Include list of all dependencies and their licenses in any release

[andrewdavidmackenzie]

Downstream users of this repo would like to know the licenses that apply to it and all of it's transitive dependencies.

The request is for releases of this repo to have a structured file (cv, json, xml preferred) containing at least the following information:

• list of all transitive dependencies
• for each dependency:
  • name and version
  • name of the license that applies to the dependency
  • url to the license text

[mikz]

Though about this long and hard.

I could not find any decent lua package manager that would lock dependencies and be able to say what are the exact versions being used.

Only reasonable way of doing this is scan the luarocks install tree and find out what is installed after it was installed. That rules out license_finder.

This step can be done in the build phase.

[mikz]

rover inspect  --roverfile gateway/Roverfile

luafilesystem	 	1.7.0-2	 	MIT/X11
router	 	2.1-0	 	MIT
ldoc	 	1.4.6-2	 	MIT/X11
lua-resty-http	 	0.11-0	 	2-clause BSD
lua_cliargs	 	3.0-1	 	MIT <http://opensource.org/licenses/MIT>
lua-resty-env	 	0.4.0-1	 	Apache License 2.0
luasystem	 	0.2.1-0	 	MIT <http://opensource.org/licenses/MIT>
luassert	 	1.7.10-0	 	MIT <http://opensource.org/licenses/MIT>
busted	 	2.0.rc12-1	 	MIT <http://opensource.org/licenses/MIT>
lua-resty-execvp	 	0.1.0-1	 	Apache License 2.0
say	 	1.3-1	 	MIT <http://opensource.org/licenses/MIT>
lua-resty-jwt	 	0.1.11-0	 	Apache License Version 2
lua-term	 	0.7-1	 	MIT/X11
penlight	 	1.5.4-1	 	MIT/X11
lua-resty-url	 	0.2.0-1	 	Apache License 2.0
lua-resty-iputils	 	0.3.0-1	 	MIT
argparse	 	0.5.0-1	 	MIT/X11
inspect	 	3.1.0-1	 	MIT <http://opensource.org/licenses/MIT>
liquid	 	scm-1	 	BSD-2-Clause
mediator_lua	 	1.1.2-0	 	MIT <http://opensource.org/licenses/MIT>
markdown	 	0.33-1	 	MIT/X11
lua-resty-repl	 	0.0.6-0	 	MIT <http://opensource.org/licenses/MIT>
dkjson	 	2.5-2	 	MIT/X11

We include all dependencies, but should be easy to limit it to some group (like production) 3scale/lua-rover#7.

[davidor]

Releases now include a licenses.xml with the information requested in the issue.