GitHub 依赖图许可证数据质量提升：改用包注册表优先
License data quality improvements
GitHub now uses package registries like npmjs.org and PyPI to determine license information for software components in the dependency graph. This improves the accuracy and completeness of the licenses shown in dependency insights, software bills of materials (SBOMs), the open source license compliance feature in GitHub Advanced Security, and the dependency review action.
GitHub 现在使用 npmjs.org 和 PyPI 等包注册表来确定依赖图中软件组件的许可证信息。这提高了依赖项洞察、软件物料清单（SBOM）、GitHub 高级安全中的开源许可证合规功能以及依赖项审查操作中显示的许可证的准确性和完整性。
Previously, the primary source of license information on GitHub was the ClearlyDefined service. While we still use and contribute to ClearlyDefined, we’ve found that its focus on depth-first file scanning led to complex results that users found confusing. We’ll still fall back to ClearlyDefined data, but will now prioritize license information from the package registries. Early results show that we’ve cut the number of missing licenses in half, from 45% of the 170 million packages in the dependency graph down to 24%. Additionally, the system now tracks version ranges instead of requiring a specific database entry for every version, so the actual coverage will be higher.
以前，GitHub 上许可证信息的主要来源是 ClearlyDefined 服务。虽然我们仍在使用并为 ClearlyDefined 做出贡献，但我们发现其深度优先的文件扫描方法导致结果复杂，用户感到困惑。我们仍将回退到 ClearlyDefined 数据，但现在将优先考虑来自包注册表的许可证信息。早期结果显示，我们将缺失许可证的数量减少了一半，从依赖图中 1.7 亿个包中的 45% 降至 24%。此外，系统现在跟踪版本范围，而不是要求为每个版本提供特定的数据库条目，因此实际覆盖率将更高。
To explain further, the dependency graph service now uses metadata from the canonical registry for a given package ecosystem, as described in the following table.
进一步说明，依赖图服务现在使用给定包生态系统的规范注册表中的元数据，如下表所述。
| Package Manager | Registry |
|---|---|
| npm | npmjs.org |
| NuGet | nuget.org |
| Python | pypi.org |
| Rubygems | rubygems.org |
| Rust | crates.io |
| Go | pkg.go.dev |
| Maven | deps.dev |
| Dart | pub.dev |
| PHP | packagist.org |
| 包管理器 | 注册表 |
|---|---|
| npm | npmjs.org |
| NuGet | nuget.org |
| Python | pypi.org |
| Rubygems | rubygems.org |
| Rust | crates.io |
| Go | pkg.go.dev |
| Maven | deps.dev |
| Dart | pub.dev |
| PHP | packagist.org |
The dependency graph service keeps license history based on version ranges. For example, Grafana, which relicensed from Apache to AGPL, has two entries: one covering 1.0.0 through 7.5.17 for Apache-2.0, and one from 8.0.0 or newer for AGPLv3. This both reduces the complexity of the database and provides license information for new versions without requiring each one to be added explicitly.
依赖图服务根据版本范围保留许可证历史。例如，Grafana 从 Apache 重新授权为 AGPL，有两个条目：一个涵盖 1.0.0 到 7.5.17 的 Apache-2.0，另一个涵盖 8.0.0 或更高版本的 AGPLv3。这既降低了数据库的复杂性，又为新版本提供了许可证信息，而无需显式添加每个版本。
Updated license information is available now across all of GitHub.
更新的许可证信息现在可在整个 GitHub 上使用。
Join the discussion within GitHub Community.
加入 GitHub 社区中的讨论。
The post License data quality improvements appeared first on The GitHub Blog.
文章《许可证数据质量改进》最初出现在 GitHub 博客上。
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力