8

I want to check a package's license before installing with apt and flatpak.
This would be particularly useful in PPAs / custom repositories that allow non-FLOSS licenses, and may have non-FLOSS dependencies too.

It has to be possible, since Discover can apparently do it, at least for official packages (though maybe it's impossible for custom repos, since they aren't on Launchpad?). At least Flathub does have license info on package's pages.
But I want to check it via command-line.

  • snap info $PKG_NAME can be used to check license of uninstalled snap packages - OK
  • apt info $PKG_NAME / apt-cache show $PKG_NAME doesn't (always?) have license information
  • flatpak info $PKG_ID only works for installed packages
  • flatpak search $PKG_NAME -vv took way too long to show basically no information

Ideally there should be an easy way to check privacy policies too, but I suppose that's asking too much...

Related:

1
  • 1
    Currently a way to check it online (from Ubuntu repos only) would be from a URL like https://changelogs.ubuntu.com/changelogs/pool/universe/d/dotnet6/dotnet6_6.0.110-0ubuntu1/copyright. So I suppose it would be possible for someone to make some simple script that from a package name gets what's necessary to fill in the things in the pattern https://changelogs.ubuntu.com/changelogs/pool/<section>/*/<pkg>/<pkg-version>/copyright and shows the downloaded file. Even better if you could process the file and show only a summary of the licenses.
    – geekley
    Nov 2, 2022 at 20:15

3 Answers 3

1

I may be tricky to check the license information of packages before installing them via apt or flatpak, there are some limitations based on how these package managers and their repositories provide metadata. Here's what you can do:

When it comes to APT:

APT repositories don't always have a section, for license details in the package metadata. This is why you may not always see the license information when using commands like info $PKG_NAME or apt cache show $PKG_NAME. However you can sometimes figure out the licensing by checking fields or by visiting the packages homepage or documentation linked within the metadata.

  1. Review the package information; of using info $PKG_NAME (which isn't usually a standard command) try using apt show $PKG_NAME to access relevant details, which could include a link to the projects website or documentation where you might find licensing specifics.

  2. Manual Investigation; Head to the homepage or project URL mentioned in the package metadata to search for licensing information.

  3. Debian Packages Tracker; If you're dealing with packages from repositories consider checking out the Debian Package Tracker website at https;//tracker.debian.org/ for potential licensing data.

Regarding Flatpak:

When it comes to Flatpak locating license information is typically more straightforward for applications, from Flathub that follow metadata practices;

  1. Refer to Flathub Website; If you're searching for a way, to command line but noticed that Flathub site includes licensing information you can still make use of this by fetching the webpage details for a package and scanning it for license specifics. You could employ curl. Wget along with grep or comparable tools to pull out the license.

  2. Regarding Installed Applications Using Flatpak CLI; Even though you mentioned that flatpak info $PKG_ID is only effective for installed packages it proves handy after installation. However this restriction remains in place, for installation verifications.

  3. Enhanced Flatpak Search: While flatpak search $PKG_NAME -vv was not helpful, focusing on metadata retrieval from a known source repository like Flathub directly can be a workaround. There's no direct command to fetch license info for uninstalled packages, but considering the metadata is available on Flathub, scripting a web query to parse these details can be a workaround.

I hope it helps you. Cheers.

1

This is one liner for official repository only as the one you mention in comments:

function lic() { apt-get download --print-uris $1 | sed "s/.*\(\/pool.*\)_.*.deb'.*/https:\/\/changelogs.ubuntu.com\/changelogs\1\/copyright/" | wget -q -i - -O - ; }

Use as:

lic pkg_source_name

This path seems long if I have support all type of repositories. So current flaws:

  • Works with "source package name" not "package name"
  • Doesn't work with PPA's, External repositories and Old releases (as they have separate site)
1
  • 1
    Thanks! The output includes entire licenses instead of just the SPDX identifiers, so it can be greatly simplified with, e.g.: lic dotnet6 | grep -Po '^License: \K.*' | sort -u, which will output just unique license names for all files (i.e. all licenses referenced in the copyright file).
    – geekley
    Feb 28 at 15:00
1

I've found a way to fetch the license for Ubuntu's repos in APT and for Flathub. Thanks to both of you for pointing me in the right direction! Of course, these won't handle every corner case, but it's good enough for my own personal use. Here's how the scripts turned out:

APT: Ubuntu repos

This will fetch the copyright file (thanks @user.dz), filter lines starting with License: , then show unique values on each line. Any fetching errors (e.g. non-existing packages) should make the script return a non-zero exit code. If multiple packages are provided, the result is aggregated, without duplicates. The order of licenses in the file(s) is preserved, so the main project's license is probably the first one listed (though I wouldn't count on it).

/usr/local/bin/licenses-apt-ubuntu

#!/usr/bin/bash
# Public Domain - see https://unlicense.org
set -e ; set -o pipefail
apt-get download --print-uris "$@" |
sed "s|.*\(/pool.*\)_.*\.deb'.*|https://changelogs.ubuntu.com/changelogs\1/copyright|" |
wget -q -i - -O - |
grep -Po '^License: \K.*' |
perl -ne '$seen{$_}++ or print;'

Flatpak: Flathub

This will use the (undocumented?) Flathub API to fetch the JSON metadata, which has the projectLicense field, which seems to correspond to the <project_license> tag in the *.metainfo.xml file. The site returns null for missing app IDs, so that will appear as the license in this case, and the script will exit with non-zero if there's any null. Each package should have one license entry, so the output with match in order if multiple packages are provided.

/usr/local/bin/license-flathub

#!/usr/bin/bash
# Public Domain - see https://unlicense.org
set -e ; set -o pipefail
echo "$@" |
perl -pe 's|\s*(\S+)\s*|https://flathub.org/api/v1/apps/$1\n|g' |
wget -q -i - -O - |
jq -er '.projectLicense'

Snap

The equivalent script for Snap Store, just for completion's sake. It simply extracts the value of the license field from the info. Like flathub, it supports multiple packages with matching output order. However, invalid entries are excluded, and it exits with non-zero when it doesn't match at least 1 valid package.

/usr/local/bin/license-snap

#!/usr/bin/bash
# Public Domain - see https://unlicense.org
set -e ; set -o pipefail
snap info "$@" | grep -Po '^license:\s*\K.*'

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .