Including licenses in distributed package archives?

[bollwyvl]

Thanks for vale!

It appears that (at least) the latest Microsoft and Google packages do not contain the LICENSE file from the repository in their distributed media.

Concretely, on this repo: this could be documented as an additional meta.json field (e.g. "license_files": ["path-to-license-file", "path-to-upstream-license-file"]) rather than expecting a specifically-named file. Checking that this key exists, and the references paths exist in the as-downloaded archive, could be automated for PR review.

After there is a documented approach, this would then be worthwhile to add to the "first-party" repackagings in this org, and encourage others (such as RedHat) to include this information.

As for those first-party ones (and the list of license files): attribution in the README is good, but it seems like distributing the upstream's additional documents (e.g. Microsoft's MIT, CC and ThirdParty) might actually be required to meet the intent of the license granted to downstreams, even if a hard requirement isn't triggered by this manner of derived work in all cases.

Motivation: I am interested in re-re-packaging some of these archives for conda-forge (as well as integrating with our re-packaging of hunspell-en), which pretty much requires accurate attribution to be accepted. Assembling all these from source is... fine, but historically has been difficult to keep accurate at scale, whereas a convention-based approach (e.g. spacy-models) has worked well.