Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Validate licenses included in artifacts #558

Draft
wants to merge 1 commit into
base: main
Choose a base branch
from
+10 −0
Draft

Validate licenses included in artifacts #558

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions artifacts.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,12 @@ import (
"io/fs"
"maps"
"path/filepath"

"github.com/pkg/errors"
)

var (
errMissingLicense = errors.New("missing required license in artifacts")
)

// Artifacts describes all the artifacts to include in the package.
Expand Down
4 changes: 4 additions & 0 deletions load.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -538,6 +538,10 @@ func (s Spec) Validate() error {
}
}

if s.Artifacts.Licenses == nil {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i think we want to check if source includes LICENSE or LICENSE.md

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From what I gathered on build-defs, I don't see where a license is included explicitly. Do you mean searching through the aforementioned source to verify the path is correct?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think we can really do this validation here.
At best we can provide a warning message back to clients, but we can't do that from here.

errs = append(errs, errMissingLicense)
}

if err := s.Image.validate(); err != nil {
errs = append(errs, errors.Wrap(err, "image"))
}
Expand Down
Loading