chore: Add license and audit checks

.github/workflows/audit.yml

@@ -0,0 +1,36 @@
+name: Audit
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+  schedule:
+    # * is a special character in YAML so you have to quote this string
+    - cron: "0 14 * * *"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  # When getting Rust dependencies, retry on network error:
+  CARGO_NET_RETRY: 10
+  # Use the local .curlrc
+  CURL_HOME: .
+  # Disable DFX telemetry
+  DFX_TELEMETRY: 'off'
+  # Use the stable toolchain for the audit
+  RUSTUP_TOOLCHAIN: stable
+
+jobs:
+  test:
+    name: audit:required
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions-rust-lang/audit@v1

.github/workflows/deny.yml

@@ -0,0 +1,30 @@
+name: License Check
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  # When getting Rust dependencies, retry on network error:
+  CARGO_NET_RETRY: 10
+  # Use the local .curlrc
+  CURL_HOME: .
+  # Disable DFX telemetry
+  DFX_TELEMETRY: 'off'
+
+jobs:
+  cargo-deny:
+    name: license-check:required
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: rm rust-toolchain.toml
+      - uses: EmbarkStudios/cargo-deny-action@v2
+        with:
+          command: check bans licenses sources # skip advisories, which are handled by audit.yml

Cargo.toml

@@ -5,6 +5,13 @@ default-members = ["crates/icp-cli"]
 exclude = ["examples/icp-rust", "examples/icp-rust-recipe"]
 resolver = "3"
 
+[workspace.package]
+authors = ["DFINITY Stiftung <sdk@dfinity.org>"]
+edition = "2024"
+repository = "https://github.com/dfinity/icp-cli"
+rust-version = "1.88.0"
+license = "Apache-2.0"
+
 [workspace.dependencies]
 anyhow = "1.0.100"
 async-trait = "0.1.88"

LICENSE

@@ -1,3 +1,4 @@
+
                                  Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/

crates/icp-canister-interfaces/Cargo.toml

@@ -1,7 +1,9 @@
 [package]
 name = "icp-canister-interfaces"
 version = "0.1.0"
-edition = "2024"
+edition = { workspace = true }
+license = { workspace = true }
+
 
 [dependencies]
 bigdecimal = { workspace = true }

crates/icp-canister-interfaces/src/cycles_ledger.rs

@@ -80,7 +80,7 @@ impl CreateCanisterError {
                 message,
                 error_code,
             } => {
-                format!("Cycles ledger error (code {}): {}", error_code, message)
+                format!("Cycles ledger error (code {error_code}): {message}")
             }
             CreateCanisterError::TemporarilyUnavailable => {
                 "Cycles ledger temporarily unavailable. Please retry in a moment.".to_string()
@@ -105,12 +105,12 @@ impl CreateCanisterError {
                 refund_block,
                 fee_block,
             } => {
-                let mut msg = format!("Failed to create canister: {}", error);
+                let mut msg = format!("Failed to create canister: {error}");
                 if let Some(b) = refund_block {
-                    msg.push_str(&format!(". Refund block: {}", b));
+                    msg.push_str(&format!(". Refund block: {b}"));
                 }
                 if let Some(b) = fee_block {
-                    msg.push_str(&format!(". Fee block: {}", b));
+                    msg.push_str(&format!(". Fee block: {b}"));
                 }
                 msg
             }
@@ -185,7 +185,7 @@ impl WithdrawError {
                 message,
                 error_code,
             } => {
-                format!("Cycles ledger error (code {}): {}", error_code, message)
+                format!("Cycles ledger error (code {error_code}): {message}")
             }
             WithdrawError::TemporarilyUnavailable => {
                 "Cycles ledger temporarily unavailable. Please retry in a moment.".to_string()
@@ -196,8 +196,7 @@ impl WithdrawError {
                 fee_block: _,
             } => {
                 format!(
-                    "Failed to withdraw cycles: {} (rejection code: {:?})",
-                    rejection_reason, rejection_code
+                    "Failed to withdraw cycles: {rejection_reason} (rejection code: {rejection_code:?})"
                 )
             }
             WithdrawError::Duplicate { duplicate_of } => {

crates/icp-cli/Cargo.toml

@@ -1,8 +1,9 @@
 [package]
 name = "icp-cli"
 version = "0.1.0"
-edition = "2024"
 publish = false
+edition.workspace = true
+license.workspace = true
 
