Skip to content

Commit 2bcb058

Browse files
ory-botory-bot
committed
autogen: update license overview
1 parent 2236a46 commit 2bcb058

4 files changed

Lines changed: 173 additions & 0 deletions

File tree

‎.bin/license-engine.sh‎

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
#!/bin/bash
2+
3+
# This script detects non-compliant licenses in the output of language-specific license checkers.
4+
5+
# These licenses are allowed.
6+
# These are the exact and complete license strings for 100% legal certainty, no regexes.
7+
ALLOWED_LICENSES=(
8+
'0BSD'
9+
'AFLv2.1'
10+
'AFLv2.1,BSD'
11+
'(AFL-2.1 OR BSD-3-Clause)'
12+
'Apache 2.0'
13+
'Apache-2.0'
14+
'(Apache-2.0 OR MPL-1.1)'
15+
'Apache-2.0 AND MIT'
16+
'Apache License, Version 2.0'
17+
'Apache*'
18+
'Artistic-2.0'
19+
'BlueOak-1.0.0'
20+
'BSD'
21+
'BSD*'
22+
'BSD-2-Clause'
23+
'(BSD-2-Clause OR MIT OR Apache-2.0)'
24+
'BSD-3-Clause'
25+
'(BSD-3-Clause OR GPL-2.0)'
26+
'BSD-3-Clause OR MIT'
27+
'(BSD-3-Clause AND Apache-2.0)'
28+
'CC0-1.0'
29+
'CC-BY-3.0'
30+
'CC-BY-4.0'
31+
'(CC-BY-4.0 AND MIT)'
32+
'ISC'
33+
'ISC*'
34+
'LGPL-2.1' # LGPL allows commercial use, requires only that modifications to LGPL-protected libraries are published under a GPL-compatible license
35+
'MIT'
36+
'MIT*'
37+
'MIT-0'
38+
'MIT AND ISC'
39+
'(MIT AND BSD-3-Clause)'
40+
'(MIT AND Zlib)'
41+
'(MIT OR Apache-2.0)'
42+
'(MIT OR CC0-1.0)'
43+
'(MIT OR GPL-2.0)'
44+
'MPL-2.0'
45+
'(MPL-2.0 OR Apache-2.0)'
46+
'Public Domain'
47+
'Python-2.0' # the Python-2.0 is a permissive license, see https://en.wikipedia.org/wiki/Python_License
48+
'Unlicense'
49+
'WTFPL'
50+
'WTFPL OR ISC'
51+
'(WTFPL OR MIT)'
52+
'(MIT OR WTFPL)'
53+
'LGPL-3.0-or-later' # Requires only that modifications to LGPL-protected libraries are published under a GPL-compatible license which is not the case at Ory
54+
)
55+
56+
# These modules don't work with the current license checkers
57+
# and have been manually verified to have a compatible license (regex format).
58+
APPROVED_MODULES=(
59+
'https://github.com/ory-corp/cloud/' # Ory IP
60+
'github.com/ory/hydra-client-go' # Apache-2.0
61+
'github.com/ory/hydra-client-go/v2' # Apache-2.0
62+
'github.com/ory/kratos-client-go' # Apache-2.0
63+
'github.com/gobuffalo/github_flavored_markdown' # MIT
64+
'buffers@0.1.1' # MIT: original source at http://github.com/substack/node-bufferlist is deleted but a fork at https://github.com/pkrumins/node-bufferlist/blob/master/LICENSE contains the original license by the original author (James Halliday)
65+
'@mapbox/jsonlint-lines-primitives@2.0.2' # MIT: https://github.com/tmcw/jsonlint
66+
'https://github.com/iconify/iconify/packages/react' # MIT: license is in root of monorepo at https://github.com/iconify/iconify/blob/main/license.txt
67+
'github.com/gobuffalo/.*' # MIT: license is in root of monorepo at https://github.com/gobuffalo/github_flavored_markdown/blob/main/LICENSE
68+
'github.com/ory-corp/cloud/.*' # Ory IP
69+
'github.com/golang/freetype/.*' # FreeType license: https://freetype.sourceforge.net/FTL.TXT
70+
'go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift' # Incorrect detection, actually Apache-2.0: https://github.com/open-telemetry/opentelemetry-go/blob/exporters/jaeger/v1.17.0/exporters/jaeger/internal/third_party/thrift/LICENSE
71+
'go.uber.org/zap/exp/.*' # MIT license is in root of exp folder in monorepo at https://github.com/uber-go/zap/blob/master/exp/LICENSE
72+
'github.com/ory/client-go' # Apache-2.0
73+
'github.com/ian-kent/linkio' # BSD - https://github.com/ian-kent/linkio/blob/97566b8728870dac1c9863ba5b0f237c39166879/linkio.go#L1-L3
74+
'github.com/t-k/fluent-logger-golang/fluent' # Apache-2.0 https://github.com/t-k/fluent-logger-golang/blob/master/LICENSE
75+
'github.com/jmespath/go-jmespath' # Apache-2.0 https://github.com/jmespath/go-jmespath/blob/master/LICENSE
76+
'github.com/ory/keto/proto/ory/keto/opl/v1alpha1' # Apache-2.0 - submodule of keto
77+
'github.com/ory/keto/proto/ory/keto/relation_tuples/v1alpha2' # Apache-2.0 - submodule of keto
78+
'@ory-corp/.*' # Ory IP
79+
'github.com/apache/arrow/.*' # Apache-2.0 https://github.com/apache/arrow/blob/main/LICENSE.txt
80+
'github.com/ory-corp/webhook-target' # Ory IP
81+
'@ory/keto-grpc-client.*' # Apache-2.0 - submodule of keto
82+
'golden-fleece@1.0.9' # MIT: https://github.com/Rich-Harris/golden-fleece/blob/master/LICENSE
83+
'github.com/gogo/googleapis/.*' # Apache-2.0 https://github.com/gogo/googleapis/blob/master/LICENSE
84+
)
85+
86+
# These lines in the output should be ignored (plain text, no regex).
87+
IGNORE_LINES=(
88+
'"module name","licenses"' # header of license output for Node.js
89+
)
90+
91+
echo_green() {
92+
printf "\e[1;92m%s\e[0m\n" "$@"
93+
}
94+
95+
echo_red() {
96+
printf "\e[0;91m%s\e[0m\n" "$@"
97+
}
98+
99+
# capture STDIN
100+
input=$(cat -)
101+
102+
# remove ignored lines
103+
for ignored in "${IGNORE_LINES[@]}"; do
104+
input=$(echo "$input" | grep -vF "$ignored")
105+
done
106+
107+
# remove pre-approved modules
108+
for approved in "${APPROVED_MODULES[@]}"; do
109+
input=$(echo "$input" | grep -vE "\"${approved}\"")
110+
input=$(echo "$input" | grep -vE "\"Custom: ${approved}\"")
111+
done
112+
113+
# remove allowed licenses
114+
for allowed in "${ALLOWED_LICENSES[@]}"; do
115+
input=$(echo "$input" | grep -vF "\"${allowed}\"")
116+
done
117+
118+
# anything left in the input at this point is a module with an invalid license
119+
120+
# print outcome
121+
if [ -z "$input" ]; then
122+
echo_green "Licenses are okay."
123+
else
124+
echo_red "Unknown licenses found!"
125+
echo "$input"
126+
exit 1
127+
fi

‎.bin/licenses‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#!/bin/sh
2+
set -e
3+
4+
# Get the directory where this script is located
5+
bin_dir="$(cd "$(dirname "$0")" && pwd)"
6+
7+
{ echo "Checking licenses ..."; } 2>/dev/null
8+
"${bin_dir}/list-licenses" | "${bin_dir}/license-engine.sh"

‎.bin/list-licenses‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
#!/bin/sh
2+
set -e
3+
4+
bin_dir="$(cd "$(dirname "$0")" && pwd)"
5+
6+
# list Node licenses
7+
if [ -f package.json ]; then
8+
if jq -e '.dependencies and (.dependencies | keys | length > 0)' package.json >/dev/null; then
9+
npx --yes license-checker --production --csv --excludePrivatePackages --customPath "${bin_dir}"/license-template-node.json | grep -v '^$'
10+
echo
11+
else
12+
echo "No dependencies found in package.json" >&2
13+
echo
14+
fi
15+
fi
16+
17+
# list Go licenses
18+
if [ -f go.mod ]; then
19+
# List all direct Go module dependencies, transform their paths to root module paths
20+
# (e.g., github.com/ory/x instead of github.com/ory/x/foo/bar), and generate a license report
21+
# for each unique root module. This ensures that the license report is generated for the root
22+
# module of a repository, where licenses are typically defined.
23+
go_modules=$(
24+
go list -f "{{if not .Indirect}}{{.Path}}{{end}}" -m ... |
25+
sort -u |
26+
awk -F/ '{ if ($1 == "github.com" && NF >= 3) { print $1"/"$2"/"$3 } else { print } }' |
27+
sort -u
28+
)
29+
if [ -z "$go_modules" ]; then
30+
echo "No Go modules found" >&2
31+
else
32+
# Workaround until https://github.com/google/go-licenses/issues/307 is fixed
33+
# .bin/go-licenses report "$module_name" --template .bin/license-template-go.tpl 2>/dev/null
34+
#
35+
echo "$go_modules" | xargs -I {} sh -c '.bin/go-licenses report --template .bin/license-template-go.tpl {}' | grep -v '^$'
36+
echo
37+
fi
38+
fi

‎.reports/dep-licenses.csv‎

Whitespace-only changes.

0 commit comments

Comments
 (0)