vole

Clone

Read only, no credentials:

https://rodent.software/git/vole.git

Write over SSH with a registered key:

git clone ssh://git@0.0.0.0:2222/vole.git

A free and open-source forge that lives in your Git repo.

Fail a push that adds a license this project cannot ship

70ba9a69c091edf3c4ddc80f3881bf44e0234f78 · Keenan Nemetz · 10d ago · parent 122a697b

Fail a push that adds a license this project cannot ship

The build failed on a reachable vulnerability but looked at no license, so a
dependency the project may not distribute could land in a change request without
a reviewer seeing it. NOTICE was the only inventory, and nothing kept it true:
canvas-confetti had been shipped for weeks without an entry.

licenses.toml at the repository root lists what the project can ship, each entry
with the reason. verify builds a bill of materials and fails when a linked module
carries anything else; a module with no detected license fails too, because
unknown is not permission. NOTICE is checked both ways against the license files
beside the vendored assets. The release run checks as well, since a tag can point
at a commit that never passed a push.

Closes #95.

.vole/images/release.yaml +4−2

@@ -2,7 +2,9 @@
	2	2	# way: the tag names the exact toolchain go.mod pins (go 1.27.3) and the digest
	3	3	# pins the base image, so a rebuild cannot pick up a different compiler. It needs
	4	4	# no packaging tools of its own: the steps fetch a pinned nfpm, which is also what
	5		# makes `vole workflow run release` work locally.
		5	# makes `vole workflow run release` work locally. python3 is here for the license
		6	# gate, which reads the bill of materials the release builds: a tag can point at a
		7	# commit that never passed a push.
	6	8	version: 1
	7	9	from: golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5
	8	10	env:
@@ -19,7 +21,7 @@ run:
	19	21	# libraries have to be installable beside the amd64 ones. Debian's archive
	20	22	# carries both, so adding the architecture is enough.
	21	23	- dpkg --add-architecture arm64
	22		- apt-get update && apt-get install -y --no-install-recommends git ca-certificates gcc libsqlite3-dev:amd64 gcc-aarch64-linux-gnu libsqlite3-dev:arm64 && rm -rf /var/lib/apt/lists/*
		24	- apt-get update && apt-get install -y --no-install-recommends git ca-certificates gcc python3 libsqlite3-dev:amd64 gcc-aarch64-linux-gnu libsqlite3-dev:arm64 && rm -rf /var/lib/apt/lists/*
	23	25	# The test step spawns ssh and ssh-keygen, which call getpwuid() and exit 255
	24	26	# with "No user exists for uid N" when the container runs as the host's uid and
	25	27	# the image has no passwd entry for it. Same reason, same entry as the verify