-3

npm packages have a standard way to define which license an uploaded package is licensed under. In the package.json there is a field called license which should contain a SPDX license id.

Is there any reason why I would need to also include a "LICENSE" file?

As I see it there is no uncertainty at all of which exact license text the package is licensed under, since it refers to an id which can be used to lookup the license text.

  • 2
    The form of the license may be specified, but not the specifics - for the MIT license, for example, what is the year and who are the copyright holders? – jonrsharpe Oct 4 '17 at 10:37
  • Very good question. I guess I haven't really thought about that information at all 🤔 – Linus Unnebäck Oct 4 '17 at 11:37
4

I am no a lawyer. The way I see it, the license field in the package.json (or other similar mechanisms) is mainly to sort/filter packages by license and is not legally binding.

Anyone using the package should be able to read the terms and conditions of the license at anytime without having the to google for it. This is also necessary because otherwise it would be possible to refer to some obscure license that is only defined on a website. The license could be changed at anytime without the license users knowing about it. Proving that they did so would be difficult. Therefore, to avoid any ambiguity or legal problems I recommend including a complete licence file.

  • "This is also necessary because otherwise it would be possible to refer to some obscure license that is only defined on a website.", this is not strictly true though since the license will have to have an SPDX license id. But I get your point though. Also, @jonrsharpe's comment about year and copyright holders is also something that is missing from just specifying it in package.json... – Linus Unnebäck Oct 4 '17 at 11:38
  • Ok, I was not aware of the SPDX Licence id. I know that it is possible do add something like { "license" : "SEE LICENSE IN <filename>" } and <filename> could in theory also be just an URL. Although, the npm docs says to include a file named <filename> at the top level of the package, but I'm not sure if this is actually enforced. – Daniele Torino Oct 4 '17 at 15:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.