Skip to content

Commit 1ffea34

Browse files
per1234per1234
authored
Merge pull request #288 from per1234/check-dependencies
Add CI workflow to check for unapproved Go dependency licenses
2 parents da49a5a + 1a036a6 commit 1ffea34

File tree

286 files changed

+48842
-1
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

286 files changed

+48842
-1
lines changed

Diff for: ‎.codespellrc

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
[codespell]
44
# In the event of a false positive, add the problematic word, in all lowercase, to a comma-separated list here:
55
ignore-words-list = ot,propert
6-
skip = ./.git,**/go.mod,**/go.sum,./package-lock.json,./poetry.lock,./yarn.lock,./arduino-lint,./arduino-lint.exe,./internal/rule/rulefunction/testdata/libraries/MisspelledSentenceParagraphValue/library.properties,./site
6+
skip = ./.git,./.licenses,**/go.mod,**/go.sum,./package-lock.json,./poetry.lock,./yarn.lock,./arduino-lint,./arduino-lint.exe,./internal/rule/rulefunction/testdata/libraries/MisspelledSentenceParagraphValue/library.properties,./site
77
builtin = clear,informal,en-GB_to_en-US
88
check-filenames =
99
check-hidden =

Diff for: ‎.ecrc

+1
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
"Exclude": [
33
"^LICENSE\\.txt$",
44
"^poetry\\.lock$",
5+
"^\\.licenses/",
56
"^internal/rule/schema/schemadata/bindata.go$",
67
"^internal/rule/schema/testdata/bindata.go$"
78
]

Diff for: ‎.github/workflows/check-go-dependencies-task.yml

+109
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md
2+
name: Check Go Dependencies
3+
4+
env:
5+
# See: https://github.com/actions/setup-go/tree/v2#readme
6+
GO_VERSION: "1.16"
7+
8+
# See: https://docs.github.com/en/actions/reference/events-that-trigger-workflows
9+
on:
10+
push:
11+
paths:
12+
- ".github/workflows/check-go-dependencies-task.ya?ml"
13+
- ".licenses/**"
14+
- ".licensed.json"
15+
- ".licensed.ya?ml"
16+
- "Taskfile.ya?ml"
17+
- "**/.gitmodules"
18+
- "**/go.mod"
19+
- "**/go.sum"
20+
pull_request:
21+
paths:
22+
- ".github/workflows/check-go-dependencies-task.ya?ml"
23+
- ".licenses/**"
24+
- ".licensed.json"
25+
- ".licensed.ya?ml"
26+
- "Taskfile.ya?ml"
27+
- "**/.gitmodules"
28+
- "**/go.mod"
29+
- "**/go.sum"
30+
workflow_dispatch:
31+
repository_dispatch:
32+
33+
jobs:
34+
check-cache:
35+
runs-on: ubuntu-latest
36+
37+
steps:
38+
- name: Checkout repository
39+
uses: actions/checkout@v2
40+
with:
41+
submodules: recursive
42+
43+
- name: Install licensed
44+
uses: jonabc/setup-licensed@v1
45+
with:
46+
github_token: ${{ secrets.GITHUB_TOKEN }}
47+
version: 3.x
48+
49+
- name: Install Go
50+
uses: actions/setup-go@v2
51+
with:
52+
go-version: ${{ env.GO_VERSION }}
53+
54+
- name: Install Task
55+
uses: arduino/setup-task@v1
56+
with:
57+
repo-token: ${{ secrets.GITHUB_TOKEN }}
58+
version: 3.x
59+
60+
- name: Update dependencies license metadata cache
61+
run: task --silent general:cache-dep-licenses
62+
63+
- name: Check for outdated cache
64+
id: diff
65+
run: |
66+
git add --intent-to-add .
67+
if ! git diff --color --exit-code; then
68+
echo
69+
echo "::error::Dependency license metadata out of sync. See: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-go-dependencies-task.md#metadata-cache"
70+
exit 1
71+
fi
72+
73+
# Some might find it convenient to have CI generate the cache rather than setting up for it locally
74+
- name: Upload cache to workflow artifact
75+
if: failure() && steps.diff.outcome == 'failure'
76+
uses: actions/upload-artifact@v2
77+
with:
78+
if-no-files-found: error
79+
name: dep-licenses-cache
80+
path: .licenses/
81+
82+
check-deps:
83+
runs-on: ubuntu-latest
84+
85+
steps:
86+
- name: Checkout repository
87+
uses: actions/checkout@v2
88+
with:
89+
submodules: recursive
90+
91+
- name: Install licensed
92+
uses: jonabc/setup-licensed@v1
93+
with:
94+
github_token: ${{ secrets.GITHUB_TOKEN }}
95+
version: 3.x
96+
97+
- name: Install Go
98+
uses: actions/setup-go@v2
99+
with:
100+
go-version: ${{ env.GO_VERSION }}
101+
102+
- name: Install Task
103+
uses: arduino/setup-task@v1
104+
with:
105+
repo-token: ${{ secrets.GITHUB_TOKEN }}
106+
version: 3.x
107+
108+
- name: Check for dependencies with unapproved licenses
109+
run: task --silent general:check-dep-licenses

Diff for: ‎.licensed.yml

+89
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
# See: https://github.com/github/licensed/blob/master/docs/configuration.md
2+
sources:
3+
go: true
4+
5+
shared_cache: true
6+
cache_path: .licenses/
7+
8+
apps:
9+
- source_path: ./
10+
- source_path: docsgen/
11+
- source_path: ruledocsgen/
12+
13+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-dependencies/GPL-3.0/.licensed.yml
14+
allowed:
15+
# The following are based on: https://www.gnu.org/licenses/license-list.html#GPLCompatibleLicenses
16+
- gpl-1.0-or-later
17+
- gpl-1.0+ # Deprecated ID for `gpl-1.0-or-later`
18+
- gpl-2.0-or-later
19+
- gpl-2.0+ # Deprecated ID for `gpl-2.0-or-later`
20+
- gpl-3.0-only
21+
- gpl-3.0 # Deprecated ID for `gpl-3.0-only`
22+
- gpl-3.0-or-later
23+
- gpl-3.0+ # Deprecated ID for `gpl-3.0-or-later`
24+
- lgpl-2.0-or-later
25+
- lgpl-2.0+ # Deprecated ID for `lgpl-2.0-or-later`
26+
- lgpl-2.1-only
27+
- lgpl-2.1 # Deprecated ID for `lgpl-2.1-only`
28+
- lgpl-2.1-or-later
29+
- lgpl-2.1+ # Deprecated ID for `lgpl-2.1-or-later`
30+
- lgpl-3.0-only
31+
- lgpl-3.0 # Deprecated ID for `lgpl-3.0-only`
32+
- lgpl-3.0-or-later
33+
- lgpl-3.0+ # Deprecated ID for `lgpl-3.0-or-later`
34+
- fsfap
35+
- apache-2.0
36+
- artistic-2.0
37+
- clartistic
38+
- sleepycat
39+
- bsl-1.0
40+
- bsd-3-clause
41+
- cecill-2.0
42+
- bsd-3-clause-clear
43+
# "Cryptix General License" - no SPDX ID (https://github.com/spdx/license-list-XML/issues/456)
44+
- ecos-2.0
45+
- ecl-2.0
46+
- efl-2.0
47+
- eudatagrid
48+
- mit
49+
- bsd-2-clause # Subsumed by `bsd-2-clause-views`
50+
- bsd-2-clause-netbsd # Deprecated ID for `bsd-2-clause`
51+
- bsd-2-clause-views # This is the version linked from https://www.gnu.org/licenses/license-list.html#FreeBSD
52+
- bsd-2-clause-freebsd # Deprecated ID for `bsd-2-clause-views`
53+
- ftl
54+
- hpnd
55+
- imatix
56+
- imlib2
57+
- ijg
58+
# "Informal license" - this is a general class of license
59+
- intel
60+
- isc
61+
- mpl-2.0
62+
- ncsa
63+
# "License of Netscape JavaScript" - no SPDX ID
64+
- oldap-2.7
65+
# "License of Perl 5 and below" - possibly `Artistic-1.0-Perl` ?
66+
- cc0-1.0
67+
- cc-pddc
68+
- psf-2.0
69+
- ruby
70+
- sgi-b-2.0
71+
- smlnj
72+
- standardml-nj # Deprecated ID for `smlnj`
73+
- unicode-dfs-2015
74+
- upl-1.0
75+
- unlicense
76+
- vim
77+
- w3c
78+
- wtfpl
79+
- lgpl-2.0-or-later with wxwindows-exception-3.1
80+
- wxwindows # Deprecated ID for `lgpl-2.0-or-later with wxwindows-exception-3.1`
81+
- x11
82+
- xfree86-1.1
83+
- zlib
84+
- zpl-2.0
85+
- zpl-2.1
86+
# The following are based on individual license text
87+
- eupl-1.2
88+
- liliq-r-1.1
89+
- liliq-rplus-1.1

Diff for: ‎.licenses/go/github.com/JohannesKaufmann/html-to-markdown/escape.dep.yml

+35
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
---
2+
name: github.com/JohannesKaufmann/html-to-markdown/escape
3+
version: v1.3.0
4+
type: go
5+
summary: Package escape escapes characters that are commonly used in markdown like
6+
the * for strong/italic.
7+
homepage: https://pkg.go.dev/github.com/JohannesKaufmann/html-to-markdown/escape
8+
license: mit
9+
licenses:
10+
- sources: [email protected]/LICENSE
11+
text: |
12+
MIT License
13+
14+
Copyright (c) 2018 Johannes Kaufmann
15+
16+
Permission is hereby granted, free of charge, to any person obtaining a copy
17+
of this software and associated documentation files (the "Software"), to deal
18+
in the Software without restriction, including without limitation the rights
19+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
20+
copies of the Software, and to permit persons to whom the Software is
21+
furnished to do so, subject to the following conditions:
22+
23+
The above copyright notice and this permission notice shall be included in all
24+
copies or substantial portions of the Software.
25+
26+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
27+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
28+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
29+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
30+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
31+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
32+
SOFTWARE.
33+
- sources: [email protected]/README.md
34+
text: This project is licensed under the terms of the MIT license.
35+
notices: []

Diff for: ‎.licenses/go/github.com/ProtonMail/go-crypto/bitcurves.dep.yml

+62
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
---
2+
name: github.com/ProtonMail/go-crypto/bitcurves
3+
version: v0.0.0-20210428141323-04723f9f07d7
4+
type: go
5+
summary:
6+
homepage: https://pkg.go.dev/github.com/ProtonMail/go-crypto/bitcurves
7+
license: bsd-3-clause
8+
licenses:
9+
- sources: [email protected]/LICENSE
10+
text: |
11+
Copyright (c) 2009 The Go Authors. All rights reserved.
12+
13+
Redistribution and use in source and binary forms, with or without
14+
modification, are permitted provided that the following conditions are
15+
met:
16+
17+
* Redistributions of source code must retain the above copyright
18+
notice, this list of conditions and the following disclaimer.
19+
* Redistributions in binary form must reproduce the above
20+
copyright notice, this list of conditions and the following disclaimer
21+
in the documentation and/or other materials provided with the
22+
distribution.
23+
* Neither the name of Google Inc. nor the names of its
24+
contributors may be used to endorse or promote products derived from
25+
this software without specific prior written permission.
26+
27+
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
28+
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
29+
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
30+
A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
31+
OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
32+
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
33+
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
34+
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
35+
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
36+
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
37+
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
38+
- sources: [email protected]/PATENTS
39+
text: |
40+
Additional IP Rights Grant (Patents)
41+
42+
"This implementation" means the copyrightable works distributed by
43+
Google as part of the Go project.
44+
45+
Google hereby grants to You a perpetual, worldwide, non-exclusive,
46+
no-charge, royalty-free, irrevocable (except as stated in this section)
47+
patent license to make, have made, use, offer to sell, sell, import,
48+
transfer and otherwise run, modify and propagate the contents of this
49+
implementation of Go, where such license applies only to those patent
50+
claims, both currently owned or controlled by Google and acquired in
51+
the future, licensable by Google that are necessarily infringed by this
52+
implementation of Go. This grant does not include claims that would be
53+
infringed only as a consequence of further modification of this
54+
implementation. If you or your agent or exclusive licensee institute or
55+
order or agree to the institution of patent litigation against any
56+
entity (including a cross-claim or counterclaim in a lawsuit) alleging
57+
that this implementation of Go or any code incorporated within this
58+
implementation of Go constitutes direct or contributory patent
59+
infringement, or inducement of patent infringement, then any patent
60+
rights granted to you under this License for this implementation of Go
61+
shall terminate as of the date such litigation is filed.
62+
notices: []

Diff for: ‎.licenses/go/github.com/ProtonMail/go-crypto/brainpool.dep.yml

+62
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
---
2+
name: github.com/ProtonMail/go-crypto/brainpool
3+
version: v0.0.0-20210428141323-04723f9f07d7
4+
type: go
5+
summary: Package brainpool implements Brainpool elliptic curves.
6+
homepage: https://pkg.go.dev/github.com/ProtonMail/go-crypto/brainpool
7+
license: bsd-3-clause
8+
licenses:
9+
- sources: [email protected]/LICENSE
10+
text: |
11+
Copyright (c) 2009 The Go Authors. All rights reserved.
12+
13+
Redistribution and use in source and binary forms, with or without
14+
modification, are permitted provided that the following conditions are
15+
met:
16+
17+
* Redistributions of source code must retain the above copyright
18+
notice, this list of conditions and the following disclaimer.
19+
* Redistributions in binary form must reproduce the above
20+
copyright notice, this list of conditions and the following disclaimer
21+
in the documentation and/or other materials provided with the
22+
distribution.
23+
* Neither the name of Google Inc. nor the names of its
24+
contributors may be used to endorse or promote products derived from
25+
this software without specific prior written permission.
26+
27+
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
28+
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
29+
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
30+
A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
31+
OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
32+
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
33+
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
34+
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
35+
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
36+
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
37+
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
38+
- sources: [email protected]/PATENTS
39+
text: |
40+
Additional IP Rights Grant (Patents)
41+
42+
"This implementation" means the copyrightable works distributed by
43+
Google as part of the Go project.
44+
45+
Google hereby grants to You a perpetual, worldwide, non-exclusive,
46+
no-charge, royalty-free, irrevocable (except as stated in this section)
47+
patent license to make, have made, use, offer to sell, sell, import,
48+
transfer and otherwise run, modify and propagate the contents of this
49+
implementation of Go, where such license applies only to those patent
50+
claims, both currently owned or controlled by Google and acquired in
51+
the future, licensable by Google that are necessarily infringed by this
52+
implementation of Go. This grant does not include claims that would be
53+
infringed only as a consequence of further modification of this
54+
implementation. If you or your agent or exclusive licensee institute or
55+
order or agree to the institution of patent litigation against any
56+
entity (including a cross-claim or counterclaim in a lawsuit) alleging
57+
that this implementation of Go or any code incorporated within this
58+
implementation of Go constitutes direct or contributory patent
59+
infringement, or inducement of patent infringement, then any patent
60+
rights granted to you under this License for this implementation of Go
61+
shall terminate as of the date such litigation is filed.
62+
notices: []

0 commit comments

Comments
 (0)