From f2b851eaf1f5f86a2c671fd2482ba84d3e85f0ed Mon Sep 17 00:00:00 2001 From: Arthur Brownlee IV Date: Mon, 2 Nov 2026 19:34:31 -0800 Subject: [PATCH] fix: ship bundled daemon licenses and required notices --- README.md | 5 +- RELEASING.md | 13 +- backend/THIRD_PARTY_NOTICES.txt | 753 ++++++++++++++++++++++++++++++++ backend/check-licenses.sh | 83 ++++ backend/test-licenses.sh | 73 ++++ backend/verify-release.sh | 2 + 6 files changed, 925 insertions(+), 4 deletions(-) create mode 100644 backend/THIRD_PARTY_NOTICES.txt create mode 100644 backend/check-licenses.sh create mode 100644 backend/test-licenses.sh diff --git a/README.md b/README.md index 34ccffa..b7012bb 100644 --- a/README.md +++ b/README.md @@ -179,4 +179,7 @@ the dashboard also drives cadence via `backend/bin/starlinkd panel open|close`. ## License -MIT — see [LICENSE](LICENSE). +Dishy's own code is MIT-licensed — see [LICENSE](LICENSE). The bundled +`starlinkd` executable also includes third-party components under their own +terms; their licenses, copyright notices, and patent grants are included in +[`backend/THIRD_PARTY_NOTICES.txt`](backend/THIRD_PARTY_NOTICES.txt). diff --git a/RELEASING.md b/RELEASING.md index 974d8ea..31c33a8 100644 --- a/RELEASING.md +++ b/RELEASING.md @@ -21,9 +21,15 @@ Prepare the release tree on the feature branch before merge: version in go.mod when it changes). Builds no longer run `go mod tidy` or silently change dependencies. Commit deliberate dependency changes separately from running the build. -3. Run the gate below on the final release tree, pass exact-diff review, then +3. When a compiler or linked dependency changes, review its upstream license and + notices, update the reviewed inventory in `backend/check-licenses.sh`, then run + `bash backend/check-licenses.sh --write` with the exact build compiler. Commit + `backend/THIRD_PARTY_NOTICES.txt` alongside the binary, including upstream + copyright/NOTICE texts (not just dependency names). Retain these notices when + distributing the executable separately from the plugin checkout. +4. Run the gate below on the final release tree, pass exact-diff review, then commit/push and merge the PR only after its CI gate passes. -4. On `main`, run the gate again at the merged SHA, tag annotated `vX.Y.Z`, +5. On `main`, run the gate again at the merged SHA, tag annotated `vX.Y.Z`, push the tag, and publish the GitHub release with notes. The manifest, executable stamp, and tag must identify the same version. @@ -42,7 +48,8 @@ omarchy plugin validate . The script regenerates ignored protobuf stubs, verifies module checksums and tidiness, checks formatting, runs race tests/vet, compares a clean deterministic rebuild to the **committed** executable, checks its compiler/static-build metadata -and manifest stamp, and scans **both source and binary** against the live Go +and manifest stamp, verifies bundled third-party texts against a reviewed linked +component/toolchain inventory and the exact upstream files, and scans **both source and binary** against the live Go vulnerability database. Scanner errors and findings fail the gate; text mode is intentional because JSON/SARIF output does not fail on findings. An offline `GOVULNDB=file:///...` snapshot is for isolated local verification only, not a diff --git a/backend/THIRD_PARTY_NOTICES.txt b/backend/THIRD_PARTY_NOTICES.txt new file mode 100644 index 0000000..9193d7c --- /dev/null +++ b/backend/THIRD_PARTY_NOTICES.txt @@ -0,0 +1,753 @@ +Third-party notices for backend/bin/starlinkd (linux/amd64) + +Dishy's own code is MIT-licensed; see ../LICENSE. The statically linked +components below retain their upstream terms. These texts accompany the +executable in the plugin checkout; retain them when redistributing it. +Generated by check-licenses.sh from the reviewed compiler/module versions. + +===== Go go1.27.3 / LICENSE ===== + +Copyright 2009 The Go Authors. