Skip to content

Commit fe1fd86

Browse files
per1234per1234
authored
Merge pull request #94 from per1234/check-dependencies
Add infrastructure to check for unapproved Go dependency licenses
2 parents 49dc48b + 75e6332 commit fe1fd86

File tree

213 files changed

+34015
-5
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

213 files changed

+34015
-5
lines changed

‎.codespellrc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
[codespell]
44
# In the event of a false positive, add the problematic word, in all lowercase, to a comma-separated list here:
55
ignore-words-list = easly,pullrequest
6-
skip = ./.git,./go.mod,./go.sum,./package-lock.json,./poetry.lock,./yarn.lock
6+
skip = ./.git,./.licenses,./go.mod,./go.sum,./package-lock.json,./poetry.lock,./yarn.lock
77
builtin = clear,informal,en-GB_to_en-US
88
check-filenames =
99
check-hidden =

‎.github/workflows/check-go-dependencies-task.yml

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md
2+
name: Check Go Dependencies
3+
4+
env:
5+
# See: https://github.com/actions/setup-go/tree/v2#readme
6+
GO_VERSION: "1.16"
7+
8+
# See: https://docs.github.com/en/actions/reference/events-that-trigger-workflows
9+
on:
10+
push:
11+
paths:
12+
- ".github/workflows/check-go-dependencies-task.ya?ml"
13+
- ".licenses/**"
14+
- ".licensed.json"
15+
- ".licensed.ya?ml"
16+
- "Taskfile.ya?ml"
17+
- "**/.gitmodules"
18+
- "**/go.mod"
19+
- "**/go.sum"
20+
pull_request:
21+
paths:
22+
- ".github/workflows/check-go-dependencies-task.ya?ml"
23+
- ".licenses/**"
24+
- ".licensed.json"
25+
- ".licensed.ya?ml"
26+
- "Taskfile.ya?ml"
27+
- "**/.gitmodules"
28+
- "**/go.mod"
29+
- "**/go.sum"
30+
workflow_dispatch:
31+
repository_dispatch:
32+
33+
jobs:
34+
check-cache:
35+
runs-on: ubuntu-latest
36+
37+
steps:
38+
- name: Checkout repository
39+
uses: actions/checkout@v2
40+
with:
41+
submodules: recursive
42+
43+
- name: Install licensed
44+
uses: jonabc/setup-licensed@v1
45+
with:
46+
github_token: ${{ secrets.GITHUB_TOKEN }}
47+
version: 3.x
48+
49+
- name: Install Go
50+
uses: actions/setup-go@v2
51+
with:
52+
go-version: ${{ env.GO_VERSION }}
53+
54+
- name: Install Task
55+
uses: arduino/setup-task@v1
56+
with:
57+
repo-token: ${{ secrets.GITHUB_TOKEN }}
58+
version: 3.x
59+
60+
- name: Update dependencies license metadata cache
61+
run: task --silent general:cache-dep-licenses
62+
63+
- name: Check for outdated cache
64+
id: diff
65+
run: |
66+
git add --intent-to-add .
67+
if ! git diff --color --exit-code; then
68+
echo
69+
echo "::error::Dependency license metadata out of sync. See: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md#metadata-cache"
70+
exit 1
71+
fi
72+
73+
# Some might find it convenient to have CI generate the cache rather than setting up for it locally
74+
- name: Upload cache to workflow artifact
75+
if: failure() && steps.diff.outcome == 'failure'
76+
uses: actions/upload-artifact@v2
77+
with:
78+
if-no-files-found: error
79+
name: dep-licenses-cache
80+
path: .licenses/
81+
82+
check-deps:
83+
runs-on: ubuntu-latest
84+
85+
steps:
86+
- name: Checkout repository
87+
uses: actions/checkout@v2
88+
with:
89+
submodules: recursive
90+
91+
- name: Install licensed
92+
uses: jonabc/setup-licensed@v1
93+
with:
94+
github_token: ${{ secrets.GITHUB_TOKEN }}
95+
version: 3.x
96+
97+
- name: Install Go
98+
uses: actions/setup-go@v2
99+
with:
100+
go-version: ${{ env.GO_VERSION }}
101+
102+
- name: Install Task
103+
uses: arduino/setup-task@v1
104+
with:
105+
repo-token: ${{ secrets.GITHUB_TOKEN }}
106+
version: 3.x
107+
108+
- name: Check for dependencies with unapproved licenses
109+
run: task --silent general:check-dep-licenses

‎.gitignore

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,12 @@
11
token
22

33
coverage_*.txt
4-
libraries-repository-engine
5-
libraries-repository-engine.exe
6-
repository
7-
repository.exe
4+
/libraries-repository-engine
5+
!/libraries-repository-engine/
6+
/libraries-repository-engine.exe
7+
/repository
8+
!/repository/
9+
/repository.exe
810
tests/arduino/cc/repository/libraries/testdata/test_db.json
911
/config.json
1012
/repos.txt

‎.licensed.yml

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
# See: https://github.com/github/licensed/blob/master/docs/configuration.md
2+
sources:
3+
go: true
4+
5+
apps:
6+
- source_path: ./
7+
8+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies/AGPL-3.0/.licensed.yml
9+
allowed:
10+
# The following are based on: https://www.gnu.org/licenses/license-list.html#GPLCompatibleLicenses
11+
- gpl-1.0-or-later
12+
- gpl-1.0+ # Deprecated ID for `gpl-1.0-or-later`
13+
- gpl-2.0-or-later
14+
- gpl-2.0+ # Deprecated ID for `gpl-2.0-or-later`
15+
- gpl-3.0-only
16+
- gpl-3.0 # Deprecated ID for `gpl-3.0-only`
17+
- gpl-3.0-or-later
18+
- gpl-3.0+ # Deprecated ID for `gpl-3.0-or-later`
19+
- lgpl-2.0-or-later
20+
- lgpl-2.0+ # Deprecated ID for `lgpl-2.0-or-later`
21+
- lgpl-2.1-only
22+
- lgpl-2.1 # Deprecated ID for `lgpl-2.1-only`
23+
- lgpl-2.1-or-later
24+
- lgpl-2.1+ # Deprecated ID for `lgpl-2.1-or-later`
25+
- lgpl-3.0-only
26+
- lgpl-3.0 # Deprecated ID for `lgpl-3.0-only`
27+
- lgpl-3.0-or-later
28+
- lgpl-3.0+ # Deprecated ID for `lgpl-3.0-or-later`
29+
- agpl-1.0-or-later
30+
- agpl-3.0-only
31+
- agpl-3.0 # Deprecated ID for `agpl-3.0-only`
32+
- agpl-3.0-or-later
33+
- fsfap
34+
- apache-2.0
35+
- artistic-2.0
36+
- clartistic
37+
- sleepycat
38+
- bsl-1.0
39+
- bsd-3-clause
40+
- cecill-2.0
41+
- bsd-3-clause-clear
42+
# "Cryptix General License" - no SPDX ID (https://github.com/spdx/license-list-XML/issues/456)
43+
- ecos-2.0
44+
- ecl-2.0
45+
- efl-2.0
46+
- eudatagrid
47+
- mit
48+
- bsd-2-clause # Subsumed by `bsd-2-clause-views`
49+
- bsd-2-clause-netbsd # Deprecated ID for `bsd-2-clause`
50+
- bsd-2-clause-views # This is the version linked from https://www.gnu.org/licenses/license-list.html#FreeBSD
51+
- bsd-2-clause-freebsd # Deprecated ID for `bsd-2-clause-views`
52+
- ftl
53+
- hpnd
54+
- imatix
55+
- imlib2
56+
- ijg
57+
# "Informal license" - this is a general class of license
58+
- intel
59+
- isc
60+
- mpl-2.0
61+
- ncsa
62+
# "License of Netscape JavaScript" - no SPDX ID
63+
- oldap-2.7
64+
# "License of Perl 5 and below" - possibly `Artistic-1.0-Perl` ?
65+
- cc0-1.0
66+
- cc-pddc
67+
- psf-2.0
68+
- ruby
69+
- sgi-b-2.0
70+
- smlnj
71+
- standardml-nj # Deprecated ID for `smlnj`
72+
- unicode-dfs-2015
73+
- upl-1.0
74+
- unlicense
75+
- vim
76+
- w3c
77+
- wtfpl
78+
- lgpl-2.0-or-later with wxwindows-exception-3.1
79+
- wxwindows # Deprecated ID for `lgpl-2.0-or-later with wxwindows-exception-3.1`
80+
- x11
81+
- xfree86-1.1
82+
- zlib
83+
- zpl-2.0
84+
- zpl-2.1
85+
# The following are based on individual license text
86+
- eupl-1.2

‎.licenses/libraries-repository-engine/go/github.com/ProtonMail/go-crypto/bitcurves.dep.yml

