Skip to content

Attempt to parse licenses and dependencies even without a bower.json #233

Closed

Description

@thomashoneyman

This issue is related to #220, #218, and #211, all of which discuss how to import packages that have a malformed Bowerfile, or a Bowerfile missing a license key, or have no Bowerfile at all (but have other files, such as a spago.dhall file).

I propose that we view this problem from a new angle: how do we get the information necessary to produce a Manifest for a package, regardless of the presence of a Bower or other files?

https://github.com/purescript/registry/blob/c28f98584e9858d3185a3842dd2fca31514574f4/v1/Manifest.dhall#L13-L24

To construct this, we need:

  1. The package name (we get this from the new-packages.json and bower-packages.json files)
  2. The package repository (we get this from the same two files)
  3. The package version (we get this from GitHub tags)
  4. The package license (we get this from the Bowerfile)
  5. The package targets, ie. dependencies and dev dependencies (we get this from the Bowerfile)

We already handle the first three items about as well as we possibly can, but the work in #220, #218, and #211 all have to do with getting the package license and targets. We've started with the idea that we'll just pull everything out of the Bowerfile, but a lot of packages have missing Bowerfiles or Bowerfiles with no license key.

My proposal is that we no longer consider ourselves to be parsing a BowerFile, but rather a license and targets, and it's not necessary that we get that information from a Bowerfile. For example:

  1. We can get the license and/or targets directly from a Bowerfile.
  2. We can get the license and/or targets directly from a Spago file (either by generating a bower.json file or using say spago ls deps).
  3. We can possibly get targets from psc-package files, though I've never used it myself and I'm not sure if it's worth bothering with this.
  4. We can get the license from a package.json file (but not dependencies).
  5. We can get the license from the repository root in the LICENSE file.

So I'm proposing that we attempt to get the license and targets by moving through these steps: read as much information as we can from the Bowerfile, then the Spago file, then the package.json, and finally the LICENSE in the repo root. Only if we can't get the license and targets from any of those sources, or a combination of them, do we fail the package.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions