Martin Vogel
487f3f945b
Release archives now carry THIRD_PARTY_NOTICES.md, generated by scripts/gen-third-party-notices.sh from THIRD_PARTY.md, the grammar manifest, and the per-component license texts; the Homebrew formula and AUR PKGBUILD install it alongside the binary. The SBOM gains per-component license metadata, corrected versions, and the previously missing vendored libraries. The security workflow gains a vendored-license scan with an explicit allow-list policy, and the release workflow exposes a skip_perf input for releases that do not touch pipeline logic.
54 lines
1.6 KiB
Python
Executable File
54 lines
1.6 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
"""License-gate policy check over a ScanCode Toolkit JSON scan.
|
|
|
|
Usage: license-gate-check.py <scan.json> <license-policy.json>
|
|
|
|
Fails (exit 1) if ANY scanned file carries a detected license expression
|
|
containing an SPDX id outside the policy allow-list — one finding is enough.
|
|
"""
|
|
import json
|
|
import re
|
|
import sys
|
|
|
|
|
|
def main():
|
|
scan_path, policy_path = sys.argv[1], sys.argv[2]
|
|
with open(policy_path) as fh:
|
|
policy = json.load(fh)
|
|
allowed = {x.lower() for x in policy["allowed_spdx_ids"]}
|
|
ignored_paths = tuple(policy.get("ignored_paths", []))
|
|
skip_tokens = {"and", "or", "with", ""}
|
|
|
|
with open(scan_path) as fh:
|
|
scan = json.load(fh)
|
|
|
|
violations = []
|
|
checked = 0
|
|
for f in scan.get("files", []):
|
|
path = f.get("path", "?")
|
|
if f.get("type") != "file":
|
|
continue
|
|
if ignored_paths and path.startswith(ignored_paths):
|
|
continue
|
|
expr = f.get("detected_license_expression_spdx")
|
|
if not expr:
|
|
continue
|
|
checked += 1
|
|
for tok in re.split(r"[\s()]+", expr):
|
|
if tok.lower() in skip_tokens:
|
|
continue
|
|
if tok.lower() not in allowed:
|
|
violations.append((path, expr, tok))
|
|
break
|
|
|
|
if violations:
|
|
print("BLOCKED: %d file(s) with non-allow-listed license detections:" % len(violations))
|
|
for path, expr, tok in violations[:25]:
|
|
print(" %s: '%s' (offending id: %s)" % (path, expr, tok))
|
|
sys.exit(1)
|
|
print("OK: %d detection(s), all allow-listed" % checked)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|