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
---
2+
name: github.com/ProtonMail/go-crypto/bitcurves
3+
version: v0.0.0-20210428141323-04723f9f07d7
4+
type: go
5+
summary:
6+
homepage: https://pkg.go.dev/github.com/ProtonMail/go-crypto/bitcurves
7+
license: bsd-3-clause
8+
licenses:
9+
- sources: go-crypto@v0.0.0-20210428141323-04723f9f07d7/LICENSE
10+
text: |
11+
Copyright (c) 2009 The Go Authors. All rights reserved.
12+
13+
Redistribution and use in source and binary forms, with or without
14+
modification, are permitted provided that the following conditions are
15+
met:
16+
17+
* Redistributions of source code must retain the above copyright
18+
notice, this list of conditions and the following disclaimer.
19+
* Redistributions in binary form must reproduce the above
20+
copyright notice, this list of conditions and the following disclaimer
21+
in the documentation and/or other materials provided with the
22+
distribution.
23+
* Neither the name of Google Inc. nor the names of its
24+
contributors may be used to endorse or promote products derived from
25+
this software without specific prior written permission.
26+
27+
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
28+
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
29+
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
30+
A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
31+
OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
32+
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
33+
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
34+
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
35+
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
36+
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
37+
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
38+
- sources: go-crypto@v0.0.0-20210428141323-04723f9f07d7/PATENTS
39+
text: |
40+
Additional IP Rights Grant (Patents)
41+
42+
"This implementation" means the copyrightable works distributed by
43+
Google as part of the Go project.
44+
45+
Google hereby grants to You a perpetual, worldwide, non-exclusive,
46+
no-charge, royalty-free, irrevocable (except as stated in this section)
47+
patent license to make, have made, use, offer to sell, sell, import,
48+
transfer and otherwise run, modify and propagate the contents of this
49+
implementation of Go, where such license applies only to those patent
50+
claims, both currently owned or controlled by Google and acquired in
51+
the future, licensable by Google that are necessarily infringed by this
52+
implementation of Go. This grant does not include claims that would be
53+
infringed only as a consequence of further modification of this
54+
implementation. If you or your agent or exclusive licensee institute or
55+
order or agree to the institution of patent litigation against any
56+
entity (including a cross-claim or counterclaim in a lawsuit) alleging
57+
that this implementation of Go or any code incorporated within this
58+
implementation of Go constitutes direct or contributory patent
59+
infringement, or inducement of patent infringement, then any patent
60+
rights granted to you under this License for this implementation of Go
61+
shall terminate as of the date such litigation is filed.
62+
notices: []

‎.licenses/libraries-repository-engine/go/github.com/ProtonMail/go-crypto/brainpool.dep.yml

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
---
2+
name: github.com/ProtonMail/go-crypto/brainpool
3+
version: v0.0.0-20210428141323-04723f9f07d7
4+
type: go
5+
summary: Package brainpool implements Brainpool elliptic curves.
6+
homepage: https://pkg.go.dev/github.com/ProtonMail/go-crypto/brainpool
7+
license: bsd-3-clause
8+
licenses:
9+
- sources: go-crypto@v0.0.0-20210428141323-04723f9f07d7/LICENSE
10+
text: |
11+
Copyright (c) 2009 The Go Authors. All rights reserved.
12+
13+
Redistribution and use in source and binary forms, with or without
14+
modification, are permitted provided that the following conditions are
15+
met:
16+
17+
* Redistributions of source code must retain the above copyright
18+
notice, this list of conditions and the following disclaimer.
19+
* Redistributions in binary form must reproduce the above
20+
copyright notice, this list of conditions and the following disclaimer
21+
in the documentation and/or other materials provided with the
22+
distribution.
23+
* Neither the name of Google Inc. nor the names of its
24+
contributors may be used to endorse or promote products derived from
25+
this software without specific prior written permission.
26+
27+
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
28+
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
29+
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
30+
A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
31+
OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
32+
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
33+
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
34+
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
35+
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
36+
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
37+
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
38+
- sources: go-crypto@v0.0.0-20210428141323-04723f9f07d7/PATENTS
39+
text: |
40+
Additional IP Rights Grant (Patents)
41+
42+
"This implementation" means the copyrightable works distributed by
43+
Google as part of the Go project.
44+
45+
Google hereby grants to You a perpetual, worldwide, non-exclusive,
46+
no-charge, royalty-free, irrevocable (except as stated in this section)
47+
patent license to make, have made, use, offer to sell, sell, import,
48+
transfer and otherwise run, modify and propagate the contents of this
49+
implementation of Go, where such license applies only to those patent
50+
claims, both currently owned or controlled by Google and acquired in
51+
the future, licensable by Google that are necessarily infringed by this
52+
implementation of Go. This grant does not include claims that would be
53+
infringed only as a consequence of further modification of this
54+
implementation. If you or your agent or exclusive licensee institute or
55+
order or agree to the institution of patent litigation against any
56+
entity (including a cross-claim or counterclaim in a lawsuit) alleging
57+
that this implementation of Go or any code incorporated within this
58+
implementation of Go constitutes direct or contributory patent
59+
infringement, or inducement of patent infringement, then any patent
60+
rights granted to you under this License for this implementation of Go
61+
shall terminate as of the date such litigation is filed.
62+
notices: []

0 commit comments

Comments
 (0)