-
Notifications
You must be signed in to change notification settings - Fork 341
Description
Description
We are currently adapting a package approval workflow, where packages are approved or blocked based on certain criteria. One very important criterion is the package's license. There is a list of approved licenses (like MIT, Apache, BSD, ...) and a list of licenses that can not be used (like GPL).
Although the Microsoft.Testplatform Nuget packages are under MIT license, it's hard to auto-approve them, because they use an embedded license file instead of an SPDX tag (https://spdx.github.io/spdx-spec/v2-draft/SPDX-license-list/). As a result, the license does not show up in the package's metadata.
The reason for this might be that Directory.Build.props has both a <PackageLicenseExpression>
and a <PackageLicenseFile>
property (and an additional <PackageLicenseFullPath>
property):
Lines 72 to 74 in 1772349
<PackageLicenseExpression>MIT</PackageLicenseExpression> | |
<PackageLicenseFile>LICENSE_MIT.txt</PackageLicenseFile> | |
<PackageLicenseFullPath>$(SrcPackageFolder)licenses/LICENSE_MIT.txt</PackageLicenseFullPath> |
However, nuspec supports only one or the other, but not both at the same time. It seems that the <PackageLicenseExpression>
property is omitted during the build process.
Steps to reproduce
Compare the "About" page of Microsoft.TestPlatform with Microsoft.Data.SqlClient, where the latter clearly states the package's license, while Microsoft.TestPlatform does not. Another example would be Microsoft.NET.Test.Sdk
Expected behavior
I would expect the corresponding nuspec files within the Nuget packages to contain a line like <license type="expression">MIT</license>
and tools to be able to display "MIT" as the license of those packages.
Actual behavior
The nuspec file contains the line <license type="file">LICENSE_MIT.txt</license>
and tools (including nuget.org) are not able to determine the license from that.