divviup / divviup/janus

Bundle licenses into container images

Open
#3,229 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Rust
Stars
70
Forks
16
Avg merge
4h 36m
Merged PRs (30d)
30

Description

Licenses like 3-clause BSD or Unicode v3 include a requirement that the license be included with any binary distributions of software (i.e., Janus) that uses dependencies covered by those licenses (i.e. our numerous deps that use these).

My reading of these licenses is that we do not need to worry about redistributing them with Janus sources: we don't distribute the source code of dependencies. Some entity using Janus does when they run cargo build/test/run. This applies to the crates we ship: we distribute only source code to crates.io and docs.rs, so that's fine.

However the binary artifacts we distribute should include Janus' license, as well as the licenses of dependencies.

For container images, David Cook suggested putting them in /usr/share/common-licenses or /usr/share/*/copyright. We could invent some build step that walks the dep tree, extracts licenses and blats them into container images... or a cheekier fix would be to include every license enumerated in licenses.allow in Janus' deny.toml.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing deny.toml, especially licenses.allow, and the container-image build definitions. Check which binary images are distributed and how Janus and dependency licenses are currently collected. Done means the distributed container images include Janus' license and the required dependency licenses in a documented location such as /usr/share/common-licenses.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, rust
Domain
devops, release
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.