skywalking-eyes doesn't seem to cover handling of BSD-2-Clause and ASF dependencies?

[linghengqian]

• I noticed the following Error Log at Add dependency detection linghengqian/hive-server2-jdbc-driver#9 . Refer to https://github.com/linghengqian/hive-server2-jdbc-driver/actions/runs/10661185543/job/29546313641?pr=9 .

WARNING Failed to resolve the license of <org.apache.hadoop.thirdparty:hadoop-shaded-guava>: failed to resolve license file found in jar 
WARNING Failed to resolve the license of <org.apache.zookeeper:zookeeper>: no possible license found 
WARNING Failed to resolve the license of <com.google.guava:failureaccess>: no possible license found 
WARNING Failed to resolve the license of <com.google.guava:listenablefuture>: no possible license found 
WARNING Failed to resolve the license of <org.apache.zookeeper:zookeeper-jute>: no possible license found 
WARNING Failed to resolve the license of <org.slf4j:slf4j-api>: no possible license found 
ERROR the following licenses are unknown or incompatible with the main license, please check manually: Apache-2.0
Dependency                                       |                                            License
------------------------------------------------ | --------------------------------------------------
org.apache.hadoop.thirdparty:hadoop-shaded-guava |                                            Unknown
org.apache.zookeeper:zookeeper                   |                                            Unknown
com.google.guava:failureaccess                   |                                            Unknown
com.google.guava:listenablefuture                |                                            Unknown
org.apache.zookeeper:zookeeper-jute              |                                            Unknown
org.slf4j:slf4j-api                              |                                            Unknown
org.codehaus.woodstox:stax2-api                  | http://www.opensource.org/licenses/bsd-license.php 
ERROR one or more errors occurred checking license compatibility

• skywalking-eyes considers BSD-2-Clause and another set of ASF dependencies as incompatible with Apache-2.0.
• I wonder if this is something that can be improved in skywalking-eyes, or if these dependencies are indeed incompatible with Apache-2.0? The license text of Apache-2.0 does not specify which LICENSEs it is compatible with, but I saw at https://www.apache.org/legal/resolved.html that BSD-2-Clause does not break Apache-2.0.

[wu-sheng]

I think the key is UNKNOWN means the license is not identified. Not about BSD-2. It may need some manual adding. @kezhenxu94

[wu-sheng]

https://www.apache.org/legal/resolved.html This page is right. Licenses in Catalog A and B usually mean safe in the dependencies.

[kezhenxu94]

Some dependencies can not be identified by skywalking-eyes tool, you can either help to improve the tool itself to make it identify those dependencies, or, manually add the licenses for the unknown dependencies

[kezhenxu94]

Example

skywalking/.licenserc.yaml

Line 83 in 1ef6334

licenses:

[linghengqian]

• Thanks for the clarification, I fixed it by configuring as follows.

  licenses:
    - name: org.apache.hadoop.thirdparty:hadoop-shaded-guava
      version: 1.1.1
      license: Apache-2.0
    - name: org.apache.zookeeper:zookeeper
      version: 3.6.3,3.8.3
      license: Apache-2.0
    - name: com.google.guava:failureaccess
      version: "1.0"
      license: Apache-2.0
    - name: com.google.guava:listenablefuture
      version: 9999.0-empty-to-avoid-conflict-with-guava
      license: Apache-2.0
    - name: org.apache.zookeeper:zookeeper-jute
      version: 3.6.3,3.8.3
      license: Apache-2.0
    - name: org.slf4j:slf4j-api
      version: 1.7.30
      license: MIT
    - name: org.codehaus.woodstox:stax2-api
      version: 4.2.1
      license: BSD-2-Clause

• I saw some additional issues from https://github.com/apache/skywalking/blob/master/.licenserc.yaml .

skywalking/.licenserc.yaml

Line 86 in 1ef6334

license: Apache-2.0

1. According to https://central.sonatype.com/artifact/org.slf4j/slf4j-api/1.7.30 , org.slf4j:slf4j-api:1.7.30 is MIT, not Apache-2.0.
2. YAML seems to automatically recognize 1.0 as a number, not a string. I'm not sure if not setting the quotes is a syntax sugar for skywalking-eyes. I had to do the following to avoid the string 1.0 being recognized as type number in IntelliJ IDEA.

    - name: com.google.guava:failureaccess
      version: "1.0"
      license: Apache-2.0

• Of course the current discussion can actually be closed. I've never written Golang code directly, so it's hard for me to say I know how to improve https://github.com/apache/skywalking-eyes .

[kezhenxu94]

1. Thanks, i’ve created a PR to fix the wrong license Fix license for Slf4j #12589
2. By default 1.0 will be considered as an int in IDE, because skywalking-eyes use type string for field version so it is not an issue