How to list all used licenses?

[AlexanderLanin]

I cannot find the command to list all licenses of all ports that I'm using (+transitively).

I need a list like the one from pip-licenses:

| lib A | 1.0.0 | MIT License |
| lib B | 2.3.5 | GPL License |

I found I can get a list of packages via
vcpkg/vcpkg depend-info --overlay-ports=. my_project (see #27030)

And I can get all licenses via CMake as shown in #28980

file(GLOB LICENSE_DIRS "${VCPKG_INSTALLED_DIR}/${VCPKG_TARGET_TRIPLET}/share/*")
foreach(LICENSE_DIR ${LICENSE_DIRS})
    if (EXISTS ${LICENSE_DIR}/copyright)
        get_filename_component(LICENSE_LIB_NAME ${LICENSE_DIR} NAME)
        message(STATUS "${LICENSE_LIB_NAME} | ${LICENSE_DIR}/copyright")
    endif()
endforeach()

But how do I get the license information from vcpkg.json of the ports that I use (+transitively)?

I hacked this solution, but it's a hack...

file(GLOB DEPENDENCIES "${VCPKG_INSTALLED_DIR}/${VCPKG_TARGET_TRIPLET}/share/*")
foreach(DEPENDENCY ${DEPENDENCIES})
    get_filename_component(DEPENDENCY_NAME ${DEPENDENCY} NAME)
    execute_process(COMMAND jq ".version" "vcpkg/ports/${DEPENDENCY_NAME}/vcpkg.json" OUTPUT_VARIABLE DEPENDENCY_VERSION OUTPUT_STRIP_TRAILING_WHITESPACE)
    execute_process(COMMAND jq ".license" "vcpkg/ports/${DEPENDENCY_NAME}/vcpkg.json" OUTPUT_VARIABLE DEPENDENCY_LICENSE OUTPUT_STRIP_TRAILING_WHITESPACE)
    message(STATUS "${DEPENDENCY_NAME} | ${DEPENDENCY_VERSION} | ${DEPENDENCY_LICENSE}")
endforeach()

Thank you!

[luncliff]

Maybe dependencygraph feature in recent vcpkg-tool versions can help you.

You can "Export SBOM" in repository Insights > Dependency Graph.
https://devblogs.microsoft.com/cppblog/vcpkg-integration-with-the-github-dependency-graph/

[cenit]

I am interested in this topic. Any news on this front? Note that I need a solution that is GitHub independent

[cenit]

also a "compatibility check", like what's already performed by other package manager (e.g. mixing libraries with incompatible licenses, or the final project having a license incompatible with a dependency) would be a great plus for the solution

[cenit]

I am working on this tool https://github.com/cenit/licencpp
Next step will be full integration with https://oss-review-toolkit.org/ort/docs/tools/analyzer

[as-ascii]

I think that's the feature really expected. Please check here what effort is required to generate nice documentation with dependencies and licenses:
https://github.com/docwire/docwire/blob/master/tools/generate_3rdparty_components_doc.cmake
Like a separate project... :-(

[pierr3]

I made this little script which compiles all the licenses as well as any other one you specify into one text file. I ship it with my binary:

https://github.com/pierr3/VectorAudio/blob/main/collect_licenses.py

[walbourn]

See microsoft/vcpkg-tool#1514