vole
Clone
Read only, no credentials:
https://rodent.software/vole.git
Write over SSH with a registered key:
git clone ssh://git@rodent.software:2222/vole.git
A free and open-source forge that lives in your Git repo.
Fail a push that adds a license this project cannot ship
70ba9a69c091edf3c4ddc80f3881bf44e0234f78 · Keenan Nemetz · 10d ago · parent 122a697b
Fail a push that adds a license this project cannot ship The build failed on a reachable vulnerability but looked at no license, so a dependency the project may not distribute could land in a change request without a reviewer seeing it. NOTICE was the only inventory, and nothing kept it true: canvas-confetti had been shipped for weeks without an entry. licenses.toml at the repository root lists what the project can ship, each entry with the reason. verify builds a bill of materials and fails when a linked module carries anything else; a module with no detected license fails too, because unknown is not permission. NOTICE is checked both ways against the license files beside the vendored assets. The release run checks as well, since a tag can point at a commit that never passed a push. Closes #95.
CONTRIBUTING.md +33−3
| @@ -153,13 +153,43 @@ available: | |||
| 153 | 153 | ./vole workflow run verify | |
| 154 | 154 | ``` | |
| 155 | 155 | ||
| 156 | That workflow runs formatting, vet, build, packaging, link checks, and the race | ||
| 157 | test suite. If it cannot run locally because no container runtime is available, | ||
| 158 | run the relevant underlying commands with the same flags the image sets | ||
| 156 | That workflow runs formatting, vet, build, the license check, reachability | ||
| 157 | scanning, packaging, link checks, and the race test suite. If it cannot run | ||
| 158 | locally because no container runtime is available, run the relevant underlying | ||
| 159 | commands with the same flags the image sets | ||
| 159 | 160 | (`CGO_ENABLED=1 go vet -tags libsqlite3 ./...`, | |
| 160 | 161 | `CGO_ENABLED=1 go test -tags libsqlite3 -race ./...`) and say which check you | |
| 161 | 162 | could not run. | |
| 162 | 163 | ||
| 164 | ## Dependencies and licenses | ||
| 165 | |||
| 166 | Adding a dependency means distributing someone else's code. `licenses.toml` at | ||
| 167 | the repository root lists the licenses this project can ship, each with the | ||
| 168 | reason it is acceptable, and `vole workflow run verify` fails a push when a linked | ||
| 169 | module carries one that is not there. | ||
| 170 | |||
| 171 | When the check fails: | ||
| 172 | |||
| 173 | - Prefer a dependency whose license is already listed. | ||
| 174 | - If the new license is permissive, add it to `licenses.toml` in the same change | ||
| 175 | request, with the reason. It is a reviewed edit, which is the point: the | ||
| 176 | decision is made in the open instead of being found at distribution time. | ||
| 177 | - If it is copyleft, or unclear, do not add it. Ask in the issue instead. | ||
| 178 | |||
| 179 | Vendored browser assets are checked the other way round. `NOTICE` is their | ||
| 180 | inventory, so a `*.LICENSE` or `OFL-*.txt` file beside an asset must be named | ||
| 181 | there, and a name in `NOTICE` must point at a file that exists. Adding a vendored | ||
| 182 | script, icon, palette, or font means adding both. | ||
| 183 | |||
| 184 | To run only the license check, build the bill of materials the check reads and | ||
| 185 | pass it the file: | ||
| 186 | |||
| 187 | ```sh | ||
| 188 | go run github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@v1.9.0 \ | ||
| 189 | app -json -noserial -std -licenses -main cmd/vole -output /tmp/bom.json . | ||
| 190 | python3 scripts/check-licenses.py /tmp/bom.json | ||
| 191 | ``` | ||
| 192 | |||
| 163 | 193 | ## Releases and sites | |
| 164 | 194 | ||
| 165 | 195 | Only use these when the task explicitly asks for them: | |