vole

Clone

Read only, no credentials:

https://rodent.software/vole.git

Write over SSH with a registered key:

git clone ssh://git@rodent.software:2222/vole.git

A free and open-source forge that lives in your Git repo.

Fail a push that adds a license this project cannot ship

70ba9a69c091edf3c4ddc80f3881bf44e0234f78 · Keenan Nemetz · 10d ago · parent 122a697b

Fail a push that adds a license this project cannot ship

The build failed on a reachable vulnerability but looked at no license, so a
dependency the project may not distribute could land in a change request without
a reviewer seeing it. NOTICE was the only inventory, and nothing kept it true:
canvas-confetti had been shipped for weeks without an entry.

licenses.toml at the repository root lists what the project can ship, each entry
with the reason. verify builds a bill of materials and fails when a linked module
carries anything else; a module with no detected license fails too, because
unknown is not permission. NOTICE is checked both ways against the license files
beside the vendored assets. The release run checks as well, since a tag can point
at a commit that never passed a push.

Closes #95.

NOTICE +6−1

@@ -15,6 +15,9 @@ It includes the following third-party components:
	15	15	server/web/static/prism-languages.min.js)
	16	16	MIT License. See server/web/static/prism.LICENSE.
	17	17
		18	canvas-confetti (server/web/static/confetti.browser.js)
		19	ISC License. See server/web/static/canvas-confetti.LICENSE.
		20
	18	21	Everforest color palette (server/web/static/everforest.css)
	19	22	MIT License. See server/web/static/everforest.LICENSE.
	20	23
@@ -25,4 +28,6 @@ It includes the following third-party components:
	25	28	SIL Open Font License 1.1. See server/web/static/fonts/OFL-JetBrainsMono.txt.
	26	29
	27	30	Other third-party Go modules are listed in go.mod and go.sum. Their licenses
	28		apply to those modules.
		31	apply to those modules. What this project can ship is listed in licenses.toml,
		32	and `vole workflow run verify` fails a push that adds a module carrying a
		33	license it does not allow, or an asset whose license file is not in this file.