License dependency bundling

[scopatz]

Hi All! In speaking with @saulshanabrook today, it seems like the new strategy for extension is to bundle all of the JS code together as part of the package, including dependencies. (That is my basic understanding.) Speaking with my conda-forge hat on, this is great news!

I just want to make sure that as part of the bunding & building that the licenses for all JS dependencies make it into a standard place in the package. Without this, we'd end up in a place like with rust/go/etc where it is a huge pain for the 3rd party packager, because they have to go and hunt down all of the licenses for all of the dependencies of an extension in order to be able to redistribute it.

You probably have already thought of this issue, so I apologize if I didn't do enough hunting to find the discussion. I wanted to bring it up here in case you hadn't. Thanks!

[blink1073]

We are already bundling JavaScript today in JupyterLab itself that has been transpiled and packed by Webpack. We don't have a mechanism to extract all of the licenses of the consumed files. It is certainly something that could be added though

[jasongrout]

I hear you. This would be good to add. cf jupyterlab/jupyterlab#4572, and there were some other issues where (IIRC) a debian packager did not like that the jlab package included a blob of javascript.

Getting a list of licenses from all of your npm dependencies seems like it should be a solved problem in the node ecosystem.

[vidartf]

There is the package license-checker that seems pretty robust / well-used ?