Find an alternative to liccheck

[leahaeusel]

Description of the Issue:

We currently check the license compatibility of our dependencies with the package liccheck. However, the current liccheck version depends on the pkg_resources module, which has been deprecated with setuptools==82.0.0.

Since liccheck does not seem to be maintained anymore (last update Sept. 2023), we should find an alternative that is compatible with the latest setuptools versions.

Proposed Solution:

Find an alternative to liccheck with at least the same capabilities that

• does not depend on pkg_resources
• checks all our dependencies (requirements.txt, dev-requirements.txt, fourc_requirements.txt, ...)

Action Items:

No response

Related Issues:

No response

Interested Parties:

No response

[sbrandstaeter]

This looks like a very promising solution to me: https://github.com/raimon49/pip-licenses

• It seems to be maintained
• Despite the name, it reads the package list from the Python path and also processes packages installed with conda.

An important improvement would be that we all check transitive dependencies (so dependencies of our dependencies).
In our current setup, we only check for the list of packages in "requirements.txt" so we are missing e.g. the fourc dependencies.

[sbrandstaeter]

Should be close once #301 is merged.