 [[bin]]
 name = "icp"
@@ -36,10 +37,10 @@ itertools.workspace = true
 k256.workspace = true
 lazy_static.workspace = true
 pem.workspace = true
-phf = { workspace = true }
+phf.workspace = true
 pkcs8.workspace = true
 rand.workspace = true
-reqwest = { workspace = true }
+reqwest.workspace = true
 sec1.workspace = true
 serde_json.workspace = true
 serde.workspace = true

crates/icp-cli/build.rs

@@ -11,27 +11,29 @@ fn get_git_version() -> Result<String, std::io::Error> {
         .spawn()?
         .wait_with_output()?
         .stdout;
+
     for tag in String::from_utf8_lossy(&tags).split_whitespace() {
         let output = Command::new("git")
             .arg("rev-list")
             .arg("--count")
-            .arg(format!("{}..HEAD", tag))
+            .arg(format!("{tag}..HEAD"))
             .arg(tag)
             .stdout(Stdio::piped())
             .spawn()?
             .wait_with_output()?
             .stdout;
+
         if let Some(count) = String::from_utf8_lossy(&output)
             .split_whitespace()
             .next()
             .and_then(|v| v.parse::<u128>().ok())
+            && count < latest_distance
         {
-            if count < latest_distance {
-                latest_tag = String::from(tag);
-                latest_distance = count;
-            }
+            latest_tag = String::from(tag);
+            latest_distance = count;
         }
     }
+
     let head_commit_sha = Command::new("git")
         .arg("rev-parse")
         .arg("--short")
@@ -60,11 +62,11 @@ fn define_icp_cli_version() {
     if let Ok(v) = std::env::var("ICP_CLI_VERSION") {
         // If the version is passed in the environment, use that.
         // Used by the release process in .github/workflows/publish.yml
-        println!("cargo:rustc-env=CARGO_PKG_VERSION={}", v);
+        println!("cargo:rustc-env=CARGO_PKG_VERSION={v}");
     } else if let Ok(git) = get_git_version() {
         // If the version isn't passed in the environment, use the git describe version.
         // Used when building from source.
-        println!("cargo:rustc-env=CARGO_PKG_VERSION={}", git);
+        println!("cargo:rustc-env=CARGO_PKG_VERSION={git}");
     } else {
         // Nothing to do here, as there is no GIT. We keep the CARGO_PKG_VERSION.
     }

crates/icp-cli/src/commands/canister/binding_env_vars.rs

@@ -175,7 +175,7 @@ pub async fn exec(ctx: &Context, cmd: Cmd) -> Result<(), CommandError> {
     debug!("Found canisters: {:?}", canister_list);
     let binding_vars = canister_list
         .iter()
-        .map(|(n, p)| (format!("PUBLIC_CANISTER_ID:{}", n), p.to_text()))
+        .map(|(n, p)| (format!("PUBLIC_CANISTER_ID:{n}"), p.to_text()))
         .collect::<Vec<(_, _)>>();
 
     for (_, (_, c)) in cs {

crates/icp-cli/src/commands/canister/info.rs

@@ -117,8 +117,8 @@ pub fn print_info(result: &CanisterStatusResult) {
 
     match &result.module_hash {
         Some(hash) => {
-            let hex_string: String = hash.iter().map(|b| format!("{:02x}", b)).collect();
-            eprintln!("Module hash: 0x{}", hex_string);
+            let hex_string: String = hash.iter().map(|b| format!("{b:02x}")).collect();
+            eprintln!("Module hash: 0x{hex_string}");
         }
         None => eprintln!("Module hash: <none>"),
     }

crates/icp-cli/src/commands/canister/settings/show.rs

@@ -134,7 +134,7 @@ pub fn print_settings(result: &CanisterStatusResult) {
             }
         }
     };
-    eprintln!("  Log visibility: {}", log_visibility);
+    eprintln!("  Log visibility: {log_visibility}");
 
     // Display environment variables configured for this canister
     // Environment variables are key-value pairs that can be accessed within the canister

crates/icp-cli/src/commands/canister/settings/update.rs

@@ -252,20 +252,20 @@ pub async fn exec(ctx: &Context, cmd: Cmd) -> Result<(), CommandError> {
 }
 
 fn compute_allocation_parser(compute_allocation: &str) -> Result<u8, String> {
-    if let Ok(num) = compute_allocation.parse::<u8>() {
-        if num <= 100 {
-            return Ok(num);
-        }
+    if let Ok(num) = compute_allocation.parse::<u8>()
+        && num <= 100
+    {
+        return Ok(num);
     }
     Err("Must be a percent between 0 and 100".to_string())
 }
 
 fn memory_parser(memory_allocation: &str) -> Result<Byte, String> {
     let limit = Byte::from_u64_with_unit(256, Unit::TiB).expect("256 TiB is a valid byte unit");
-    if let Ok(byte) = memory_allocation.parse::<Byte>() {
-        if byte <= limit {
-            return Ok(byte);
-        }
+    if let Ok(byte) = memory_allocation.parse::<Byte>()
+        && byte <= limit
+    {
+        return Ok(byte);
     }
     Err("Must be a value between 0..256 TiB inclusive, (e.g. '2GiB')".to_string())
 }
@@ -306,22 +306,22 @@ fn environment_variable_parser(env_var: &str) -> Result<EnvironmentVariable, Com
 }
 
 fn require_current_settings(cmd: &Cmd) -> bool {
-    if let Some(controllers) = &cmd.controllers {
-        if controllers.require_current_settings() {
-            return true;
-        }
+    if let Some(controllers) = &cmd.controllers
+        && controllers.require_current_settings()
+    {
+        return true;
     }
 
