Check whether extension has an OSI approved license

lib/resolveExtension.js

@@ -4,6 +4,7 @@ const fs = require('fs');
 const path = require('path');
 const Octokit = require('octokit').Octokit;
 const readVSIXPackage = require('vsce/out/zip').readVSIXPackage;
+const osiLicenses = require('osi-licenses');
 const download = require('download');
 const exec = require('./exec');
 
@@ -53,6 +54,26 @@ exports.resolveExtension = async function ({ id, repository, location }, ms) {
   await exec(`git clone --filter=blob:none --recurse-submodules ${repository} ${repoPath}`, { quiet: true });
 
   const packagePath = [repoPath, location, 'package.json'].filter(p => !!p).join('/');
+
+  //#region Check if the extension has an OSI-approved open-source license
+  try {
+    const manifest = JSON.parse(await fs.promises.readFile(packagePath, 'utf-8'));
+    const license = manifest.license;
+    if (!(license && Object.keys(osiLicenses).includes(license))) {
+      if (repositoryUrl.hostname !== 'github.com') return undefined;
+
+      const ghLicenseResponse = (await octokit.rest.licenses.getForRepo({ owner, repo })).data.license;
+      if (!Object.keys(osiLicenses).includes(ghLicenseResponse.spdx_id)) {
+        console.log(`Not an OSS license: ${ghLicenseResponse.name} (${ghLicenseResponse.spdx_id})`);
+        return undefined;
+      }
+    }
+  } catch {
+    console.log('Can\'t process license');
+    return undefined;
+  }
+  //#endregion
+
   /**
    * @param {string} ref 
    * @returns {Promise<string | undefined>}

package.json

@@ -27,6 +27,7 @@
     "download": "^8.0.0",
     "minimist": "^1.2.5",
     "octokit": "^1.7.0",
+    "osi-licenses": "^0.1.1",
     "ovsx": "latest",
     "semver": "^7.1.3",
     "vsce": "^2.3.0"