Meta: Document licenses in use for dependencies

[ADKaster]

For example, ffmpeg has raised questions in other issues.

We need to document the licenses for each of our dependencies, reproduce them here in full, and mark down which license we're using for dual-licensed works, etc.

[Celeo]

What should the output look like - a big ol' file with all the license contents; a directory with all the licenses as individual files; something else? Would some method to automatically retrieve those licenses be required, or would this be a one-time thing?

[i-love-coffee-i-love-tea]

Do we use vcpkg for all libraries? If yes, maybe this is a start: https://learn.microsoft.com/en-us/vcpkg/commands/license-report

[i-love-coffee-i-love-tea]

The vcpkg license-report only prints the SPDX license id, but not which packages use the license. We should also use SPDX license IDs, to enable integration with automated tooling.

(Apache-2.0 OR BSL-1.0 OR MIT)
(Apache-2.0 OR MIT)
(BSD-3-Clause OR GPL-2.0-only)
(FTL OR GPL-2.0-or-later)
Apache-2.0
BSD-2-Clause
BSD-3-Clause
ICU
ISC
LGPL-2.1-only
MIT
MIT-Modern-Variant
Zlib
blessing
bzip2-1.0.6
curl
libpng-2.0
libtiff

Apparently the vcpkg packages each contain one copyright file with the license. Not sure how vcpkg treats projects with multiple licenses to choose from.

[i-love-coffee-i-love-tea]

So, I found out vcpkg also provides a vcpkg.spdx.json for each package which contains the licensing data in structured and standardized form, but it does only contain one concluded/selected license under which vcpkg distributes the package and does not contain info about other available licenses. The copyright file of a package contains the selected license itself.

{
  "name": "zlib",
  "SPDXID": "SPDXRef-port",
  "versionInfo": "1.3.1",
  "downloadLocation": "git+https://github.com/Microsoft/vcpkg@3f05e04b9aededb96786a911a16193cdb711f0c9",
  "homepage": "https://www.zlib.net/",
  "licenseConcluded": "Zlib", <------------------------------
  "licenseDeclared": "NOASSERTION",
  "copyrightText": "NOASSERTION",
  "description": "A compression library",
  "comment": "This is the port (recipe) consumed by vcpkg."
}

This may mean we can't use vcpkg's license information to create selection for redistribution unless we make the same selections.
I'm still trying to find out where the vcpkg license-report example in the link above takes the info about MIT license from in the zlib package.

@Celeo
So the task, if I understand it correctly would be to extract the library name and possible licenses from the JSON files and make a list of it and then decide which license we want to use and mark each line that way.

An example of a project with multiple licenses is zlib (MIT and zlib).