-    if let Some(log_visibility) = &cmd.log_visibility {
-        if log_visibility.require_current_settings() {
-            return true;
-        }
+    if let Some(log_visibility) = &cmd.log_visibility
+        && log_visibility.require_current_settings()
+    {
+        return true;
     }
 
-    if let Some(environment_variables) = &cmd.environment_variables {
-        if environment_variables.require_current_settings() {
-            return true;
-        }
+    if let Some(environment_variables) = &cmd.environment_variables
+        && environment_variables.require_current_settings()
+    {
+        return true;
     }
 
     false

crates/icp-cli/src/commands/canister/status.rs

@@ -137,7 +137,7 @@ pub fn print_status(result: &CanisterStatusResult) {
             }
         }
     };
-    eprintln!("  Log visibility: {}", log_visibility);
+    eprintln!("  Log visibility: {log_visibility}");
 
     // Display environment variables configured for this canister
     // Environment variables are key-value pairs that can be accessed within the canister
@@ -152,8 +152,8 @@ pub fn print_status(result: &CanisterStatusResult) {
 
     match &result.module_hash {
         Some(hash) => {
-            let hex_string: String = hash.iter().map(|b| format!("{:02x}", b)).collect();
-            eprintln!("  Module hash: 0x{}", hex_string);
+            let hex_string: String = hash.iter().map(|b| format!("{b:02x}")).collect();
+            eprintln!("  Module hash: 0x{hex_string}");
         }
         None => eprintln!("  Module hash: <none>"),
     }

crates/icp-cli/src/commands/deploy/mod.rs

@@ -150,10 +150,10 @@ pub async fn exec(ctx: &Context, cmd: Cmd) -> Result<(), CommandError> {
     )
     .await;
 
-    if let Err(err) = out {
-        if !matches!(err, create::CommandError::NoCanisters) {
-            return Err(err.into());
-        }
+    if let Err(err) = out
+        && !matches!(err, create::CommandError::NoCanisters)
+    {
+        return Err(err.into());
     }
 
     let _ = ctx.term.write_line("\n\nSetting environment variables:");
@@ -167,10 +167,10 @@ pub async fn exec(ctx: &Context, cmd: Cmd) -> Result<(), CommandError> {
     )
     .await;
 
-    if let Err(err) = out {
-        if !matches!(err, binding_env_vars::CommandError::NoCanisters) {
-            return Err(err.into());
-        }
+    if let Err(err) = out
+        && !matches!(err, binding_env_vars::CommandError::NoCanisters)
+    {
+        return Err(err.into());
     }
 
     // Install the selected canisters
@@ -186,10 +186,10 @@ pub async fn exec(ctx: &Context, cmd: Cmd) -> Result<(), CommandError> {
     )
     .await;
 
-    if let Err(err) = out {
-        if !matches!(err, install::CommandError::NoCanisters) {
-            return Err(err.into());
-        }
+    if let Err(err) = out
+        && !matches!(err, install::CommandError::NoCanisters)
+    {
+        return Err(err.into());
     }
 
     // Sync the selected canisters
@@ -204,10 +204,10 @@ pub async fn exec(ctx: &Context, cmd: Cmd) -> Result<(), CommandError> {
     )
     .await;
 
-    if let Err(err) = out {
-        if !matches!(err, sync::CommandError::NoCanisters) {
-            return Err(err.into());
-        }
+    if let Err(err) = out
+        && !matches!(err, sync::CommandError::NoCanisters)
+    {
+        return Err(err.into());
     }
 
     Ok(())

crates/icp-cli/src/commands/identity/list.rs

@@ -38,7 +38,7 @@ pub fn exec(ctx: &Context, _cmd: ListCmd) -> Result<(), ListKeysError> {
 
     for (name, id) in sorted_identities.iter() {
         let principal = id.principal();
-        let padded_name = format!("{: <1$}", name, longest_identity_name_length);
+        let padded_name = format!("{name: <longest_identity_name_length$}");
         if **name == defaults.default {
             println!("* {padded_name} {principal}");
         } else {