feat(extractor): add support for chisel manifests #764
Conversation
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
| @@ -35,6 +35,8 @@ github.com/bradleyjkemp/cupaloy/v2 v2.8.0 h1:any4BmKE+jGIaMpnU8YgH/I2LPiLBufr6oM | |||
| github.com/bradleyjkemp/cupaloy/v2 v2.8.0/go.mod h1:bm7JXdkRd4BHJk9HpwqAI8BoAY1lps46Enkdqw6aRX0= | |||
| github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM= | |||
| github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE= | |||
| github.com/canonical/chisel v1.1.1-0.20250423141040-e4a81ab3205c h1:Az25s4yK9N9NAC53yeJwk+YKLTHYoTLIrcOVXD+igh0= | |||
There was a problem hiding this comment.
the top level license for this repository is AGPL, which unfortunately we cannot use.
Is it possible to move the Apache-2.0 public components to a separate repository?
There was a problem hiding this comment.
Thanks for catching this. I'll raise this internally to confirm our action points.
There was a problem hiding this comment.
Hey Oliver, sometime ago we discussed internally whether to publish these modules in a separate repository or not. We got reassurance from the legal team that, as long as the SPDX headers are in place in the /public modules, the top level licensing for the project would not be a problem. With that said, even if there are no legal problems, I assume importing top-level GPL modules is against some internal policy. If that is the case, what other options are valid apart from separate repository?
This PR adds support to parse the chisel manifest that resides in the "chisel"ed container images.
Closes: #658