Replace license crate with askalono

[ebroto]

Resolves #147

So askalono seems to use a more complex analysis that relies in a binary cache generated from a json file. For the moment I went for adding the cache directly under resources/. In askalono-cli the json file is checked out as a submodule from this repo and the cache is generated using build.rs.

We could go with a similar approach (maybe using git subtree instead), this way we would get updates of the supported licenses and won't have to update the cache manually. Since the solution is more involved I wanted to ask first what do you think about it.

[o2sh]

Just tested it, works like a charm! 💯

We could go with a similar approach (maybe using git subtree instead), this way we would get updates of the supported licenses and won't have to update the cache manually.

Just to be sure I understood correctly, you mean adding spdx as a subtree to onefetch in order to automatically cash the licenses (generate a license-cache.bin.gz) at compile time via a build.rs?

Sounds great @ebroto !

[ebroto]

Yep, that's it.

Alright, I will work on it soon!

[o2sh]

Hi @ebroto, don't you think it would be better to use spdx as a git submodule instead, so that we only get references and not a full copy of the repo.

The rest is great!!

[ebroto]

Yes, I was hesitating about the two options and went for the subtree because it's easier to manage, but indeed it seems overkill for our needs 👍

I will try with submodules instead. BTW thanks for the invitation to collaborate!

[o2sh]

This is definitely the most elegant solution, however I don't think the license cache will change that much.

I will create a branch with your PR (to build the a new cache when changes on spdx occur) and use a static cache on master...

[ebroto]

You can also use git clone --recurse-submodules $REPO. But yes, that was the kind of extra management I wanted to avoid initially because the user has to do extra steps. Besides of this, I think it was a good call to choose submodules over subtrees because they seem a better fit. From what I've seen, cargo and travis for example should fetch the submodules without extra configuration.

In any case, we can always go back to the first approach and bundle the cache directly in the repository. The main con for this is that we have to remember to regenerate the cache whenever we update askalono as the caches are incompatible between versions.

So what are others doing? Askalono is currently used by two crates:

• askalono-cli: the CLI that comes with the library, is using the submodules approach.
• cargo-deny: they have a pre-generated cache versioned in the repository.

So there is no "better" option here I think. After having tried all the options (xD), I'm thinking that we can simplify and just bundle the cache directly for now and see if it works for us.

What do you think?

[ebroto]

Hey it seems we posted at the same time :) Did not think about the possibility you suggested, works for me!

[o2sh]

Great, thanks again for your PR @ebroto,

If you have any suggestion/idea to improve the project, don't hesitate to keep contributing 🥇