Libraries function returns non-licensed vendored package as the package with LICENSE from root project

[spankratov]

Steps to reproduce:

1. Create Go project with some external package as dependency and run go mod vendor to place this package inside vendor folder
2. Delete LICENSE file from this package inside vendor folder
3. Run go-licenses report or go-licenses check on your project. The command lists external package as package without a license (as it should be)
4. Now add some default LICENSE in the root folder of your project. Project folder looks like this: go.mod go.sum LICENSE main.go vendor/
5. Run go-licenses report or go-licenses check on your project again. Now commands consider external package as having LICENSE from the root project folder: go-licenses check doesn't fire an error and go-licenses report doesn't list external package at all (considering this as the part of root project).

I guess it's because when Libraries function calls Find function, it passes p.Module.Dir as rootDir (which is nil for vendored packages for some reason) and then Find does rootDir, err = filepath.Abs(rootDir), nil turns into working directory (root package folder) and findUpwards looks for license file until it finds it in root package folder.

[Bobgy]

If the vendor folder is not modified, a simple workaround can be:

1. Delete vendor folder
2. Check licenses

[Bobgy]

p.Module.Dir as rootDir (which is nil for vendored packages for some reason)

vendored modules do not have full metadata, as far as I know, this is working as intended.

[Bobgy]

then Find does rootDir, err = filepath.Abs(rootDir), nil turns into working directory (root package folder)

This seems unexpected, can we infer a vendor dir and set a correct root package folder?

Looks like you already did some investigations, contribution welcomed!

[Bobgy]

There were some special handling for vendored packages in

go-licenses/licenses/library.go

Line 152 in 5eedde1

if lib.module != nil && lib.module.Path != "" && lib.module.Dir == "" {

You might consider doing a similar check and infer root path of package.

[jaxesn]

I took a pass at fixing this after running into something similar would appreciate any feedback and other thoughts/issues I may fully understand. #178