Skip to content

Commit 5174929

Browse files
thiemanthieman
authored
Merge pull request #3 from DataDog/thieman/open-source-compliance
Prepare repository for Datadog open source review
2 parents 955b52e + 6c413b4 commit 5174929

37 files changed

Lines changed: 1719 additions & 21 deletions

‎.github/CODEOWNERS‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# Agent Data Plane has default ownership over everything.
2+
* @DataDog/agent-data-plane

‎.github/ISSUE_TEMPLATE/bug-report.yaml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
# Unless explicitly stated otherwise all files in this repository are licensed under the MIT License.
2+
#
3+
# This product includes software developed at Datadog (https://www.datadoghq.com/)
4+
# Copyright 2026 Datadog, Inc.
5+
6+
name: Bug report
7+
description: Report a reproducible problem in rustls-cng-crypto
8+
title: "[BUG] "
9+
labels: [bug]
10+
body:
11+
- type: markdown
12+
attributes:
13+
value: |
14+
Thanks for reporting a problem. Please do not include secrets, private keys, or sensitive certificate material.
15+
- type: textarea
16+
id: description
17+
attributes:
18+
label: What happened?
19+
description: Describe the problem and the behavior you expected.
20+
validations:
21+
required: true
22+
- type: textarea
23+
id: reproduce
24+
attributes:
25+
label: Reproduction steps
26+
description: Provide the smallest example or command sequence that reproduces the issue.
27+
validations:
28+
required: true
29+
- type: input
30+
id: version
31+
attributes:
32+
label: rustls-cng-crypto version
33+
placeholder: "0.1.2"
34+
validations:
35+
required: true
36+
- type: input
37+
id: windows
38+
attributes:
39+
label: Windows version
40+
placeholder: "Windows Server 2022, Windows 11 24H2, etc."
41+
validations:
42+
required: true
43+
- type: textarea
44+
id: additional
45+
attributes:
46+
label: Additional context
47+
description: Add logs, error messages, or links to a minimal reproduction if available.
48+
validations:
49+
required: false

‎.github/ISSUE_TEMPLATE/config.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
# Unless explicitly stated otherwise all files in this repository are licensed under the MIT License.
2+
#
3+
# This product includes software developed at Datadog (https://www.datadoghq.com/)
4+
# Copyright 2026 Datadog, Inc.
5+
6+
blank_issues_enabled: true
7+
contact_links:
8+
- name: Security vulnerability report
9+
url: https://www.datadoghq.com/security/
10+
about: Please report security vulnerabilities privately through Datadog's security channel.

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
<!--
2+
Unless explicitly stated otherwise all files in this repository are licensed under the MIT License.
3+
4+
This product includes software developed at Datadog (https://www.datadoghq.com/)
5+
Copyright 2026 Datadog, Inc.
6+
-->
7+
8+
## Summary
9+
10+
Describe the change and why it is needed.
11+
12+
## Testing
13+
14+
List the commands you ran and their results.
15+
16+
- [ ] `cargo fmt -- --check`
17+
- [ ] `make check-licenses`
18+
- [ ] `cargo test` or GitHub Actions Windows CI
19+
20+
## License inventory
21+
22+
- [ ] Dependency changes are reflected in `Cargo.lock` and `LICENSE-3rdparty.csv`, or this PR does not change dependencies.
23+
24+
## Checklist
25+
26+
- [ ] Documentation is updated for user-visible changes.
27+
- [ ] Security-sensitive behavior is described clearly for reviewers.

‎.github/chainguard/self.renovate-sync-licenses.sts.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# Unless explicitly stated otherwise all files in this repository are licensed under the MIT License.
2+
#
3+
# This product includes software developed at Datadog (https://www.datadoghq.com/)
4+
# Copyright 2026 Datadog, Inc.
5+
6+
# Docs: https://datadoghq.atlassian.net/wiki/spaces/SECENG/pages/5138645099/User+guide+dd-octo-sts
7+
issuer: https://token.actions.githubusercontent.com
8+
9+
subject: repo:DataDog/rustls-cng-crypto:pull_request
10+
11+
claim_pattern:
12+
event_name: pull_request
13+
head_ref: renovate/.*
14+
job_workflow_ref: DataDog/rustls-cng-crypto/\.github/workflows/renovate-sync-licenses\.yml@refs/pull/[0-9]+/merge
15+
16+
permissions:
17+
contents: write

‎.github/dependabot.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
1+
# Unless explicitly stated otherwise all files in this repository are licensed under the MIT License.
2+
#
3+
# This product includes software developed at Datadog (https://www.datadoghq.com/)
4+
# Copyright 2026 Datadog, Inc.
5+
16
version: 2
27
updates:
38
- package-ecosystem: "cargo"

