Extract licenses of BuildRequires about cavil HOT 2 OPEN

In this case, maybe only -devel packages should be presented. There should be a discriminator between linked vs. used. So things like libtool or gcc doesn't mean it's linked, but adding openssl-devel headers probably is a good indicator that openssl-devel is linked against.

from cavil.

There is much more to it. Cavil itself has no real concept of packages or even projects. Those are just sources for it to get code from to scan and analyse. To give you the correct license report of a BuildRequire we would need to know the exact context in which the package will be built at the time it will be built (dependencies will get updated all the time too, so everything is in constant flux).

And then there's the problem that Cavil tries to resolve links to the devel projects to reduce duplicates. That means our data is not at all equipped to resolve dependencies currently. At best we could give estimates, or a list of all possible versions of a dependency package, and then you'd have to sort through them to find the right one. But it would be pretty sketchy for a proper legal review.

from cavil.