bytedance / bytedance/bolt

[Chore] [license] implement Conan dependency license compatibility checker

Open
#64 0 comments 0 reactions 0 assignees View on GitHub
build good first issue needs triage
Dominant language
C++
Stars
177
Forks
107
Avg merge
3d 10h
Merged PRs (30d)
49

Description

### Chore Type

Dependency Update (Conan/Third-party)

### Task Description

Implement Conan dependency license compatibility checker

### Motivation / Benefit

Currently, we lack an automated way to verify if all third-party dependencies introduced via Conan comply with the [ASF License Policy](https://www.apache.org/legal/resolved.html). Manual checks are error-prone and difficult to maintain as the project grows.

### Related Files (Optional)

_No response_

### Implementation Plan (Optional)

Introduce a Python script that:
1. Executes `conan graph info` (or uses Conan API) to flatten the dependency tree.
2. Extracts license information from each package.
3. Compares licenses against a whitelist of ASF-compatible licenses (e.g., Apache 2.0, MIT, BSD).
4. Fails the build/check if any "Category X" (incompatible) licenses are detected.

### Additional Context

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by checking how Conan dependencies and build checks are configured in the repository; the issue names no existing files or tests. Use `conan graph info` or the Conan API to flatten dependencies, extract licenses, compare them with an ASF-compatible whitelist, and make the build or check fail for Category X licenses.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, python
Domain
build-system
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.