License data quality improvements
Summary
GitHub now uses package registries like npmjs.org and PyPI to determine license information for software components in the dependency graph. This improves the accuracy and completeness of the licenses shown… The post License data quality improvements appeared first on The GitHub Blog .
Original Text
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd"> GitHub now uses package registries like npmjs.org and PyPI to determine license information for software components in the dependency graph. This improves the accuracy and completeness of the licenses shown in dependency insights, software bills of materials (SBOMs), the open source license compliance feature in GitHub Advanced Security, and the dependency review action.
Previously, the primary source of license information on GitHub was the ClearlyDefined service. While we still use and contribute to ClearlyDefined, we’ve found that its focus on depth-first file scanning led to complex results that users found confusing. We’ll still fall back to ClearlyDefined data, but will now prioritize license information from the package registries. Early results show that we’ve cut the number of missing licenses in half, from 45% of the 170 million packages in the dependency graph down to 24%. Additionally, the system now tracks version ranges instead of requiring a specific database entry for every version, so the actual coverage will be higher.
To explain further, the dependency graph service now uses metadata from the canonical registry for a given package ecosystem, as described in the following table.
Package Manager
Registry
npm
npmjs.org
NuGet
nuget.org
Python
pypi.org
Rubygems
rubygems.org
Rust
crates.io
Go
pkg.go.dev
Maven
deps.dev
Dart
pub.dev
PHP
packagist.org
The dependency graph service keeps license history based on version ranges. For example, Grafana, which relicensed from Apache to AGPL, has two entries: one covering 1.0.0 through 7.5.17 for Apache-2.0, and one from 8.0.0 or newer for AGPLv3. This both reduces the complexity of the database and provides license information for new versions without requiring each one to be added explicitly.
Updated license information is available now across all of GitHub.
Join the discussion within GitHub Community.
The post License data quality improvements appeared first on The GitHub Blog.
News Radar provides aggregated summaries. Full content and copyright remain with the original publisher.