Repository navigation
Slice 120: every file attributed, every dependency licensed, and both checked - #91
Merged
Merged
Conversation
…h checked reuse lint exits 0 against REUSE Specification 3.3 over all 613 files. It did not before: no LICENSES directory at all, 28 files carrying nothing, two files carrying expressions the tool could not parse. The part a linter cannot check is the part that mattered. Twenty-six of the uncovered files were the desktop shell's icons, and the obvious fix, sweeping every uncovered file under this project's copyright, would have passed. It would also have been false: those icons are the output of Tauri's own installer, as the commit that added them says. Attributing them to this project would have put a false copyright notice into the files whose purpose is to state copyright accurately, in the slice whose purpose is to make that statement checkable. THIRD_PARTY_LICENSES.md is generated from the CycloneDX bill, so the list and the bill cannot disagree. Building it found two dependencies with no licence in the bill at all: a Hex package carries its licences in its metadata, a git dependency carries nothing, and the bill emits such a component silently rather than with an error. The bill was not wrong, it was quiet, and nothing downstream could tell MIT from nobody checked. Both were read at the pinned commit rather than at a branch, and a component with a licence from neither source now fails the build. reuse lint is a workflow step rather than a gate row, because mix gate has to stay runnable inside the FIPS container and on a machine with no Python environment this project controls. mix trinity.reuse stays in the alias as the subset every leg can run, and the division is written into the step so it is not tidied away. One file cannot carry a header the formatter leaves alone: mix format joins the last heex comment onto the doctype, so the tag parses as Apache-2.0 followed by markup. Putting the doctype on its own line is undone every time. Resolved with REUSE ignore markers and an annotation, with the tags left in the file for a reader. The DCO check reads the whole history and excludes merge commits. Measured first without the exclusion: seven commits had no sign-off and all seven were merges, six of them made by GitHub on merging a pull request. A sign-off certifies the right to submit work; a forge's merge commit introduces none. GOVERNANCE.md states the committer process as it stands rather than as written: two of three maintainers joined by invitation, because there was no history of outside contribution for the published path to apply to. AC3 is retagged manual and recorded as unmet. It asks for the owner's word on the 024 signed field set, which slice 024 proposed for review and nothing since has cleared. Reporting it as met would be the exact failure this slice exists to prevent. mix gate: 730 passed, 18 excluded; coverage 80.31%, unchanged. Signed-off-by: Ayla Croft <aylacroft@proton.me>
…makes The postgres leg failed while gate and fips passed. Two of the new tests read sbom.cdx.json, which is gitignored and generated by mix trinity.sbom as a row of the mix gate alias. The postgres leg runs mix test directly, so the bill does not exist there and both tests failed on a missing file rather than on anything they were written to check. Locally everything passed, because an earlier mix gate had left the bill in the working tree. The tests were not wrong about licences; they were wrong about what a test may assume exists, and only a leg that runs the suite on its own could show it. The task now takes --bom <path>, so the planted-dependency test hands it a file in the temporary directory. That also removes a test that wrote over the real bill in the repository root, which works right up until two tests run at once. The completeness test reads THIRD_PARTY_LICENSES.md, the committed artifact, which is what the criterion is about. A test that reads the generated bill passes or fails depending on which leg runs it. Verified as it should have been the first time: with sbom.cdx.json moved out of the tree, mix test gives 730 passed, which reproduces the postgres leg's condition. mix gate is 730 passed with the bill present. Signed-off-by: Ayla Croft <aylacroft@proton.me>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
reuse lintexits 0 against REUSE Specification 3.3 over all 613 files. It did not before: noLICENSES/directory at all, 28 files carrying nothing, and two files carrying expressions the tool could not parse.The part a linter cannot check is the part that mattered
Twenty-six of the uncovered files were
src-tauri/icons/*. The obvious fix, sweeping every uncovered file under this project's copyright, would have passed the linter.It would also have been false.
git log --diff-filter=Anames the commit that added them: "feat(s001): mix ex_tauri.install — the generator's output, nothing else". They are Tauri's template icons. Attributing them to Sudo Apt Holdings would have put a false copyright notice into the files whose entire purpose is to state copyright accurately, in the slice whose entire purpose is to make that statement checkable. They are attributed to the Tauri Programme within The Commons Conservancy underMIT OR Apache-2.0, andNOTICEsays so.Two dependencies had no licence in the bill, and the bill did not say so
THIRD_PARTY_LICENSES.mdis generated fromsbom.cdx.json, so the list and the bill cannot disagree. Building it found 2 of 132 components with nolicenseskey at all:daisyuiandheroicons, bothgithub:dependencies.A Hex package carries its licences in its metadata; a git dependency carries nothing, and the
sbomlibrary emits such a component silently rather than with an error. The bill was not wrong, it was quiet, and nothing downstream could distinguish "MIT" from "nobody checked".Both licences were read at the pinned commit, not at a branch, because a licence read from
mainis a statement about today rather than about the bytes this project builds against. A test asserts every declared entry's evidence URL contains a 40-character SHA. A component with a licence from neither source now fails the build, with no default: a licence nobody looked up is not a licence.AC4 as written was unachievable, and the reason is what the certificate means
git log --allfound 7 commits with no sign-off. All 7 are merge commits; 6 were made by GitHub itself on merging a PR. A sign-off certifies the right to submit the work; a forge's merge commit introduces none, has two already-signed parents, and is authored by whoever pressed the button.--no-mergesis a correction, not a weakening, and the test fails rather than passes on a shallow checkout.AC3 is recorded as unmet
It asks for the owner's word on the slice 024 signed field set, which 024 proposed for review and nothing since has cleared. Retagged
[manual]with the question in the verification queue. Reporting it as met would be the exact failure this slice exists to prevent.Where the checks run
reuse lintis a workflow step, not amix gaterow: it is a Python tool and the alias must stay runnable inside the FIPS container and on a machine with no Python environment this project controls.mix trinity.reusestays in the alias as the subset every leg can run, and the division is written into the step so it is not tidied away later.🤖 Generated with Claude Code