Preserve license comments

[guybedford]

We can read this out of the original sources in the compilers at https://github.com/systemjs/builder/tree/master/compilers from the load.source value. It can then be included in the bundle output.

The above would work but wouldn't hoist all the license comments to the top. If hoisting of license comments is preferable, we could handle the reading of license comments reading from tree[name].source just before https://github.com/systemjs/builder/blob/master/lib/compile.js#L152, maintaining the license comments as its own array before injection at the end.

[Munter]

You might want to talk to @papandreou about this when you're in Copenhagen. I think we did something like this in Assetgraph as well which might be reused

[tniswong]

It's important that license comments are also included for imported third-party libraries such as Bootstrap/Angular/etc.

Babel also provides a config option called shouldPrintComment, which could be handy as well if applied to the entire JSPM packaging / minification process.

[lookfirst]

I've been thinking about this a bit... what if instead of putting the licenses in the source code and making the bundled downloads unnecessarily larger for the end user... instead the system would read the package.json and/or look for a LICENSE.* file for each imported project in the jspm_packages folder.

The build would then concat all the licenses together into a single file and add a single line to the bundle that is a reference to that combined license file. Almost like what happens with the reference to the source mapping file.

// /combined-licenses.txt

[brycecr]

I'm also interested in this and would throw my hat in in support of @lookfirst 's suggestion, presuming that it satisfies the licenses. Deferred loading, especially only on demand, would be really nice. However, that requires browser support, at least for the same technique as source maps.

[jrabbe]

While I support @lookfirst's suggestion, I have to voice a warning. Several of the licenses used by open source projects require the copyright statement attached to the work itself. Although I guess the lawyers are still out on what that exactly means, the most common is to add headers to the source files. This would mean the LICENSE.* files wouldn't necessarily be enough.

That said, if the license headers from the source files could be extracted and combined together with the terms from the LICENSE.* files I would be all for it.

[lookfirst]

The license type is also in the package.json, so that could be used as the indicator of whether or not to bundle with the source and/or in a separate file.

That said, given that a bundle is effectively a 'binary' distribution, I think that a project or court of law would have a hard time countering a best effort attempt at sideways distribution of the proper information.

I'm not a lawyer, but I have been involved in open source for a very long time (20+ years) and I've never heard a case like what you describe. I really dislike the idea that the end user should have to suffer with a larger/slower download just because of that potential issue.

[jrauschenbusch]

I've made some thoughts about this topic. Maybe by the progress related to issue #489 this ticket can take a bit more momentum again.

Problem sources of a bundled LICENSE file

• Each dependency must contain a LICENSE file (matched by /^LICENSE.*/), which is not the case.
  • problem of possible missing licenses
• The content of LICENSE files is often too comprehensive than really needed
  • problem of very large/slow downloads (mentioned by @lookfirst)

General questions:

• How can license comments be automatically be differiantated from regular code comments?
• What are the technical challenges to get the preserveComments feature inside the code base?

Possible solution

• Concatenation of all found LICENSE files of each dependency referenced from inside the bundle
• Option to insert a relative link to the bundled LICENSE file at top of the bundle
  • Advantage: no special browser support needed like mentioned by @brycecr
  • Assumption: Bundled LICENSE file is located beside the bunde.js
• Option to preserve all license comments found in the sources
• Option to enable the hoisting of license comments

[asapach]

I thought Uglify already supports this: https://github.com/mishoo/UglifyJS2#keeping-copyright-notices-or-other-comments

[brycecr]

Hey, thanks for circling back to this topic. Looks like a good plan so far. Just a few comments of mine based on @jrauschenbusch 's thoughts:

Each dependency must contain a LICENSE file (matched by /^LICENSE.*/), which is not the case.

The only 100% solution I've thought of is to inform the user of missing licenses.

The content of LICENSE files is often too comprehensive than really needed

Sometimes it is the full text of the license, sometimes there are actually multiple licenses and the user has to specify which it wants to use.

How can license comments be automatically be differentiated from regular code comments?

This actually isn't very hard for the 90% case because licenses have well known wording, so you just look for the sequences you know correspond to the license. Edge cases will be difficult...

Personally, I would like to see part of this change include a way to notify the user of missing licenses, because users of this feature are interested in compliance, which needs to be complete. I am not sure, however, if that really falls within the scope of SystemJS. Would defer to you guys on that, of course.

[jrauschenbusch]

Ok, maybe the most pragmatic solution would be to use the already existing feature of UglifyJS, like mentioned by @asapach. Then only a possibility for hoisting comments would be additionally needed.

I think the scope of the LICENCE file feature should maybe tracked by another project, because it's not only a thing relevant to SystemJS. The only fact related to SystemJS would be which liberaries are imported/used by the application.

Any thoughts?