@evocateur I think this is ready for a review now.

So I'm not sure this is lerna's responsibility? I mean, this sort of thing arguably belongs in a separate CLI, run once to copy licenses etc, or perhaps in a preversion lifecycle in order to validate that the licenses exist, and fail if necessary before lerna publish gets around to actually publishing. npm publish always includes LICENSE.md (and similar) when it finds them.

It is my understanding that the license field of package.json is also sufficient for this sort of thing? As long as it matches an SPDX identifier, it is not strictly necessary to include yet another copy+paste of the license text.

@evocateur That sounds a bit like a turn-down, although in #1213 you seemed to agree with the idea and we even agreed on how this could be implemented. After investing quite some time into the PR, I'm a bit confused now. Do you suggest a different implementation approach or are we revisiting whether this should be a part of Lerna at all?

Almost every project using Lerna (and that's most of the projects utilizing monorepos, and that's a lot of packages in the npm ecosystem) is suffering an issue where the sub packages are not distributed with a full license text when the maintainers only provide the full license text file in the root of the monorepo. While the intention is clear (all the packages are licensed under the root license), the result is debatable. The distributions of packages published to npm are without the license text, thus more strict company lawyers could prohibit using such pacakges or deem them as problematic and requiring special treatment. That brings burden to those wanting to use such packages.

Without full license text, the sub packages are not properly licensed, even though the license field contains a valid SPDX identifier. Some licenses, such as MIT, even explicitly require packing the text together with the distribution, it's written in the text of the license: babel/babel#7308 (comment) Effectively, this way the source code of most Lerna-distributed packages on npm is unlicensed and cannot be used by anyone else (or, to be more precise, by anyone who cares about licensing).

npm does include the license file automatically in case it's present, so this problem wouldn't exist if the project were not monorepos. As Lerna is a tool to help maintainers to deal with specifics of having a monorepo, and especially with specifics of publishing the sub packages, I think this feature should be a core feature of the tool. Moreover, the behavior we discussed in the initial issue requires no additional work to the maintainers. It follows their intentions without having to care about anything, while it automatically solves the licensing problem for all the package users. Factoring the feature out to a separate tool doesn't solve the widespread issue as it requires the users of the packages to file issues on the projects they have problems to use, and it requires maintainers to make additional steps and to modify their project life cycle to accommodate the license distribution.

@honzajavorek Thanks for the push back, I understand a lot better now, and completely agree. Sorry for the scattered skepticism, I've been punishingly busy the last few weeks. I will rebase your changes, since I caused the conflicts.

Thanks again for all your efforts!

Warnings tend to be ignored till it's too late.
Can there be an option to force a failure, --strict-licensing or something? Also being configurable through lerna.json would be great.

@StrahilKazlachev Definitely, I think we can tackle that in a separate PR.

@evocateur Thank you for maintaining Lerna despite the time constraints, for your initial guidance on how to implement this and for merging this! 🚀

This thread has been automatically locked because there has not been any recent activity after it was closed. Please open a new issue for related bugs.