‎.github/workflows/ci.yml‎

Lines changed: 35 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,73 +1,93 @@
1+
# Unless explicitly stated otherwise all files in this repository are licensed under the MIT License.
2+
#
3+
# This product includes software developed at Datadog (https://www.datadoghq.com/)
4+
# Copyright 2026 Datadog, Inc.
15

26
name: CI
37
on:
48
push:
59
branches: [main]
610
pull_request:
11+
workflow_dispatch:
712
permissions:
813
contents: read
914

1015
env:
1116
CARGO_TERM_COLOR: always
1217

1318
jobs:
19+
license:
20+
name: License Inventory
21+
runs-on: ubuntu-latest
22+
steps:
23+
- name: Check out repository
24+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
25+
- name: Install toolchain
26+
uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
27+
with:
28+
toolchain: stable
29+
- name: Cache build artifacts
30+
uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2
31+
- name: Check third-party license inventory
32+
run: make check-licenses
33+
1434
test:
1535
name: Test
16-
runs-on: windows-latest
36+
runs-on: windows-2022
1737
steps:
1838
- name: Check out repository
19-
uses: actions/checkout@v4
39+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
2040
- name: Install toolchain
21-
uses: dtolnay/rust-toolchain@v1
41+
uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
2242
with:
2343
toolchain: stable
2444
- name: Cache build artifacts
25-
uses: Swatinem/rust-cache@v2
45+
uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2
2646
- name: cargo test
2747
run: cargo test
2848
# https://github.com/rust-lang/cargo/issues/6669
2949
- name: cargo test --doc
3050
run: cargo test --doc
51+
3152
lint:
3253
name: Lint
33-
runs-on: windows-latest
54+
runs-on: windows-2022
3455
steps:
3556
- name: Check out repository
36-
uses: actions/checkout@v4
57+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
3758
- name: Install toolchain
38-
uses: dtolnay/rust-toolchain@v1
59+
uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
3960
with:
4061
toolchain: stable
4162
components: rustfmt, clippy
4263
- name: Cache build artifacts
43-
uses: Swatinem/rust-cache@v2
64+
uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2
4465
- name: cargo fmt (check)
4566
run: cargo fmt -- --check -l
4667
- name: cargo clippy (warnings)
4768
run: cargo clippy --all-targets -- -D warnings
4869
- name: cargo clippy --no-default-features (warnings)
4970
run: cargo clippy --no-default-features --all-targets -- -D warnings
5071

51-
5272
coverage:
5373
name: Coverage
54-
runs-on: windows-latest
74+
runs-on: windows-2022
5575
steps:
5676
- name: Check out repository
57-
uses: actions/checkout@v4
77+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
5878
- name: Install toolchain
59-
uses: dtolnay/rust-toolchain@v1
79+
uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
6080
with:
6181
toolchain: stable
6282
components: llvm-tools
6383
- name: Cache build artifacts
64-
uses: Swatinem/rust-cache@v2
84+
uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2
6585
- name: Install cargo-llvm-cov
66-
uses: taiki-e/install-action@cargo-llvm-cov
86+
uses: taiki-e/install-action@50570a4fd0cb7e583e6a512c02bffb9ade28d868 # cargo-llvm-cov
6787
- name: Generate coverage
6888
run: cargo llvm-cov --lcov --output-path lcov.info
6989
- name: Report to codecov.io
70-
uses: codecov/codecov-action@v5
90+
uses: codecov/codecov-action@04b047e8bb82a0c002c8312c1c880fbc6a999d45 # v5
7191
with:
7292
files: lcov.info
7393
token: ${{ secrets.CODECOV_TOKEN }}

