manifest/scripts/.gitignore, branch replicant-11-dev replicant-next manifest Add script to check licenses 2021-10-20T00:59:32+00:00 Denis 'GNUtoo' Carikli GNUtoo@cyberdimension.org 2021-10-18T20:58:01+00:00 f6a553a976f797d310e613e29d54b7c6570b810a As we currently have 757 repositories, we can't review all the code of all repositories. And unlike GNU/Linux distributions, we don't have package definitions with licenses. And switching to a package manager would not only require extensive work, but we would also need to be really sure that that work would also need to be maintained over time. Because of all theses constraints, and to have at least some weak assurances that we don't bring in nonfree code from the Android open source project, I wrote this script to try to semi-automatically list the repositories licenses. While it doesn't look yet into the repositories themselves, we at least found one repository (external/dng) with a potentially problematic license that we need to review in more detail. For instance it has a clause that prevents the modification of the documentation, but there is no documentation. There is also still 425 repositories with an unknown license fo far: $ ./manifest/scripts/check-licenses.py manifest/default.xml | external/dng_sdk/LICENSE | [...] Remaining: 331 done: 426 total: 757 Also note that this script doesn't expend the includes and so it won't automatically check the repositories in replicant/repositories.xml when used with default.xml. However the repositories added or forked by Replicant are less a concern as developers forking repositories will probably have more probability of finding licensing issues in a given repository than if it was handled by this script. Signed-off-by: Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org> 
As we currently have 757 repositories, we can't review all
the code of all repositories. And unlike GNU/Linux
distributions, we don't have package definitions with
licenses.

And switching to a package manager would not only require
extensive work, but we would also need to be really sure
that that work would also need to be maintained over time.

Because of all theses constraints, and to have at least
some weak assurances that we don't bring in nonfree code
from the Android open source project, I wrote this script
to try to semi-automatically list the repositories licenses.

While it doesn't look yet into the repositories themselves,
we at least found one repository (external/dng) with a
potentially problematic license that we need to review
in more detail. For instance it has a clause that prevents
the modification of the documentation, but there is no
documentation.

There is also still 425 repositories with an unknown license
fo far:
    $ ./manifest/scripts/check-licenses.py manifest/default.xml
    | external/dng_sdk/LICENSE | [...]
    Remaining: 331 done: 426 total: 757

Also note that this script doesn't expend the includes and
so it won't automatically check the repositories in
replicant/repositories.xml when used with default.xml.

However the repositories added or forked by Replicant are
less a concern as developers forking repositories will
probably have more probability of finding licensing issues
in a given repository than if it was handled by this script.

Signed-off-by: Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org>
scripts: Move Manifest in its own file 2021-10-18T20:52:14+00:00 Denis 'GNUtoo' Carikli GNUtoo@cyberdimension.org 2021-10-18T20:43:31+00:00 f3c754121a25c2fc388355e6cc3b5c96d75277e8 This enables to reuse the manifest parsing code other python scripts. Signed-off-by: Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org> 
This enables to reuse the manifest parsing code other python
scripts.

Signed-off-by: Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org>
scripts: add tests 2021-10-18T20:47:21+00:00 Denis 'GNUtoo' Carikli GNUtoo@cyberdimension.org 2021-10-18T20:35:18+00:00 f418ea3e6fa56644ee97cf6d68a2243a723641a8 tests/reference-mirror.sh was generated with the folowing commands: $ make check $ mv tests/mirror.sh tests/reference-mirror.sh Here we use cmp over checksums as it enables us to update the tests along with the souce code and/or manifest and see what changed in the generated file along the way. Signed-off-by: Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org> 
tests/reference-mirror.sh was generated with the folowing
commands:
    $ make check
    $ mv tests/mirror.sh tests/reference-mirror.sh

Here we use cmp over checksums as it enables us to update the
tests along with the souce code and/or manifest and see what
changed in the generated file along the way.

Signed-off-by: Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org>