#481: License compatibility check ----------------------------+----------------------------------------------- Reporter: guest | Owner: Type: enhancement | Status: new Priority: normal | Milestone: _|_ Component: Cabal library | Version: Severity: normal | Resolution: Keywords: | Difficulty: unknown Ghcversion: | Platform: ----------------------------+----------------------------------------------- Changes (by duncan): * version: 1.6.0.1 => * milestone: => _|_ Comment: This is not as simple or easy as it looks. Firstly, there is nothing wrong with a BSD package depending on a GPL package. The BSD package really can have that license. Of course anyone using the combination of packages is bound by the GPL but that does not mean the BSD package is wrong in any way. It would be useful to notify users of a package of the set of licenses that a package must follow if it depends on a package and all its deps transitively. That could be done on hackage. However actually notifying accurately is not easy because deciding what the dependencies of a package are is hard (NP-hard). The dependencies are also potentially very flexible, so in some configurations we might want to complain and in others not. For example a package that depends on either readline or editline bindings. Or more tricky, suppose you depend on a package and a later version of that package gains a dependency on readline. You could still construct a configuration that avoids readline so do we warn or not? It's also necessarily incomplete because it does not take into account dependencies on foreign libraries. As for proprietary packages, they're not allowed on hackage anyway. People producing proprietary software already need to do a more thorough check than this simple one would be. So how useful is it? At least doing the check at build time makes it a bit easier because it removes all the questions about potential configurations, we're picking a specific configuration and linking everything together. However we're not distributing anything at that point. We do not want to warn about every single utility that people write in-house (which will naturally be `AllRightsReserved`), we would only want to warn at distribution time but we have no way of identifying distribution time for proprietary apps. People running `sdist` may just be distributing internally within a company. -- Ticket URL: http://hackage.haskell.org/trac/hackage/ticket/481#comment:1 Hackage http://haskell.org/cabal/ Hackage: Cabal and related projects