From 2ad67c7412e1ca4b25dcbf0073b579446790f1fb Mon Sep 17 00:00:00 2001
From: ksanrse <ksanrse@gmail.com>
Date: Tue, 1 Sep 2026 02:20:33 +0300
Subject: [PATCH] fix(package-index): drop undefined license gate

---
 README.md                        |  2 +-
 scripts/publish-catalog.mjs      |  1 -
 scripts/publish-catalog.test.mjs | 10 +---------
 3 files changed, 2 insertions(+), 11 deletions(-)

diff --git a/README.md b/README.md
index 9f62511..979ac81 100644
--- a/README.md
+++ b/README.md
@@ -51,7 +51,7 @@ The no-secret preflight checks the target release is unused and verifies the
 previous catalog's exact downloaded bytes, detached signatures, and pinned
 public key. The credentialed build step resolves each private BOM commit and
 release tag exactly before the signing key is exposed. Archives are fail-closed on unsafe ZIP paths/metadata,
-compression bombs, executable extras, missing source-package license metadata, and wrong PE
+compression bombs, executable extras, and wrong PE
 platforms.
 
 ## Pull-request checks
diff --git a/scripts/publish-catalog.mjs b/scripts/publish-catalog.mjs
index aa24f44..665e88f 100644
--- a/scripts/publish-catalog.mjs
+++ b/scripts/publish-catalog.mjs
@@ -205,7 +205,6 @@ export async function inspectArchive(spec, archivePath, zipUtils, sequence) {
   try { manifest = JSON.parse(manifestEntry.data.toString("utf8")); } catch { fail(`${spec.id}: archive manifest.json is invalid JSON`); }
   requiredManifest(manifest, spec, spec.build?.provider ?? spec.id);
   const licenseEntry = files.find((entry) => /^license(?:[._-].*)?$/i.test(path.posix.basename(entry.name)));
-  if (spec.kind !== "app" && !licenseEntry && typeof manifest.license !== "string") fail(`${spec.id}: archive license is missing`);
   const expected = ["manifest.json", spec.entrypoint, spec.icon, ...(licenseEntry ? [licenseEntry.name] : [])].sort();
   const actual = files.map((entry) => entry.name).sort();
   if (spec.kind === "app" ? (expected.some((name) => !actual.includes(name)) ||
diff --git a/scripts/publish-catalog.test.mjs b/scripts/publish-catalog.test.mjs
index c09dbc5..a2d5004 100644
--- a/scripts/publish-catalog.test.mjs
+++ b/scripts/publish-catalog.test.mjs
@@ -138,7 +138,7 @@ async function mutateCentral(file, entryName, mutate) {
   await writeFile(file, bytes);
 }
 
-test("archive policy rejects traversal, collisions, missing license, and extra files", async () => {
+test("archive policy rejects traversal, collisions, and extra files", async () => {
   const dir = await mkdtemp(path.join(tmpdir(), "kosmos-archive-"));
   try {
     const spec = archiveSpec();
@@ -159,14 +159,6 @@ test("archive policy rejects traversal, collisions, missing license, and extra f
     const extra = path.join(dir, "extra.kspkg");
     await writeArchive(extra, spec, [{ name: "payload.exe", data: peFixture() }]);
     await assert.rejects(() => inspectArchive(spec, extra, { readZip }, 8), /unexpected/);
-    const noLicense = path.join(dir, "no-license.kspkg");
-    const noLicenseSpec = { ...spec, artifact: { name: "no-license.kspkg" } };
-    writeZip(noLicense, [
-      { name: "manifest.json", data: JSON.stringify(completeManifest(noLicenseSpec)) },
-      { name: noLicenseSpec.entrypoint, data: peFixture() },
-      { name: noLicenseSpec.icon, data: Buffer.from("icon") },
-    ]);
-    await assert.rejects(() => inspectArchive(noLicenseSpec, noLicense, { readZip }, 8), /license/);
     const traversal = path.join(dir, "traversal.kspkg");
     await writeArchive(traversal, spec, [{ name: "../escape.txt", data: Buffer.from("x") }]);
     await assert.rejects(() => inspectArchive(spec, traversal, { readZip }, 8), /unsafe|unexpected/);