‎.github/workflows/renovate-sync-licenses.yml‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
# Unless explicitly stated otherwise all files in this repository are licensed under the MIT License.
2+
#
3+
# This product includes software developed at Datadog (https://www.datadoghq.com/)
4+
# Copyright 2026 Datadog, Inc.
5+
6+
# rustls-cng-crypto maintains a LICENSE-3rdparty.csv file listing every third-party dependency and its license.
7+
# The license CI check verifies that this file is in sync with Cargo.lock. Renovate updates Cargo.lock
8+
# when it bumps dependency versions, but it has no way to regenerate the license file because that
9+
# requires running dd-rust-license-tool.
10+
#
11+
# This workflow detects Renovate PRs, regenerates LICENSE-3rdparty.csv, and pushes a signed commit
12+
# back to the PR branch so license checks pass without human intervention. Human reviewers still see
13+
# and review the license file changes.
14+
15+
name: "Renovate: Sync Third-Party Licenses"
16+
17+
on:
18+
pull_request:
19+
types: [opened, synchronize]
20+
21+
jobs:
22+
sync-licenses:
23+
runs-on: ubuntu-latest
24+
25+
if: >
26+
github.actor == 'renovate[bot]' &&
27+
startsWith(github.head_ref, 'renovate/')
28+
29+
timeout-minutes: 15
30+
31+
permissions:
32+
id-token: write
33+
34+
steps:
35+
- name: Get access token from dd-octo-sts
36+
uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
37+
id: octo-sts
38+
with:
39+
scope: DataDog/rustls-cng-crypto
40+
policy: self.renovate-sync-licenses
41+
42+
- name: Checkout PR branch
43+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
44+
with:
45+
ref: ${{ github.head_ref }}
46+
token: "${{ steps.octo-sts.outputs.token }}"
47+
48+
- name: Set up Rust toolchain
49+
uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16
50+
with:
51+
cache: false
52+
rustflags: ""
53+
54+
- name: Install dd-rust-license-tool
55+
run: |
56+
TOOL_VERSION=$(grep 'CARGO_TOOL_VERSION_dd-rust-license-tool' Makefile | head -1 | sed 's/.*?= //')
57+
cargo install "dd-rust-license-tool@${TOOL_VERSION}"
58+
59+
- name: Sync third-party license file
60+
run: $HOME/.cargo/bin/dd-rust-license-tool write
61+
62+
- name: Check for changes
63+
id: changes
64+
run: |
65+
if git diff --quiet LICENSE-3rdparty.csv; then
66+
echo "changed=false" >> $GITHUB_OUTPUT
67+
else
68+
echo "changed=true" >> $GITHUB_OUTPUT
69+
fi
70+
71+
- name: Configure Git
72+
if: steps.changes.outputs.changed == 'true'
73+
run: |
74+
git config user.name "github-actions[bot]"
75+
git config user.email "github-actions[bot]@users.noreply.github.com"
76+
77+
- name: Commit changes
78+
id: commit
79+
if: steps.changes.outputs.changed == 'true'
80+
run: |
81+
git add LICENSE-3rdparty.csv
82+
git commit -m "chore(deps): sync third-party license file"
83+
echo "commit_sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
84+
85+
- name: Sign and push commit
86+
if: steps.changes.outputs.changed == 'true'
87+
uses: DataDog/commit-headless@5a0f3876e0fbdd3a86b3e008acf4ec562db59eee # v2.0.1
88+
with:
89+
token: "${{ steps.octo-sts.outputs.token }}"
90+
branch: ${{ github.head_ref }}
91+
head-sha: ${{ github.event.pull_request.head.sha }}
92+
command: push
93+
commits: "${{ steps.commit.outputs.commit_sha }}"

‎.gitignore‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
# Unless explicitly stated otherwise all files in this repository are licensed under the MIT License.
2+
#
3+
# This product includes software developed at Datadog (https://www.datadoghq.com/)
4+
# Copyright 2026 Datadog, Inc.
5+
16
target/
2-
Cargo.lock
37
lcov.info

‎CONTRIBUTING.md‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
<!--
2+
Unless explicitly stated otherwise all files in this repository are licensed under the MIT License.
3+
4+
This product includes software developed at Datadog (https://www.datadoghq.com/)
5+
Copyright 2026 Datadog, Inc.
6+
-->
7+
8+
# Contributing to rustls-cng-crypto
9+
10+
Thanks for your interest in contributing to `rustls-cng-crypto`.
11+
12+
## Development setup
13+
14+
This crate implements a rustls crypto provider backed by Windows CNG. Full test coverage requires a Windows host because the implementation calls Windows cryptography APIs.
15+
16+
Install a stable Rust toolchain, then run:
17+
18+
```bash
19+
cargo fmt -- --check
20+
cargo test
21+
```
22+
23+
On non-Windows hosts, use formatting and metadata checks locally, then rely on GitHub Actions for Windows validation.
24+
25+
## License inventory
26+
27+
This repository tracks third-party Rust dependencies in `LICENSE-3rdparty.csv`. The file is generated from `Cargo.lock` with Datadog's Rust license inventory tool.
28+
29+
After changing dependencies, run:
30+
31+
```bash
32+
make sync-licenses
33+
make check-licenses
34+
```
35+
36+
Commit `Cargo.lock`, `LICENSE-3rdparty.csv`, and any required `license-tool.toml` override changes together. Do not hand-edit generated `LICENSE-3rdparty.csv` rows.
37+
38+
## Pull requests
39+
40+
Before opening a pull request:
41+
42+
1. Run `cargo fmt -- --check`.
43+
2. Run `make check-licenses`.
44+
3. Run `cargo test` on Windows or confirm that GitHub Actions will provide Windows test coverage.
45+
4. Update documentation for user-visible changes.
46+
47+
## License
48+
49+
Unless explicitly stated otherwise, contributions are licensed under the MIT License. See `LICENSE` for the repository license and `LICENSE-3rdparty.csv` for third-party dependency notices.

0 commit comments

Comments
 (0)