https://github.com/bazelbuild/rules_license

https://github.com/bazelbuild/rules_license

Last synced: over 1 year ago
JSON representation

• Host: GitHub
• URL: https://github.com/bazelbuild/rules_license
• Owner: bazelbuild
• License: apache-2.0
• Created: 2020-04-16T20:13:55.000Z (about 6 years ago)
• Default Branch: main
• Last Pushed: 2024-11-07T14:02:37.000Z (over 1 year ago)
• Last Synced: 2025-01-12T01:56:17.030Z (over 1 year ago)
• Language: Starlark
• Size: 278 KB
• Stars: 82
• Watchers: 15
• Forks: 31
• Open Issues: 58
• Metadata Files:
  • Readme: README.md
  • Contributing: docs/CONTRIBUTING.md
  • License: LICENSE
  • Code of conduct: docs/CODE_OF_CONDUCT.md
  • Codeowners: CODEOWNERS

Awesome Lists containing this project

README

          
# rules_license

CI: [![Build status](https://badge.buildkite.com/e12f23186aa579f1e20fcb612a22cd799239c3134bc38e1aff.svg)](https://buildkite.com/bazel/rules-license)

This repository contains a set of rules and tools for

- declaring metadata about packages, such as

  - the licenses the package is available under

  - the canonical package name and version

  - copyright information

  - ... and more TBD in the future

- gathering license declarations into artifacts to ship with code

- applying organization specific compliance constriants against the

  set of packages used by a target.

- producing SBOMs for built artifacts.

WARNING: The code here is still in active initial development and will churn a lot.

## Contact

If you want to follow along:

- Mailing list: [bazel-ssc@bazel.build](https://groups.google.com/a/bazel.build/g/bazel-ssc)  

- Monthly eng meeting: [calendar link](MjAyMjA4MjJUMTYwMDAwWiBjXzUzcHBwZzFudWthZXRmb3E5NzhxaXViNmxzQGc&tmsrc=c_53pppg1nukaetfoq978qiub6ls%40group.calendar.google.com&scp=ALL)

- [Latest docs](https://bazelbuild.github.io/rules_license/latest.html)

## Roadmap

*Last update: October 22, 2023*

### Q4 2023

- Reference implementation for "packages used" tool

  - produce JSON output usable for SBOM generation or other compliance reporting.

- Reference implementation for an SPDX SBOMM generator

  - Support for reading bzlmod lock file

  - Support for reading maven lock file

- "How To" guides

  - produce a license audit

  - produce an SBOM

### Q1 2024

- Add support for other package manager lock file formats

  - ? Python

  - Golang

  - NodeJS

- More SPDX SBOM fields

  - support for including vendor SBOMs

  - 

### Beyond

- Performance improvements

- Sub-SBOMs for tools

- TBD

## Background reading:

These is for learning about the problem space, and our approach to solutions. Concrete specifications will always appear in checked in code rather than documents.

- [License Checking with Bazel](https://docs.google.com/document/d/1uwBuhAoBNrw8tmFs-NxlssI6VRolidGYdYqagLqHWt8/edit#).

- [OSS Licenses and Bazel Dependency Management](https://docs.google.com/document/d/1oY53dQ0pOPEbEvIvQ3TvHcFKClkimlF9AtN89EPiVJU/edit#)

- [Adding OSS license declarations to Bazel](https://docs.google.com/document/d/1XszGbpMYNHk_FGRxKJ9IXW10KxMPdQpF5wWbZFpA4C8/edit#heading=h.5mcn15i0e1ch)