mirror of
https://github.com/screentinker/screentinker.git
synced 2026-08-14 22:33:12 -06:00
3f9459139f
Some checks are pending
CI / Unit tests (node --test) (push) Waiting to run
CI / OpenAPI spec lint (push) Waiting to run
CI / Android unit tests (Kotlin schedule evaluator vectors) (push) Waiting to run
CI / Licence gate + SBOM (production deps) (push) Waiting to run
CI / Boot smoke + version check (push) Waiting to run
The licence audit that found org.json in the APK was run by hand. Nothing stopped the next
transitive dependency arriving the same way, and "we track licences" was a claim rather than
something anyone could check.
TWO GATES, BOTH FAIL CLOSED.
scripts/license-check.js audits the server's npm tree. scripts/android-license-check.js
resolves the real releaseRuntimeClasspath — everything that can enter the APK a customer
installs — and checks it against android/licenses.json, where each entry records the licence
AND the evidence for it. A dependency nobody has recorded fails the build. That is the case
worth catching: org.json reached customers because it arrived transitively and nothing ever
asked what licence it carried.
Denied: AGPL, GPL, SSPL, Commons Clause, BUSL, and the JSON Licence. Weak copyleft (LGPL,
MPL, EPL, CDDL) is reported but does not fail — it is a judgement, and the judgement should
be made by someone who knows they are making it. Anything unrecognised fails; a package whose
licence we cannot identify is not one we ship.
⚠️ THE SERVER GATE INSTALLS --omit=dev, AND THAT IS THE POINT. A developer checkout carries
sharp, whose @img/sharp-wasm32 declares LGPL-3.0-or-later. It is a test fixture generator that
never reaches a server, but a scanner pointed at a dev tree reports LGPL and contradicts the
answer we give customers. Auditing the production install is what makes the answer defensible.
SBOM. Every release now publishes screentinker-sbom-<version>.cdx.json — CycloneDX 1.5, every
production dependency with version, purl and licence, generated from a production install. CI
uploads one on every run too. That is what turns the claim into something a customer or an
underwriter can verify themselves.
Neither script takes a dependency: a gate that needs its own supply chain audited is worth
less than one that does not.
Verified by mutation rather than assumed. Injecting GPL-3.0-or-later, AGPL-3.0, the JSON
Licence, SSPL-1.0, and a package with no licence field each fail the server gate; MIT and
LGPL pass (LGPL reported). Removing the org.json exclusion fails the Android gate by name;
dropping a group from the policy fails it as unrecorded. Both restored, both green.
Found and fixed while building it: npm ls exits non-zero for any tree problem — an extraneous
package is enough — which made the gate abort instead of auditing. It now reads the listing
either way and only aborts on genuinely empty output.
docs/licensing.md records the policy, how to run the gates, and the dev-vs-production trap.
1676/1676 pass.
46 lines
2.8 KiB
JSON
46 lines
2.8 KiB
JSON
{
|
|
"_comment": [
|
|
"Licence policy for everything on the Android release runtime classpath — i.e. everything that",
|
|
"can end up inside the APK customers install.",
|
|
"",
|
|
"scripts/android-license-check.js resolves the real classpath and checks it against this file.",
|
|
"An artifact that appears in neither 'artifacts' nor 'groups' FAILS: a new transitive dependency",
|
|
"must be looked at by a person before it ships, which is exactly how org.json:json:20090211 got",
|
|
"into the APK unnoticed in the first place.",
|
|
"",
|
|
"Record what you verified in 'evidence' — the point is to be able to answer 'how do you know?'"
|
|
],
|
|
|
|
"groups": {
|
|
"androidx": { "license": "Apache-2.0", "evidence": "AndroidX / Jetpack, Apache-2.0 across the board" },
|
|
"com.google.android.material": { "license": "Apache-2.0", "evidence": "Material Components for Android" },
|
|
"com.google.code.gson": { "license": "Apache-2.0", "evidence": "google/gson LICENSE" },
|
|
"com.google.crypto.tink": { "license": "Apache-2.0", "evidence": "google/tink LICENSE" },
|
|
"com.google.errorprone": { "license": "Apache-2.0", "evidence": "google/error-prone LICENSE" },
|
|
"com.google.guava": { "license": "Apache-2.0", "evidence": "google/guava LICENSE" },
|
|
"com.google.j2objc": { "license": "Apache-2.0", "evidence": "google/j2objc LICENSE" },
|
|
"com.squareup.okhttp3": { "license": "Apache-2.0", "evidence": "square/okhttp LICENSE" },
|
|
"com.squareup.okio": { "license": "Apache-2.0", "evidence": "square/okio LICENSE" },
|
|
"org.checkerframework": { "license": "MIT", "evidence": "checker-framework, MIT for the qualifiers" },
|
|
"org.jetbrains": { "license": "Apache-2.0", "evidence": "JetBrains annotations" },
|
|
"org.jetbrains.kotlin": { "license": "Apache-2.0", "evidence": "Kotlin stdlib" },
|
|
"org.jetbrains.kotlinx": { "license": "Apache-2.0", "evidence": "kotlinx coroutines" },
|
|
"io.socket": { "license": "MIT", "evidence": "socket.io-client-java LICENSE (MIT)" }
|
|
},
|
|
|
|
"artifacts": {},
|
|
|
|
"denied": {
|
|
"org.json:json": {
|
|
"why": "JSON Licence — the 'shall be used for Good, not Evil' clause. Not OSI-approved, non-free per Debian and Fedora, Apache Category X. Arrives transitively via socket.io-client and was previously packaged into the APK in full (19 classes). Excluded in app/build.gradle.kts; Android provides org.json in the platform from API 1 and minSdk is 24, so nothing is lost."
|
|
}
|
|
},
|
|
|
|
"denied_licenses": [
|
|
{ "match": "AGPL", "why": "network copyleft" },
|
|
{ "match": "GPL", "why": "strong copyleft in a commercially distributed binary" },
|
|
{ "match": "SSPL", "why": "not OSI-approved, service-scope obligations" },
|
|
{ "match": "JSON", "why": "field-of-use restriction" }
|
|
]
|
|
}
|