INJIVER-1310: Security Testing (0.14.0 / 0.16.0): License Compliance Issue

[Ivanmeneges]

Fix the license compliance issues raised by Security Team in 0.14.0 and 0.16.0..

https://mosip.atlassian.net/browse/MOSIP-43066

https://mosip.atlassian.net/browse/MOSIP-43760

Attachments

• license issue in github codebase.txt (no direct link)
• non_compliant_license_packages_split (1).pdf (no direct link)

[Ivanmeneges]

Jira Assignee: Pragya (no GitHub mapping found)

[Ivanmeneges]

Sreenadh S commented: For the compliance issues reported except the package {{wget}} everything else is coming from the base image and is not added in as direct dependency in any ways. The {{wget}}depencency is not used and safe to remove from the docker file. Updated , tested and raised a PR for same.

And for the report from github, there are two libs

jszip → This is a transitive dependency from one of our modules {{PixelPass}}. But {{jszip}} is a direct dependency for {{PixelPass}}, Thus this needs to be fixed on {{PixelPass}} side.

node-forge → This is a transitive dependency

[Ivanmeneges]

Mayura Deshmukh commented: [~accountid:712020:1caf7501-caf0-450e-b281-e1ceded02e38]

Can u pls check below comments and test the fix in “develop” branch code in [https://github.com/mosip/inji-verify|https://github.com/mosip/inji-verify|smart-link]

Code is deployed in [https://injiverify.dev-int-inji.mosip.net/|https://injiverify.dev-int-inji.mosip.net/]

[Ivanmeneges]

Mahesh Binayak commented: can we fix/remove the node-forge dependency in this release? [~accountid:5fb51056cbead50069e676d8] [~accountid:70121:b14118bc-025e-4ce7-ac60-438e99c35d7e]

[Ivanmeneges]

Sreenadh S commented: [~accountid:5fc884940d2f61006fb351f4] node-forge is a transitive dependency

the dependency tree looks like this for node-forge

{{verify-ui}} --> {{react-scripts}}--> {{webpack-dev-server}} --> {{selfsigned}} --> {{node-forge}}

Cc: [~accountid:5fb51056cbead50069e676d8]

[Ivanmeneges]

Mahesh Binayak commented: As per our discussion with [~accountid:712020:3e4f76bc-7e2e-42b3-a2a5-3a906737a036] , even transitive dependecies have to be fixed.
So if there is a time contraint, then it can be fixed in subsequent releases.

[Ivanmeneges]

Mayura Deshmukh commented: [~accountid:5fc884940d2f61006fb351f4]

It is not possible to fix the below:

{{node-forge}} since it is a transitive dependency of {{react-scripts}}

{{jszip}} is a direct dependency for {{PixelPass}}, have created [https://mosip.atlassian.net/browse/INJIVER-1340|https://mosip.atlassian.net/browse/INJIVER-1340|smart-link] for the same.

We can keep this bug open for 0.15.0 release.

[Ivanmeneges]

Mahesh Binayak commented: ok [~accountid:5fb51056cbead50069e676d8]