From bc4decf7400ef56eacfd5d7696224cc08c1c9287 Mon Sep 17 00:00:00 2001 From: Enrico Risa Date: Wed, 16 Sep 2026 16:55:46 +0200 Subject: [PATCH] feat: dash check on release --- .github/workflows/release-plz-prepare.yml | 14 ++ DEPENDENCIES.txt | 230 ++++++++++++++++++++++ scripts/check-dependencies.sh | 35 ++++ scripts/dash-common.sh | 36 ++++ scripts/request-dependency-review.sh | 40 ++++ 5 files changed, 355 insertions(+) create mode 100644 DEPENDENCIES.txt create mode 100755 scripts/check-dependencies.sh create mode 100755 scripts/dash-common.sh create mode 100755 scripts/request-dependency-review.sh diff --git a/.github/workflows/release-plz-prepare.yml b/.github/workflows/release-plz-prepare.yml index aa20a2d..15757de 100644 --- a/.github/workflows/release-plz-prepare.yml +++ b/.github/workflows/release-plz-prepare.yml @@ -4,6 +4,11 @@ name: Prepare Release # branch. A human then opens the PR from that branch — pushing a branch is allowed for # GITHUB_TOKEN even when the org forbids Actions from *creating* PRs, and a human-opened PR # also gets normal CI. Merging that PR triggers release-plz.yml to publish (publish-on-merge). +# +# Before computing the release, the Eclipse Dash License Tool is run over the dependency tree +# (scripts/check-dependencies.sh). The run aborts if any dependency is restricted or rejected, +# i.e. still needs an Eclipse IP Team review. The regenerated DEPENDENCIES.txt is committed to +# the release branch. on: workflow_dispatch: @@ -31,6 +36,15 @@ jobs: - name: Install Rust toolchain uses: dtolnay/rust-toolchain@stable + - name: Install Java (for Eclipse Dash License Tool) + uses: actions/setup-java@v4 + with: + distribution: temurin + java-version: "21" + + - name: Check dependency licenses (Eclipse Dash) + run: scripts/check-dependencies.sh + - name: Install release-plz uses: taiki-e/install-action@v2 with: diff --git a/DEPENDENCIES.txt b/DEPENDENCIES.txt new file mode 100644 index 0000000..67ab773 --- /dev/null +++ b/DEPENDENCIES.txt @@ -0,0 +1,230 @@ +crate/cratesio/-/allocator-api2/0.2.21, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/anyhow/1.0.104, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #16097 +crate/cratesio/-/arraydeque/0.5.1, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/async-trait/0.1.92, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #6666 +crate/cratesio/-/atoi/2.0.0, MIT, approved, clearlydefined +crate/cratesio/-/atomic-waker/1.1.2, Apache-2.0 OR MIT, approved, clearlydefined +crate/cratesio/-/aws-lc-rs/1.16.1, Apache-2.0 OR ISC AND (Apache-2.0 AND ISC) AND (Apache-2.0 OR ISC) AND (Apache-2.0 OR ISC), approved, #31088 +crate/cratesio/-/aws-lc-sys/0.38.0, Apache-2.0 AND ISC AND (Apache-2.0 OR ISC) AND ((Apache-2.0 OR ISC) AND OpenSSL) AND (Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND GPL-2.0-only AND ISC AND LicenseRef-scancode-openssl AND LicenseRef-scancode-ssleay-windows AND MIT AND OpenSSL) AND (MIT OR CC0-1.0) AND (LicenseRef-scancode-openssl AND LicenseRef-scancode-ssleay-windows) AND (BSD-3-Clause AND OpenSSL) AND (BSD-3-Clause AND GPL-1.0-or-later AND OpenSSL) AND (LicenseRef-scancode-openssl AND OpenSSL) AND (Apache-2.0 OR ISC OR MIT) AND (BSD-3-Clause AND GPL-2.0-only AND OpenSSL) AND (LicenseRef-scancode-openssl AND LicenseRef-scancode-openssl-nokia-psk-contribution AND LicenseRef-scancode-ssleay-windows) AND (LicenseRef-scancode-openssl AND LicenseRef-scancode-openssl-nokia-psk-contribution AND LicenseRef-scancode-ssleay-windows AND OpenSSL) AND (LicenseRef-scancode-proprietary-license AND LicenseRef-scancode-ssleay-windows) AND (LicenseRef-scancode-openssl-nokia-psk-contribution AND LicenseRef-scancode-ssleay-windows) AND (BSD-3-Clause AND GPL, restricted, #31085 +crate/cratesio/-/axum-core/0.5.6, MIT, approved, clearlydefined +crate/cratesio/-/axum-extra/0.12.6, MIT, approved, #31080 +crate/cratesio/-/axum-macros/0.5.1, MIT, approved, #31083 +crate/cratesio/-/axum/0.8.9, MIT, approved, #27199 +crate/cratesio/-/base64/0.22.1, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #14618 +crate/cratesio/-/base64/0.23.1, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/bitflags/2.10.0, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/block-buffer/0.10.4, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/bon-macros/3.9.3, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/bon/3.9.3, Apache-2.0 AND MIT, approved, #31087 +crate/cratesio/-/byteorder/1.5.0, Unlicense OR MIT, approved, clearlydefined +crate/cratesio/-/bytes/1.11.1, MIT, approved, #26020 +crate/cratesio/-/cfg-if/1.0.4, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/chrono/0.4.45, Apache-2.0 AND MIT, approved, #25679 +crate/cratesio/-/concurrent-queue/2.5.0, Apache-2.0 OR MIT, approved, clearlydefined +crate/cratesio/-/config/0.15.25, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/const-random-macro/0.1.16, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/const-random/0.1.18, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/convert_case/0.6.0, MIT, approved, clearlydefined +crate/cratesio/-/cpufeatures/0.2.17, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #16101 +crate/cratesio/-/crc-catalog/2.4.0, Apache-2.0 AND MIT, approved, #31078 +crate/cratesio/-/crc/3.4.0, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/crossbeam-queue/0.3.12, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #30073 +crate/cratesio/-/crossbeam-utils/0.8.21, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #30082 +crate/cratesio/-/crunchy/0.2.4, MIT, approved, clearlydefined +crate/cratesio/-/crypto-common/0.1.7, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/darling/0.21.3, MIT, approved, clearlydefined +crate/cratesio/-/darling_core/0.21.3, MIT, approved, clearlydefined +crate/cratesio/-/darling_macro/0.21.3, MIT, approved, clearlydefined +crate/cratesio/-/digest/0.10.7, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/displaydoc/0.2.5, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #17430 +crate/cratesio/-/dlv-list/0.5.2, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/dotenvy/0.15.7, MIT, approved, clearlydefined +crate/cratesio/-/either/1.15.0, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #20272 +crate/cratesio/-/encoding_rs/0.8.35, Apache-2.0 AND BSD-3-Clause AND MIT AND Apache-2.0 AND (Apache-2.0 AND CC0-1.0 AND MIT) AND MIT AND BSD-3-Clause AND (Apache-2.0 AND BSD-3-Clause AND CC0-1.0 AND MIT) AND (Apache-2.0 AND MIT) AND CC0-1.0, approved, #9762 +crate/cratesio/-/equivalent/1.0.2, Apache-2.0 OR MIT, approved, clearlydefined +crate/cratesio/-/erased-serde/0.4.9, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #24465 +crate/cratesio/-/errno/0.3.14, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/event-listener/5.4.1, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #30067 +crate/cratesio/-/fnv/1.0.7, Apache-2.0 OR MIT, approved, clearlydefined +crate/cratesio/-/foldhash/0.1.5, Zlib, approved, clearlydefined +crate/cratesio/-/foldhash/0.2.0, Zlib, approved, clearlydefined +crate/cratesio/-/form_urlencoded/1.2.2, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/futures-channel/0.3.33, (Apache-2.0 or MIT) AND BSD-2-Clause-Views, approved, #6671 +crate/cratesio/-/futures-core/0.3.33, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #17218 +crate/cratesio/-/futures-intrusive/0.5.0, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/futures-io/0.3.33, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #17223 +crate/cratesio/-/futures-sink/0.3.33, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #17222 +crate/cratesio/-/futures-task/0.3.33, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #17217 +crate/cratesio/-/futures-util/0.3.33, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #17219 +crate/cratesio/-/generic-array/0.14.7, MIT, approved, clearlydefined +crate/cratesio/-/getrandom/0.2.17, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #25580 +crate/cratesio/-/getrandom/0.4.2, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #26536 +crate/cratesio/-/h2/0.4.13, MIT, approved, #29113 +crate/cratesio/-/hashbrown/0.14.5, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/hashbrown/0.15.5, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #17428 +crate/cratesio/-/hashbrown/0.16.1, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #23538 +crate/cratesio/-/hashlink/0.10.0, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/hashlink/0.11.1, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/headers-core/0.3.0, MIT, approved, clearlydefined +crate/cratesio/-/headers/0.4.1, MIT, approved, clearlydefined +crate/cratesio/-/heck/0.5.0, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/hex/0.4.3, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/hkdf/0.12.4, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/hmac/0.12.1, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/home/0.5.12, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/http-body-util/0.1.4, MIT, approved, #30205 +crate/cratesio/-/http-body/1.0.1, MIT, approved, clearlydefined +crate/cratesio/-/http/1.4.0, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #25475 +crate/cratesio/-/httparse/1.10.1, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #19932 +crate/cratesio/-/httpdate/1.0.3, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/hyper-rustls/0.27.7, Apache-2.0 OR ISC OR MIT, approved, clearlydefined +crate/cratesio/-/hyper-util/0.1.20, MIT, approved, clearlydefined +crate/cratesio/-/hyper/1.8.1, MIT, approved, clearlydefined +crate/cratesio/-/iana-time-zone/0.1.65, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #23542 +crate/cratesio/-/icu_collections/2.1.1, Unicode-3.0, approved, #25128 +crate/cratesio/-/icu_locale_core/2.1.1, Unicode-3.0, approved, #25133 +crate/cratesio/-/icu_normalizer/2.1.1, Unicode-3.0, approved, #25131 +crate/cratesio/-/icu_normalizer_data/2.1.1, Unicode-3.0, approved, #25127 +crate/cratesio/-/icu_properties/2.1.2, Unicode-3.0, approved, #25119 +crate/cratesio/-/icu_properties_data/2.1.2, Apache-2.0, approved, #25120 +crate/cratesio/-/icu_provider/2.1.1, Unicode-3.0 AND (Apache-2.0 OR MIT), approved, #25123 +crate/cratesio/-/ident_case/1.0.1, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/idna/1.1.0, Apache-2.0 AND MIT AND Unicode-TOU, approved, #23543 +crate/cratesio/-/idna_adapter/1.2.1, Apache-2.0 OR MIT, approved, clearlydefined +crate/cratesio/-/indexmap/2.13.0, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #29691 +crate/cratesio/-/ipnet/2.11.0, Apache-2.0 AND MIT, approved, #31082 +crate/cratesio/-/itoa/1.0.17, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #17174 +crate/cratesio/-/json5/0.4.1, ISC, approved, #17819 +crate/cratesio/-/lazy_static/1.5.0, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/libc/0.2.180, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #16809 +crate/cratesio/-/litemap/0.8.1, Unicode-3.0, approved, #22551 +crate/cratesio/-/lock_api/0.4.14, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/log/0.4.29, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #18691 +crate/cratesio/-/matchers/0.2.0, MIT, approved, clearlydefined +crate/cratesio/-/matchit/0.8.4, MIT AND BSD-3-Clause, approved, clearlydefined +crate/cratesio/-/md-5/0.10.6, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/memchr/2.7.6, Unlicense AND (MIT AND Unlicense) AND MIT, approved, #15463 +crate/cratesio/-/mime/0.3.17, Apache-2.0 AND MIT, approved, #17178 +crate/cratesio/-/mio/1.1.1, MIT, approved, #25477 +crate/cratesio/-/nu-ansi-term/0.50.3, MIT, approved, #24623 +crate/cratesio/-/num-traits/0.2.19, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/once_cell/1.21.3, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #20275 +crate/cratesio/-/openssl-probe/0.2.1, Apache-2.0 AND MIT AND OpenSSL AND LicenseRef-BSD-style, approved, #27067 +crate/cratesio/-/ordered-multimap/0.7.3, MIT, approved, clearlydefined +crate/cratesio/-/parking/2.2.1, Apache-2.0 OR MIT, approved, clearlydefined +crate/cratesio/-/parking_lot/0.12.5, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/parking_lot_core/0.9.12, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/pathdiff/0.2.3, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/percent-encoding/2.3.2, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/pest/2.8.6, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #26148 +crate/cratesio/-/pest_derive/2.8.6, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #26147 +crate/cratesio/-/pest_generator/2.8.6, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #26158 +crate/cratesio/-/pest_meta/2.8.6, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #26154 +crate/cratesio/-/pin-project-lite/0.2.16, Apache-2.0 or MIT, approved, #14202 +crate/cratesio/-/pin-utils/0.1.0, Apache-2.0 OR MIT, approved, clearlydefined +crate/cratesio/-/potential_utf/0.1.4, Unicode-3.0, approved, #22549 +crate/cratesio/-/ppv-lite86/0.2.21, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #20269 +crate/cratesio/-/prettyplease/0.2.37, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #17305 +crate/cratesio/-/proc-macro2/1.0.106, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #15103 +crate/cratesio/-/quote/1.0.44, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #17177 +crate/cratesio/-/rand/0.8.5, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #27436 +crate/cratesio/-/rand_chacha/0.3.1, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/rand_core/0.6.4, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #16073 +crate/cratesio/-/regex-automata/0.4.16, Apache-2.0 or MIT, approved, #15415 +crate/cratesio/-/regex-syntax/0.8.11, (Apache-2.0 or MIT) AND Unicode-DFS-2016, approved, #11398 +crate/cratesio/-/reqwest/0.13.4, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #28551 +crate/cratesio/-/ring/0.17.14, ISC AND OpenSSL AND MIT AND (OpenSSL OR LicenseRef-Cryptograms) AND LicenseRef-Public-domain AND LicenseRef-SSLeay, approved, #11393 +crate/cratesio/-/ron/0.12.0, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #25470 +crate/cratesio/-/rust-ini/0.21.3, MIT, approved, #31081 +crate/cratesio/-/rustls-native-certs/0.8.3, Apache-2.0 AND ISC AND MIT AND Apache-2.0 AND ISC AND MIT, approved, #28543 +crate/cratesio/-/rustls-pki-types/1.14.0, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #25680 +crate/cratesio/-/rustls-platform-verifier/0.6.2, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #25480 +crate/cratesio/-/rustls-webpki/0.103.9, ISC, approved, #22461 +crate/cratesio/-/rustls/0.23.36, Apache-2.0 AND ISC AND MIT, approved, #25685 +crate/cratesio/-/rustversion/1.0.22, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #19410 +crate/cratesio/-/ryu/1.0.23, Apache-2.0 AND BSL-1.0 AND CC-BY-SA-3.0, approved, #4267 +crate/cratesio/-/scopeguard/1.2.0, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/serde-untagged/0.1.9, Apache-2.0 AND MIT, approved, #31079 +crate/cratesio/-/serde/1.0.228, Apache-2.0 or MIT, approved, #16100 +crate/cratesio/-/serde_core/1.0.228, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #29876 +crate/cratesio/-/serde_derive/1.0.228, Apache-2.0 or MIT, approved, #16099 +crate/cratesio/-/serde_json/1.0.151, Apache-2.0 AND MIT, approved, #4264 +crate/cratesio/-/serde_path_to_error/0.1.20, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #17172 +crate/cratesio/-/serde_spanned/1.0.4, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #26146 +crate/cratesio/-/serde_urlencoded/0.7.1, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/sha1/0.10.6, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #30085 +crate/cratesio/-/sha2/0.10.9, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/sharded-slab/0.1.7, MIT, approved, clearlydefined +crate/cratesio/-/signal-hook-registry/1.4.8, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #25534 +crate/cratesio/-/slab/0.4.12, MIT, approved, #22882 +crate/cratesio/-/smallvec/1.15.1, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #29108 +crate/cratesio/-/socket2/0.6.2, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #26546 +crate/cratesio/-/sqlx-core/0.8.6, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/sqlx-macros-core/0.8.6, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/sqlx-macros/0.8.6, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/sqlx-postgres/0.8.6, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/sqlx/0.8.6, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/stable_deref_trait/1.2.1, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/stringprep/0.1.5, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/strsim/0.11.1, MIT, approved, clearlydefined +crate/cratesio/-/subtle/2.6.1, BSD-3-Clause, approved, #16076 +crate/cratesio/-/syn/2.0.114, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #14203 +crate/cratesio/-/syn/3.0.2, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #29877 +crate/cratesio/-/sync_wrapper/1.0.2, Apache-2.0, approved, clearlydefined +crate/cratesio/-/synstructure/0.13.2, MIT, approved, clearlydefined +crate/cratesio/-/thiserror-impl/2.0.20, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #25682 +crate/cratesio/-/thiserror/2.0.20, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #19424 +crate/cratesio/-/thread_local/1.1.9, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #30081 +crate/cratesio/-/tiny-keccak/2.0.2, CC0-1.0, approved, clearlydefined +crate/cratesio/-/tinystr/0.8.2, Unicode-3.0, approved, #22554 +crate/cratesio/-/tinyvec/1.10.0, Apache-2.0 AND MIT AND Zlib AND Apache-2.0 AND MIT AND Zlib, approved, #23539 +crate/cratesio/-/tinyvec_macros/0.1.1, MIT OR Apache-2.0 OR Zlib, approved, clearlydefined +crate/cratesio/-/tokio-macros/2.6.0, MIT, approved, #26543 +crate/cratesio/-/tokio-rustls/0.26.4, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/tokio-stream/0.1.18, MIT, approved, #30519 +crate/cratesio/-/tokio-util/0.7.18, MIT, approved, #11389 +crate/cratesio/-/tokio/1.50.0, MIT, approved, #26541 +crate/cratesio/-/toml/1.0.6+spec-1.1.0, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/toml_datetime/1.0.0+spec-1.1.0, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #26547 +crate/cratesio/-/toml_parser/1.0.9+spec-1.1.0, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #26163 +crate/cratesio/-/tower-http/0.6.11, MIT AND CC0-1.0, approved, #28570 +crate/cratesio/-/tower-http/0.7.0, MIT AND CC0-1.0, approved, #31086 +crate/cratesio/-/tower-layer/0.3.3, MIT, approved, clearlydefined +crate/cratesio/-/tower-service/0.3.3, MIT, approved, clearlydefined +crate/cratesio/-/tower/0.5.3, MIT AND Apache-2.0, approved, #16671 +crate/cratesio/-/tracing-attributes/0.1.31, MIT, approved, #22260 +crate/cratesio/-/tracing-core/0.1.36, MIT, approved, #17502 +crate/cratesio/-/tracing-log/0.2.0, MIT, approved, clearlydefined +crate/cratesio/-/tracing-subscriber/0.3.23, MIT AND BSD-3-Clause AND BSD-2-Clause AND LicenseRef-Public-Domain, approved, #6670 +crate/cratesio/-/tracing/0.1.44, MIT, approved, #25125 +crate/cratesio/-/try-lock/0.2.5, MIT, approved, clearlydefined +crate/cratesio/-/typeid/1.0.3, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #24466 +crate/cratesio/-/typenum/1.19.0, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/ucd-trie/0.1.7, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/unicode-bidi/0.3.18, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/unicode-ident/1.0.22, Apache-2.0 AND MIT AND LicenseRef-unicode, approved, #4138 +crate/cratesio/-/unicode-normalization/0.1.25, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/unicode-properties/0.1.4, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/unicode-segmentation/1.12.0, MIT OR Apache-2.0, approved, clearlydefined +crate/cratesio/-/untrusted/0.9.0, ISC AND (ISC AND MIT), approved, #7111 +crate/cratesio/-/url/2.5.8, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #17429 +crate/cratesio/-/utf8_iter/1.0.4, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #15426 +crate/cratesio/-/uuid/1.24.1, Apache-2.0 AND MIT AND Apache-2.0 AND MIT, approved, #30089 +crate/cratesio/-/want/0.3.1, MIT, approved, clearlydefined +crate/cratesio/-/webpki-roots/0.26.11, CDLA-Permissive-2.0, approved, #22432 +crate/cratesio/-/webpki-roots/1.0.6, LicenseRef-CDLA-Permissive-2.0, approved, #25535 +crate/cratesio/-/whoami/1.6.1, Apache-2.0 OR BSL-1.0 OR MIT, approved, clearlydefined +crate/cratesio/-/winnow/0.7.15, MIT, approved, #25471 +crate/cratesio/-/winnow/1.0.3, MIT, approved, #28553 +crate/cratesio/-/writeable/0.6.2, Unicode-3.0, approved, #22550 +crate/cratesio/-/yaml-rust2/0.11.0, (Apache-2.0 AND MIT), approved, #31084 +crate/cratesio/-/yoke-derive/0.8.1, Unicode-3.0, approved, #22553 +crate/cratesio/-/yoke/0.8.1, Unicode-3.0, approved, #22547 +crate/cratesio/-/zerocopy/0.8.39, Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND MIT AND (Apache-2.0 AND BSD-3-Clause AND MIT) AND (Apache-2.0 AND BSD-2-Clause AND MIT) AND Apache-2.0 AND BSD-2-Clause AND MIT, approved, #20054 +crate/cratesio/-/zerofrom-derive/0.1.6, Apache-2.0 AND Unicode-3.0, approved, #15438 +crate/cratesio/-/zerofrom/0.1.6, Apache-2.0 AND Unicode-3.0, approved, #15435 +crate/cratesio/-/zeroize/1.8.2, Apache-2.0 OR MIT, approved, clearlydefined +crate/cratesio/-/zerotrie/0.2.3, Unicode-3.0, approved, #22561 +crate/cratesio/-/zerovec-derive/0.11.2, Unicode-3.0, approved, #22552 +crate/cratesio/-/zerovec/0.11.5, Unicode-3.0, approved, #22560 +crate/cratesio/-/zmij/1.0.19, MIT, approved, #25540 diff --git a/scripts/check-dependencies.sh b/scripts/check-dependencies.sh new file mode 100755 index 0000000..04db940 --- /dev/null +++ b/scripts/check-dependencies.sh @@ -0,0 +1,35 @@ +#!/usr/bin/env bash +# Runs the Eclipse Dash License Tool over the workspace's normal (non-dev) dependencies. +# Writes DEPENDENCIES.txt and fails if any dependency is restricted or rejected, i.e. still needs +# an Eclipse IP Team review (see scripts/request-dependency-review.sh to file those reviews). +# +# Usage: scripts/check-dependencies.sh +# Environment: see scripts/dash-common.sh (DASH_JAR, DASH_TIMEOUT). +set -euo pipefail +cd "$(git rev-parse --show-toplevel)" +# shellcheck source=scripts/dash-common.sh +source scripts/dash-common.sh + +SUMMARY=DEPENDENCIES.txt + +dash_ensure_jar + +# Dash writes the summary incrementally, so write to a temp file and only replace the committed +# summary once the tool ran to completion (exit 127 = internal error, e.g. a network timeout). +tmp_summary=$(mktemp) +trap 'rm -f "$tmp_summary"' EXIT +status=0 +dash_dependency_ids | java -jar "$DASH_JAR" -timeout "$DASH_TIMEOUT" -summary "$tmp_summary" - || status=$? + +if [ "$status" -eq 127 ]; then + echo "::error::Eclipse Dash License Tool failed to run; $SUMMARY was left unchanged." + exit "$status" +fi +mv "$tmp_summary" "$SUMMARY" + +# Explicit gate on the summary (dash itself already exits non-zero for non-approved content). +if grep -E ', (restricted|rejected), ' "$SUMMARY"; then + echo "::error::Restricted or rejected dependencies found in $SUMMARY (see above). File an IP review before releasing." + exit 1 +fi +exit "$status" diff --git a/scripts/dash-common.sh b/scripts/dash-common.sh new file mode 100755 index 0000000..e2e849a --- /dev/null +++ b/scripts/dash-common.sh @@ -0,0 +1,36 @@ +#!