Skip to content

Don't combine PackageLicenseExpression and PackageLicenseFile (only use PackageLicenseExpression for MIT licensed packages) #4816

@szimmer-dap

Description

@szimmer-dap

Description

We are currently adapting a package approval workflow, where packages are approved or blocked based on certain criteria. One very important criterion is the package's license. There is a list of approved licenses (like MIT, Apache, BSD, ...) and a list of licenses that can not be used (like GPL).

Although the Microsoft.Testplatform Nuget packages are under MIT license, it's hard to auto-approve them, because they use an embedded license file instead of an SPDX tag (https://spdx.github.io/spdx-spec/v2-draft/SPDX-license-list/). As a result, the license does not show up in the package's metadata.

The reason for this might be that Directory.Build.props has both a <PackageLicenseExpression> and a <PackageLicenseFile> property (and an additional <PackageLicenseFullPath> property):

<PackageLicenseExpression>MIT</PackageLicenseExpression>
<PackageLicenseFile>LICENSE_MIT.txt</PackageLicenseFile>
<PackageLicenseFullPath>$(SrcPackageFolder)licenses/LICENSE_MIT.txt</PackageLicenseFullPath>

However, nuspec supports only one or the other, but not both at the same time. It seems that the <PackageLicenseExpression> property is omitted during the build process.

Steps to reproduce

Compare the "About" page of Microsoft.TestPlatform with Microsoft.Data.SqlClient, where the latter clearly states the package's license, while Microsoft.TestPlatform does not. Another example would be Microsoft.NET.Test.Sdk

Expected behavior

I would expect the corresponding nuspec files within the Nuget packages to contain a line like <license type="expression">MIT</license> and tools to be able to display "MIT" as the license of those packages.

Actual behavior

The nuspec file contains the line <license type="file">LICENSE_MIT.txt</license> and tools (including nuget.org) are not able to determine the license from that.

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions