 3rdpartylicenses.txt, which I assume is some attempt to collect the licenses for you.

However, it seems that the automatically generated 3rdpartylicenses.txt is missing some libraries. For example, if I do npm ls --prod, the 3rdpartylicenses.txt only contains about half of those. For example, I'm pretty sure that rxjs is a dependency of Angular, but it isn't listed anywhere in 3rdpartylicenses.txt. Other libraries that I installed through npm are also missing (even though they show up in package.json).

I'm still new to npm and js, so maybe I am missing something, but does this mean that the only way to make sure you list all the licenses is to manually go through all the repositories and their dependencies and copy the licenses over each time? This seems like a very time consuming step and I'm guessing that other people must have run in to a similar workflow issue.

  • rxjs is a peer dependency of angular. I'm pretty sure 3rdpartylicenses.txt only includes libraries you import ie get compiled to the output. For example, I have 2 apps in the same project app 1 imports lib A app 2 doesn't, only app 1's 3rdpartylicenses.txt has lib A's license. – William Lohan Jan 2 at 23:11
2

Going through them manually is one way, but you could also try a tool such as FOSSology which scans all files in a software project to determine the licenses. It is both a command line program and accessible through a web interface that displays the results of a scan.

You mentioned that your automatically generated 3rdpartylicenses.txt was missing some licenses. This tool is specifically designed for accuracy in detecting licenses:

Nomos is one of FOSSology's license scanners. Nomos does license identification using short phrases (regular expressions) and heuristics, e.g. a phrase must be found in (or out of) proximity to another phrase or phrases. This helps to eliminate false positives.

I have not used this tool, but it seems to be what you are looking for. Judging by the screen shots and this methodical review (starts on page 18), which found 100% accuracy in three test cases, it seems to be accurate indeed.

  • 1
    I am terribly biased.... but I would recommend to use instead github.com/nexB/scancode-toolkit that I maintain... Among other things it is aware and detects node modules and my benchmarks show that it detects more license and more accurately than other scanners out there. – Philippe Ombredanne Aug 22 '17 at 13:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.