/usr/bin/env bash +# Shared helpers for the Eclipse Dash License Tool (https://github.com/eclipse-dash/dash-licenses). +# Source this file; it expects `set -euo pipefail` and the repo root as working directory. +# +# DASH_JAR=/path/to/dash.jar reuse an already downloaded jar (default: $RUNNER_TEMP or /tmp) +# DASH_TIMEOUT=120 per-request timeout in seconds for the license services + +DASH_JAR="${DASH_JAR:-${RUNNER_TEMP:-${TMPDIR:-/tmp}}/dash.jar}" +DASH_URL='https://repo.eclipse.org/service/rest/v1/search/assets/download?sort=version&repository=dash-maven2-releases&maven.groupId=org.eclipse.dash&maven.artifactId=org.eclipse.dash.licenses&maven.extension=jar' +DASH_TIMEOUT="${DASH_TIMEOUT:-120}" + +# Eclipse project this repository belongs to (https://projects.eclipse.org/projects/technology.dataplane-core). +ECLIPSE_PROJECT_ID="${ECLIPSE_PROJECT_ID:-technology.dataplane-core}" +ECLIPSE_PROJECT_REPO="${ECLIPSE_PROJECT_REPO:-https://github.com/eclipse-dataplane-core/dataplane-sdk-rust}" + +# Downloads the latest released dash jar unless DASH_JAR already exists. +dash_ensure_jar() { + if [ ! -f "$DASH_JAR" ]; then + echo "Downloading Eclipse Dash License Tool to $DASH_JAR" >&2 + curl -sSfL -o "$DASH_JAR" "$DASH_URL" + fi +} + +# Prints the ClearlyDefined ids ("crate/cratesio/-//") of all normal (non-dev) +# dependencies from the committed Cargo.lock, one per line. +# +# cargo tree lines look like: "name v1.2.3", "name v1.2.3 (proc-macro)", "name v1.2.3 (/local/path)", +# "name v1.2.3 (https://git...)". Only registry crates have a ClearlyDefined id on crates.io; local +# path crates (the workspace members) and git sources are dropped. Blank lines separate workspace roots. +dash_dependency_ids() { + cargo tree -e normal --prefix none --no-dedupe --locked \ + | sort -u \ + | grep -v '^[[:space:]]*$' \ + | grep -Ev ' \((/|[a-z+]+://)' \ + | sed -E 's|^([^ ]+) v([^ ]+).*$|crate/cratesio/-/\1/\2|' +} diff --git a/scripts/request-dependency-review.sh b/scripts/request-dependency-review.sh new file mode 100755 index 0000000..78508e3 --- /dev/null +++ b/scripts/request-dependency-review.sh @@ -0,0 +1,40 @@ +#!/usr/bin/env bash +# Files Eclipse IP Team review requests (IPLab issues on gitlab.eclipse.org) for every dependency +# that the Eclipse Dash License Tool cannot approve automatically. Run this when +# scripts/check-dependencies.sh reports restricted dependencies. +# +# Usage: GITLAB_API_TOKEN= scripts/request-dependency-review.sh +# +# GITLAB_API_TOKEN required; a personal access token from gitlab.eclipse.org with scope `api` +# (https://gitlab.eclipse.org/-/user_settings/personal_access_tokens). +# Passed via the environment only, never as an argument. Do not share it. +# ECLIPSE_PROJECT_ID Eclipse project id (default: technology.dataplane-core) +# ECLIPSE_PROJECT_REPO repository URL attached to the review requests +# DASH_JAR, DASH_TIMEOUT see scripts/dash-common.sh +# +# Dash files at most five review requests per run, so re-run the script until it reports nothing +# left to review. Content that already has an open review is not filed twice. The tool exits +# non-zero while any dependency is still unapproved; that is expected until the IP Team has +# closed the reviews. +set -euo pipefail +cd "$(git rev-parse --show-toplevel)" +# shellcheck source=scripts/dash-common.sh +source scripts/dash-common.sh + +if [ -z "${GITLAB_API_TOKEN:-}" ]; then + echo "GITLAB_API_TOKEN is not set. Create a token with scope 'api' at" >&2 + echo "https://gitlab.eclipse.org/-/user_settings/personal_access_tokens and export it." >&2 + exit 2 +fi + +dash_ensure_jar + +echo "Requesting IP Team reviews for project $ECLIPSE_PROJECT_ID ($ECLIPSE_PROJECT_REPO)" >&2 +dash_dependency_ids \ + | java -jar "$DASH_JAR" \ + -timeout "$DASH_TIMEOUT" \ + -review \ + -token "$GITLAB_API_TOKEN" \ + -project "$ECLIPSE_PROJECT_ID" \ + -repo "$ECLIPSE_PROJECT_REPO" \ + -