License requirements for packages

[wlandau]

Should we restrict community and/or production to use a set of known open-source licenses? If so, at what level do we do this? PR reviews and/or checks? cc @shikokuchuo

[wlandau]

C.f. https://cran.r-project.org/web/licenses/. NB r-multiverse/contributions#190 uses AGPL3 and was contributed by the author directly, and I merged it.

[shikokuchuo]

We need to check at least at the point of contribution. Does a GitHub project ever change from an open source to non-open source licence, and remain in the same repo, and create a GitHub release? Seems unlikely, but if it's cheap to check then we probably should.

[llrs]

There is a cheap check via available.packages with filter "license/FOSS".

[wlandau]

There is a cheap check via available.packages with filter "license/FOSS".

which makes this easy to check in multiverse.internals::issues_descriptions() to filter packages for production. But we still risk hosting the package from community. I guess a retrospective check could could call available.packages() on community and remove any with missing or bad licenses, but there would be a bit of unavoidable exposure time in anything retrospective.

[wlandau]

This is all implemented now. For Community and Staging, we use available.packages() with the FOSS license filter. For individual package reviews, we are limited by HenrikBengtsson/Wishlist-for-R#170, so multiverse.internals has custom code to verify the most common types of licenses.