vole

Clone

Read only, no credentials:

https://rodent.software/vole.git

Write over SSH with a registered key:

git clone ssh://git@rodent.software:2222/vole.git

A free and open-source forge that lives in your Git repo.

Fail a push that adds a license this project cannot ship

70ba9a69c091edf3c4ddc80f3881bf44e0234f78 · Keenan Nemetz · 10d ago · parent 122a697b

Fail a push that adds a license this project cannot ship

The build failed on a reachable vulnerability but looked at no license, so a
dependency the project may not distribute could land in a change request without
a reviewer seeing it. NOTICE was the only inventory, and nothing kept it true:
canvas-confetti had been shipped for weeks without an entry.

licenses.toml at the repository root lists what the project can ship, each entry
with the reason. verify builds a bill of materials and fails when a linked module
carries anything else; a module with no detected license fails too, because
unknown is not permission. NOTICE is checked both ways against the license files
beside the vendored assets. The release run checks as well, since a tag can point
at a commit that never passed a push.

Closes #95.

licenses.toml +31

@@ -0,0 +1,31 @@
	1	# The licenses this project can ship, and why each one is acceptable.
	2	#
	3	# `vole workflow run verify` builds a bill of materials and checks every Go module
	4	# it links against this list; a module carrying a license that is not here fails
	5	# the push, and the release run checks again before it builds anything, because a
	6	# tag can point at a commit that never passed a push. See
	7	# scripts/check-licenses.py.
	8	#
	9	# Adding an entry is a deliberate, reviewed edit. It is a statement that the
	10	# project may distribute that code, so write the reason and not only the
	11	# identifier. CONTRIBUTING.md says what to do when a dependency needs a license
	12	# that is not here.
	13	#
	14	# The standard library is not listed. It ships with the toolchain, and the
	15	# toolchain's license is not a dependency this project chose.
	16
	17	[modules]
	18
	19	# Permissive: keep the copyright notice, no other conditions.
	20	MIT = "permissive; the majority of the module graph"
	21
	22	# Permissive: keep the notice, and do not use the author's name to endorse.
	23	"BSD-3-Clause" = "permissive; webauthn, bluemonday, uuid, and gorilla/css"
	24
	25	# Permissive: keep the notice, state changes, and no endorsement claim.
	26	"Apache-2.0" = "permissive; also the license this project uses, so go-tpm and yaml.v3 match it"
	27
	28	# The detector's name for the wording the golang.org/x modules use. The file is a
	29	# three-clause BSD text (source, binary, no endorsement), which is why the modules
	30	# arrive under a different identifier than the rest of the BSD-3-Clause graph.
	31	"BSD-Source-Code" = "permissive; the golang.org/x modules written in the three-clause BSD text"