mirror of
https://github.com/home-assistant/frontend.git
synced 2026-05-18 05:59:06 +01:00
Bram Kragten
1884a06f98
* Generate third party license file during production build * Add license check CI step * Address review comments: use license-checker-rseidelsohn, add version validation for LICENSE_OVERRIDES * Fix license-checker-rseidelsohn import (CJS module, use require)
92 lines
2.7 KiB
JavaScript
Executable File
92 lines
2.7 KiB
JavaScript
Executable File
#!/usr/bin/env node
|
|
// Checks that all production dependencies use approved open-source licenses.
|
|
//
|
|
// To allow a new license type, add its SPDX identifier to ALLOWED_LICENSES.
|
|
// To allow a specific package that cannot be relicensed (e.g. a dual-license
|
|
// package where the reported identifier is non-standard), add it to
|
|
// ALLOWED_PACKAGES with a comment explaining why.
|
|
|
|
import { createRequire } from "module";
|
|
import { fileURLToPath } from "url";
|
|
import path from "path";
|
|
|
|
const require = createRequire(import.meta.url);
|
|
const checker = require("license-checker-rseidelsohn");
|
|
const root = path.resolve(fileURLToPath(import.meta.url), "../../");
|
|
|
|
// Permissive licenses that are compatible with distribution in a compiled wheel.
|
|
// Copyleft licenses (GPL, LGPL, AGPL, EUPL, etc.) must NOT be added here.
|
|
const ALLOWED_LICENSES = new Set([
|
|
"MIT",
|
|
"MIT*",
|
|
"ISC",
|
|
"BSD-2-Clause",
|
|
"BSD-3-Clause",
|
|
"BSD*",
|
|
"Apache-2.0",
|
|
"0BSD",
|
|
"CC0-1.0",
|
|
"(MIT OR CC0-1.0)",
|
|
"(MIT AND Zlib)",
|
|
"Python-2.0", // argparse - Python Software Foundation License (permissive)
|
|
"Public Domain",
|
|
"W3C-20150513", // wicg-inert - W3C Software and Document License (permissive)
|
|
"Unlicense",
|
|
"CC-BY-4.0",
|
|
]);
|
|
|
|
// Packages whose license identifier is ambiguous or non-standard but have been
|
|
// manually verified as permissive. Add only when strictly necessary.
|
|
const ALLOWED_PACKAGES = {
|
|
// No entries currently needed.
|
|
};
|
|
|
|
checker.init(
|
|
{
|
|
start: root,
|
|
production: true,
|
|
excludePrivatePackages: true,
|
|
},
|
|
(err, packages) => {
|
|
if (err) {
|
|
console.error("license-checker failed:", err);
|
|
process.exit(1);
|
|
}
|
|
|
|
const violations = [];
|
|
|
|
for (const [nameAtVersion, info] of Object.entries(packages)) {
|
|
if (nameAtVersion in ALLOWED_PACKAGES) {
|
|
continue;
|
|
}
|
|
|
|
const license = info.licenses;
|
|
|
|
if (!ALLOWED_LICENSES.has(license)) {
|
|
violations.push({ package: nameAtVersion, license });
|
|
}
|
|
}
|
|
|
|
if (violations.length > 0) {
|
|
console.error(
|
|
"The following packages have licenses that are not on the allowlist:"
|
|
);
|
|
for (const { package: pkg, license } of violations) {
|
|
console.error(` ${pkg}: ${license}`);
|
|
}
|
|
console.error(`
|
|
If the license is permissive and appropriate for distribution, add it
|
|
to ALLOWED_LICENSES in script/check-licenses. If it is a specific
|
|
package with an ambiguous identifier, add it to ALLOWED_PACKAGES.
|
|
|
|
Do NOT add copyleft licenses (GPL, LGPL, AGPL, etc.) to the allowlist.`);
|
|
process.exit(1);
|
|
}
|
|
|
|
const count = Object.keys(packages).length;
|
|
console.log(
|
|
`License check passed: all ${count} production dependencies use approved licenses.`
|
|
);
|
|
}
|
|
);
|