Google Git
Sign in
android / platform / external / bazelbuild-rules_license / refs/heads/main
commit48d5273aeec5d79939b6db8ed317d870fd967189[log] [tgz]
authorHONG Yifan <elsk@google.com>Wed Dec 11 20:52:53 2024 -0800
committerAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>Wed Dec 11 20:52:53 2024 -0800
tree4dfe96fb10214f0e2a61cece7f54b4730b861cc8
parentf578df4fd057ffe2023728444759535685631548 [diff]
parentc1b439a569064be8b22efde6e134cf38952cc029 [diff]
Upgrade rules_license to 1.0.0 am: c1b439a569

Original change: https://android-review.googlesource.com/c/platform/external/bazelbuild-rules_license/+/3405159

Change-Id: Idc9f3bac8f8ede821091bb03b6cfbcdb2ddeb269
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
tree: 4dfe96fb10214f0e2a61cece7f54b4730b861cc8
  1. .bazelci/
  2. .github/
  3. admin/
  4. distro/
  5. doc_build/
  6. docs/
  7. examples/
  8. licenses/
  9. rules/
  10. rules_gathering/
  11. sample_reports/
  12. tests/
  13. tools/
  14. .gitignore
  15. BUILD
  16. CODEOWNERS
  17. deps.bzl
  18. LICENSE
  19. METADATA
  20. MODULE.bazel
  21. README.md
  22. version.bzl
  23. WORKSPACE
  24. WORKSPACE.bzlmod
README.md

rules_license

CI: Build status

This repository contains a set of rules and tools for

  • declaring metadata about packages, such as
    • the licenses the package is available under
    • the canonical package name and version
    • copyright information
    • ... and more TBD in the future
  • gathering license declarations into artifacts to ship with code
  • applying organization specific compliance constriants against the set of packages used by a target.
  • producing SBOMs for built artifacts.

WARNING: The code here is still in active initial development and will churn a lot.

Contact

If you want to follow along:

Roadmap

Last update: October 22, 2023

Q4 2023

  • Reference implementation for “packages used” tool
    • produce JSON output usable for SBOM generation or other compliance reporting.
  • Reference implementation for an SPDX SBOMM generator
    • Support for reading bzlmod lock file
    • Support for reading maven lock file
  • “How To” guides
    • produce a license audit
    • produce an SBOM

Q1 2024

  • Add support for other package manager lock file formats
    • ? Python
    • Golang
    • NodeJS
  • More SPDX SBOM fields
    • support for including vendor SBOMs

Beyond

  • Performance improvements

  • Sub-SBOMs for tools

  • TBD

Background reading:

These is for learning about the problem space, and our approach to solutions. Concrete specifications will always appear in checked in code rather than documents.