Sign in

Search issue titles and bodies, change requests and comments. Private repositories you cannot read are not included.
vole
Clone

Read only, no credentials:

https://rodent.software/vole.git

Write over SSH with a registered key:

git clone ssh://git@rodent.software:2222/vole.git

A free and open-source forge that lives in your Git repo.

#95

P2: Check dependency licences and show dependency changes to reviewers

closed · opened by keenan 10d ago

keenan opened this 10d ago

Why

verify fails on a reachable vulnerability but looks at no licence. A dependency whose licence does not fit Apache-2.0 can land in a change request without any reviewer seeing it, and NOTICE lists only the vendored browser assets, not the Go modules or the fonts’ origin.

Nor can a reviewer see what a change request does to the dependency set: the verification log shows go build and go test, not “this adds a module”.

Scope

  • Check every module in the build list against an allowlist and fail verify on an unknown licence, with the tool pinned like govulncheck.
  • Keep the allowlist in one file in the repository with a one-line reason per entry, so widening it is a deliberate, reviewed edit.
  • Print the module diff on the verification log: modules added, removed, or bumped, each with its licence.
  • Check that NOTICE still describes the vendored assets that are actually present (the *.LICENSE and OFL-*.txt files beside the static files), and fail when one is missing or unlisted.
  • Document the policy: which licences are accepted, and what a contributor does when they need one that is not.

Acceptance

  • verify fails when a module with a licence outside the allowlist is added.
  • A change request’s verification log names the modules it added or removed.
  • Removing a *.LICENSE file next to a vendored asset fails a check.
  • The accepted licences and the policy are in the docs.

Part of #14.

Comments (1)

keenan 10d ago

Starting this on a trimmed scope, so the cut is on the record rather than in the diff.

Dropping: “print the module diff on the verification log: modules added, removed, or bumped, each with its licence.”

Two reasons. The change request page already renders the diff, so a reviewer sees go.mod and go.sum move and can read the names. What a reviewer could not see is what each module’s licence is, and that is what the allowlist check answers. The other half also needs a base to compare against inside a job that a push triggers, and that job has no dependable base: it would mean a merge-base against a ref the container may not have, and a wrong base silently prints nothing.

Keeping, and widening by one gate:

  • licenses.toml at the repository root: the licenses the project can ship, each with the reason it is acceptable, so widening it is a reviewed edit.
  • verify fails a push when a linked module carries a licence that is not there. A module with no detected licence fails too: unknown is not permission.
  • NOTICE is checked both ways against the license files beside the vendored assets — every file must be named, and every name must exist.
  • The release run checks as well, because a tag can point at a commit that never passed a push and a release cannot be recalled. That is the same reason it re-runs govulncheck.

One finding already, before the change request is even open: NOTICE never mentioned canvas-confetti, which arrived with the celebration work. The licence file was there and the inventory was not, which is exactly the drift the both-ways check catches. It is fixed in this change.