Skip to content

Remove LGPL from permitted licenses list

Sean McGivern requested to merge remove-lgpl-from-permitted-licenses-list into master

This dependency decision goes back to when we first added the LicenseFinder gem: gitlab-foss!3775 (merged)

This is probably because we were using Sidekiq (which is licensed under the LGPL) from before we added the LicenseFinder job: gitlab-foss@c7bb3a1f

However, the license is currently on our unacceptable licenses list: https://about.gitlab.com/handbook/engineering/open-source/#unacceptable-licenses

The existing LicenseFinder configuration allowed any new LGPL dependencies to pass CI with no issues. With this change, we will require individual dependencies that use the LGPL to be approved one-by-one, rather than as a blanket approval for the license itself.

GitLab-internal reference: gitlab-com/legal-and-compliance#672

We cannot restrict the license and still have approvals for individual dependencies, unfortunately: https://github.com/pivotal/LicenseFinder#restricting-licenses

Any dependency that has exclusively restricted licenses will always appear in the action items, even if someone attempts to manually approve or permit it. However, if a dependency has even one license that is not restricted, it can still be manually approved or permitted.

Merge request reports