{"action":"created","issue":{"url":"https://api.github.com/repos/npm/npm/issues/4473","labels_url":"https://api.github.com/repos/npm/npm/issues/4473/labels{/name}","comments_url":"https://api.github.com/repos/npm/npm/issues/4473/comments","events_url":"https://api.github.com/repos/npm/npm/issues/4473/events","html_url":"https://github.com/npm/npm/issues/4473","id":25473344,"number":4473,"title":"Strongly encourage setting \"license\" and \"licenses\" in package.json","user":{"login":"garthk","id":15906,"avatar_url":"https://avatars.githubusercontent.com/u/15906?v=3","gravatar_id":"","url":"https://api.github.com/users/garthk","html_url":"https://github.com/garthk","followers_url":"https://api.github.com/users/garthk/followers","following_url":"https://api.github.com/users/garthk/following{/other_user}","gists_url":"https://api.github.com/users/garthk/gists{/gist_id}","starred_url":"https://api.github.com/users/garthk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/garthk/subscriptions","organizations_url":"https://api.github.com/users/garthk/orgs","repos_url":"https://api.github.com/users/garthk/repos","events_url":"https://api.github.com/users/garthk/events{/privacy}","received_events_url":"https://api.github.com/users/garthk/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/npm/npm/labels/feature-request","name":"feature-request","color":"ACE1AF"},{"url":"https://api.github.com/repos/npm/npm/labels/patch-welcome","name":"patch-welcome","color":"e102d8"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":47,"created_at":"2014-01-13T00:26:55Z","updated_at":"2015-05-20T00:35:27Z","closed_at":"2015-05-08T16:43:35Z","body":"Specifying [license] in `package.json` makes it a lot easier for users to find and comply with [GNU Affero] licenses. \r\n\r\nAlso giving `licenses` (an array of objects with `type` and `url` keys) helps  users whose legal departments request both the license name *and the text*. See this example from [async]:\r\n\r\n      \"licenses\": [{\r\n        \"type\": \"MIT\",\r\n        \"url\": \"https://github.com/caolan/async/raw/master/LICENSE\"\r\n      }]\r\n\r\nIf npm \\[had] `WARN`-ed about missing `license` and `licenses` like it did missing `description`, `repository`, and `README`, my current task would be a lot easier. \r\n\r\nSolid `license` and `licenses` adoption might also help Node adoption by large companies. If I find any problematic licenses during this mostly manual search — especially buried amongst the dependencies of framework packages like `express`, `connect`, or `restify` — it'll cause the kind of chaos that \\[unfairly] entrenches hostility against new platforms. \r\n\r\nThough `licenses` isn't specified in the [npm package.json spec][license], it *is* supported by the NPM site, as you'll see if you check [async's NPM page][async]. So, I guess we've also got a doc-bug. \r\n\r\n[GNU Affero]: http://www.gnu.org/licenses/agpl-3.0.html\r\n[async]: https://npmjs.org/package/async\r\n[asyncpj]: https://github.com/caolan/async/blob/master/package.json\r\n[license]: https://npmjs.org/doc/json.html#license"},"comment":{"url":"https://api.github.com/repos/npm/npm/issues/comments/103706577","html_url":"https://github.com/npm/npm/issues/4473#issuecomment-103706577","issue_url":"https://api.github.com/repos/npm/npm/issues/4473","id":103706577,"user":{"login":"rlidwka","id":999113,"avatar_url":"https://avatars.githubusercontent.com/u/999113?v=3","gravatar_id":"","url":"https://api.github.com/users/rlidwka","html_url":"https://github.com/rlidwka","followers_url":"https://api.github.com/users/rlidwka/followers","following_url":"https://api.github.com/users/rlidwka/following{/other_user}","gists_url":"https://api.github.com/users/rlidwka/gists{/gist_id}","starred_url":"https://api.github.com/users/rlidwka/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rlidwka/subscriptions","organizations_url":"https://api.github.com/users/rlidwka/orgs","repos_url":"https://api.github.com/users/rlidwka/repos","events_url":"https://api.github.com/users/rlidwka/events{/privacy}","received_events_url":"https://api.github.com/users/rlidwka/received_events","type":"User","site_admin":false},"created_at":"2015-05-20T00:35:27Z","updated_at":"2015-05-20T00:35:27Z","body":"> But again, npm is just one source. And npm itself is not just for node.\r\n\r\nOh right, I forgot one point that `package.json` is used by other libraries as well, and putting SPDX identifier there contradicts even CommonJS 1.0 standard npm claims to support:\r\n\r\n> licenses - array of licenses under which the package is provided. This property is not legally binding and does not necessarily mean your package is licensed under the terms you define in this property. Each license is a hash with a \"type\" property specifying the type of license and a url property linking to the actual text. If the license is one of the [official open source licenses](http://www.opensource.org/licenses/alphabetical) the official license name or its abbreviation may be explicated with the \"type\" property. If an abbreviation is provided (in parentheses), the abbreviation must be used.\r\n>\r\n> ```json\r\n> \"licenses\": [\r\n>   {\r\n>       \"type\": \"GPLv2\",\r\n>       \"url\": \"http://www.example.com/licenses/gpl.html\",\r\n>   }\r\n>]\r\n>```\r\n\r\nThus, third party tools implementing CommonJS (like I don't know, Bower?) would have a problem with this. I know the name differs, but considering the history of npm, one would assume the same data type applies to \"license\". That would be an additional argument for https://github.com/npm/npm/issues/8222."}}