ci / mach: Add some form of deep license scanning

Open
#47,769 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
35/100
Issue type
Feature
Clarity
Needs clarification
Activity status
Active
Tech stack
rust
Domain
ci-cd, tooling

Research direction

Start by reviewing how CI currently uses cargo-deny and cargo-about, then investigate free tooling that scans source files rather than relying only on Cargo.toml license fields. Done means selecting a practical approach and defining how CI/mach would report licenses required by linked code, including -sys crates.

Written by the indexing model from the issue text.

Description

A-infrastructure

We currently use carg-deny and cargo-about for license compliance, but they rely on licenses specified in crate Cargo.toml being accurate.
However, relying on licenses specified in Cargo.toml is not sufficient, as -sys crates in practice often do not specify the license that the code they link with requires (machine readable in Cargo.toml license field).
To fill this gap we would need some tooling which scans source files and reports actual licenses. I'm not familiar with what tooling is available (free), investigation needed.

Dominant language
Rust
Stars
38k
Forks
3.8k
Avg merge
1d 8h
Merged PRs (30d)
459

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from servo/servo

All issues in servo/servo

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.