skywalking-eyes compatibility issue with some "Weak Copyleft" Licenses

[FeynmanZhou]

Hi team,

I am a maintainer from the CNCF Notary Project. We are using skywalking-eyes to detect non-compliant licenses in a few repositories.

After the skywalking-eyes version was upgraded from v0.4.0 to v0.5.0 by dependabot in a PR, we noticed the CI check failed due to a dependency's license MPL v2.0 is not in the skywalking-eyes compatibility list, see the detailed logs for context.

According to ASF 3RD PARTY LICENSE POLICY, MPL v2.0 may be accepted in a few conditions although it is under the "Weak Copyleft" Licenses.

Is it acceptable to add MPL v2.0 to skywalking-eyes compatibility list?
Maybe MPL v2.0 is not the only case for this kind of issue. To make license check policy configurable and flexible, is it possible to add a new section to the skywalking-eyes compatibility list for Category-b, which makes it configurable to "Weak Copyleft" Licenses?
If not, do you have any suggestions on mitigating the CI failing issue?

Thanks!

[wu-sheng]

Hi, Catalog B in the ASF means it is usually acceptable as the runtime dependency, but sometimes with some conditions.

@kezhenxu94 What do you think we accept this as a compatible list? Or add an additional accept list for the end users?

[FeynmanZhou]

Thanks for the response. I agree with your opinion. Based on the analysis of Category-B, my thinking is that maybe we can append a new list "compatible-with-conditions" under the skywalking-eyes compatibility list and make this part configurable for users. It will unblock users if they are using any "Weak Copyleft" licenses (Category-B) in their dependencies.

[wu-sheng]

You could work on a PR, I think a new list with a new config(default is OFF) should be good.

[FeynmanZhou]

@wu-sheng I will be available to work on this proposal late this week. Do we need to transfer this Discussion into a GitHub issue, or start a PR directly?

[wu-sheng]

Don't worry about that. Just link this discussion to the PR, we are good.

[Two-Hearts]

Hi @wu-sheng and @kezhenxu94, I have created a PR: apache/skywalking-eyes#171 based on the discussions in this post. Could you kindly review the PR when you have time? Thanks.
/cc: @FeynmanZhou

[kezhenxu94]

What do you think if we add a new section weak-compatible in the list and expose a config accept-weak-license under the dependency section?

[FeynmanZhou]

+1. Sounds a good suggestion.

[FeynmanZhou]

Thanks @Two-Hearts for the contribution. The PR apache/skywalking-eyes#171 is merged so I think we can close this discussion.

@kezhenxu94 @wu-sheng Does skywalking-eyes have a plan to release a new version recently?

[wu-sheng]

We don't have a plan to release soon. As usually, you could use commit ID to bump up to any commit you like.

[FeynmanZhou]

Thanks @wu-sheng for the quick response. SGTM. I will close this discussion.