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are +met: + + * Redistributions of source code must retain the above copyright +notice, this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above +copyright notice, this list of conditions and the following disclaimer +in the documentation and/or other materials provided with the +distribution. + * Neither the name of Google LLC nor the names of its +contributors may be used to endorse or promote products derived from +this software without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + +===== Go go1.27.3 / PATENTS ===== + +Additional IP Rights Grant (Patents) + +"This implementation" means the copyrightable works distributed by +Google as part of the Go project. + +Google hereby grants to You a perpetual, worldwide, non-exclusive, +no-charge, royalty-free, irrevocable (except as stated in this section) +patent license to make, have made, use, offer to sell, sell, import, +transfer and otherwise run, modify and propagate the contents of this +implementation of Go, where such license applies only to those patent +claims, both currently owned or controlled by Google and acquired in +the future, licensable by Google that are necessarily infringed by this +implementation of Go. This grant does not include claims that would be +infringed only as a consequence of further modification of this +implementation. If you or your agent or exclusive licensee institute or +order or agree to the institution of patent litigation against any +entity (including a cross-claim or counterclaim in a lawsuit) alleging +that this implementation of Go or any code incorporated within this +implementation of Go constitutes direct or contributory patent +infringement, or inducement of patent infringement, then any patent +rights granted to you under this License for this implementation of Go +shall terminate as of the date such litigation is filed. + + +===== Go go1.27.3 / src/runtime/memmove_amd64.s ===== + +Derived from Inferno's libkern/memmove-386.s (adapted for amd64) +https://bitbucket.org/inferno-os/inferno-os/src/master/libkern/memmove-386.s + +Copyright © 1994-1999 Lucent Technologies Inc. All rights reserved. +Revisions Copyright © 2000-2007 Vita Nuova Holdings Limited (www.vitanuova.com). All rights reserved. +Portions Copyright 2009 The Go Authors. All rights reserved. + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in +all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +THE SOFTWARE. + + +===== golang.org/x/net@v0.62.0 / LICENSE ===== + +Copyright 2009 The Go Authors. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are +met: + + * Redistributions of source code must retain the above copyright +notice, this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above +copyright notice, this list of conditions and the following disclaimer +in the documentation and/or other materials provided with the +distribution. + * Neither the name of Google LLC nor the names of its +contributors may be used to endorse or promote products derived from +this software without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + +===== golang.org/x/net@v0.62.0 / PATENTS ===== + +Additional IP Rights Grant (Patents) + +"This implementation" means the copyrightable works distributed by +Google as part of the Go project. + +Google hereby grants to You a perpetual, worldwide, non-exclusive, +no-charge, royalty-free, irrevocable (except as stated in this section) +patent license to make, have made, use, offer to sell, sell, import, +transfer and otherwise run, modify and propagate the contents of this +implementation of Go, where such license applies only to those patent +claims, both currently owned or controlled by Google and acquired in +the future, licensable by Google that are necessarily infringed by this +implementation of Go. This grant does not include claims that would be +infringed only as a consequence of further modification of this +implementation. If you or your agent or exclusive licensee institute or +order or agree to the institution of patent litigation against any +entity (including a cross-claim or counterclaim in a lawsuit) alleging +that this implementation of Go or any code incorporated within this +implementation of Go constitutes direct or contributory patent +infringement, or inducement of patent infringement, then any patent +rights granted to you under this License for this implementation of Go +shall terminate as of the date such litigation is filed. + + +===== golang.org/x/sys@v0.49.0 / LICENSE ===== + +Copyright 2009 The Go Authors. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are +met: + + * Redistributions of source code must retain the above copyright +notice, this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above +copyright notice, this list of conditions and the following disclaimer +in the documentation and/or other materials provided with the +distribution. + * Neither the name of Google LLC nor the names of its +contributors may be used to endorse or promote products derived from +this software without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + +===== golang.org/x/sys@v0.49.0 / PATENTS ===== + +Additional IP Rights Grant (Patents) + +"This implementation" means the copyrightable works distributed by +Google as part of the Go project. + +Google hereby grants to You a perpetual, worldwide, non-exclusive, +no-charge, royalty-free, irrevocable (except as stated in this section) +patent license to make, have made, use, offer to sell, sell, import, +transfer and otherwise run, modify and propagate the contents of this +implementation of Go, where such license applies only to those patent +claims, both currently owned or controlled by Google and acquired in +the future, licensable by Google that are necessarily infringed by this +implementation of Go. This grant does not include claims that would be +infringed only as a consequence of further modification of this +implementation. If you or your agent or exclusive licensee institute or +order or agree to the institution of patent litigation against any +entity (including a cross-claim or counterclaim in a lawsuit) alleging +that this implementation of Go or any code incorporated within this +implementation of Go constitutes direct or contributory patent +infringement, or inducement of patent infringement, then any patent +rights granted to you under this License for this implementation of Go +shall terminate as of the date such litigation is filed. + + +===== golang.org/x/text@v0.43.0 / LICENSE ===== + +Copyright 2009 The Go Authors. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are +met: + + * Redistributions of source code must retain the above copyright +notice, this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above +copyright notice, this list of conditions and the following disclaimer +in the documentation and/or other materials provided with the +distribution. + * Neither the name of Google LLC nor the names of its +contributors may be used to endorse or promote products derived from +this software without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + +===== golang.org/x/text@v0.43.0 / PATENTS ===== + +Additional IP Rights Grant (Patents) + +"This implementation" means the copyrightable works distributed by +Google as part of the Go project. + +Google hereby grants to You a perpetual, worldwide, non-exclusive, +no-charge, royalty-free, irrevocable (except as stated in this section) +patent license to make, have made, use, offer to sell, sell, import, +transfer and otherwise run, modify and propagate the contents of this +implementation of Go, where such license applies only to those patent +claims, both currently owned or controlled by Google and acquired in +the future, licensable by Google that are necessarily infringed by this +implementation of Go. This grant does not include claims that would be +infringed only as a consequence of further modification of this +implementation. If you or your agent or exclusive licensee institute or +order or agree to the institution of patent litigation against any +entity (including a cross-claim or counterclaim in a lawsuit) alleging +that this implementation of Go or any code incorporated within this +implementation of Go constitutes direct or contributory patent +infringement, or inducement of patent infringement, then any patent +rights granted to you under this License for this implementation of Go +shall terminate as of the date such litigation is filed. + + +===== google.golang.org/genproto/googleapis/rpc@v0.0.0-20260706201446-f0a921348800 / LICENSE ===== + + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. + + +===== google.golang.org/grpc@v1.84.0 / LICENSE ===== + + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. + + +===== google.golang.org/grpc@v1.84.0 / NOTICE.txt ===== + +Copyright 2014 gRPC authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. + + +===== google.golang.org/grpc@v1.84.0 / AUTHORS ===== + +Google Inc. + + +===== google.golang.org/protobuf@v1.36.12 / LICENSE ===== + +Copyright (c) 2018 The Go Authors. All rights reserved. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are +met: + + * Redistributions of source code must retain the above copyright +notice, this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above +copyright notice, this list of conditions and the following disclaimer +in the documentation and/or other materials provided with the +distribution. + * Neither the name of Google Inc. nor the names of its +contributors may be used to endorse or promote products derived from +this software without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + +===== google.golang.org/protobuf@v1.36.12 / PATENTS ===== + +Additional IP Rights Grant (Patents) + +"This implementation" means the copyrightable works distributed by +Google as part of the Go project. + +Google hereby grants to You a perpetual, worldwide, non-exclusive, +no-charge, royalty-free, irrevocable (except as stated in this section) +patent license to make, have made, use, offer to sell, sell, import, +transfer and otherwise run, modify and propagate the contents of this +implementation of Go, where such license applies only to those patent +claims, both currently owned or controlled by Google and acquired in +the future, licensable by Google that are necessarily infringed by this +implementation of Go. This grant does not include claims that would be +infringed only as a consequence of further modification of this +implementation. If you or your agent or exclusive licensee institute or +order or agree to the institution of patent litigation against any +entity (including a cross-claim or counterclaim in a lawsuit) alleging +that this implementation of Go or any code incorporated within this +implementation of Go constitutes direct or contributory patent +infringement, or inducement of patent infringement, then any patent +rights granted to you under this License for this implementation of Go +shall terminate as of the date such litigation is filed. + diff --git a/backend/check-licenses.sh b/backend/check-licenses.sh new file mode 100644 index 0000000..be5346a --- /dev/null +++ b/backend/check-licenses.sh @@ -0,0 +1,83 @@ +#!/usr/bin/env bash +# Review-pinned redistribution texts for the committed linux/amd64 executable. +set -euo pipefail +cd "$(dirname "$0")" +export GOTOOLCHAIN="${GOTOOLCHAIN:-local}" +export GOOS=linux GOARCH=amd64 GOAMD64=v1 GOEXPERIMENT= GOFLAGS=-mod=readonly +case "${1:-}" in + '') write=false ;; + --write) write=true ;; + *) echo 'Usage: bash backend/check-licenses.sh [--write]' >&2; exit 1 ;; +esac +test "$#" -le 1 +work=$(mktemp -d) +trap 'rm -rf "$work"' EXIT +fail() { echo "License check: $*" >&2; exit 1; } + +# A dependency/toolchain change requires reviewing its terms, not just accepting +# whatever LICENSE happens to exist. Include optional AUTHORS/PATENTS verbatim. +compiler=go1.27.3 +components=( + 'golang.org/x/net|v0.62.0|LICENSE PATENTS' + 'golang.org/x/sys|v0.49.0|LICENSE PATENTS' + 'golang.org/x/text|v0.43.0|LICENSE PATENTS' + 'google.golang.org/genproto/googleapis/rpc|v0.0.0-20260706201446-f0a921348800|LICENSE' + 'google.golang.org/grpc|v1.84.0|LICENSE NOTICE.txt AUTHORS' + 'google.golang.org/protobuf|v1.36.12|LICENSE PATENTS' +) +test "$(go env GOVERSION)" = "$compiler" || fail "Use reviewed compiler $compiler" +test "go$(awk '$1 == "go" {print $2}' go.mod)" = "$compiler" || fail 'Review the new go.mod compiler' +go version -m bin/starlinkd > "$work/metadata" +test "$(head -n 1 "$work/metadata")" = "bin/starlinkd: $compiler" || fail 'Binary compiler differs from reviewed compiler' +grep -Fq 'GOARCH=amd64' "$work/metadata" || fail 'Review the binary architecture' +grep -Fq 'GOOS=linux' "$work/metadata" || fail 'Review the binary OS' +if grep -Eq '^[[:space:]]*=>' "$work/metadata"; then + fail 'Module replacements require notice review' +fi +awk '$1 == "dep" {print $2 "|" $3}' "$work/metadata" | sort > "$work/actual" +printf '%s\n' "${components[@]}" | cut -d '|' -f 1,2 | sort > "$work/expected" +cmp -s "$work/actual" "$work/expected" || fail 'Linked module inventory changed; review dependency licenses' + +append() { + local component=$1 source=$2 file=$3 + test -s "$source" || fail "Missing upstream text: $component/$file" + printf '\n===== %s / %s =====\n\n' "$component" "$file" >> "$work/notices" + cat "$source" >> "$work/notices" + printf '\n' >> "$work/notices" +} +cat > "$work/notices" <<'EOF' +Third-party notices for backend/bin/starlinkd (linux/amd64) + +Dishy's own code is MIT-licensed; see ../LICENSE. The statically linked +components below retain their upstream terms. These texts accompany the +executable in the plugin checkout; retain them when redistributing it. +Generated by check-licenses.sh from the reviewed compiler/module versions. +EOF +goroot=$(go env GOROOT) +append "Go $compiler" "$goroot/LICENSE" LICENSE +append "Go $compiler" "$goroot/PATENTS" PATENTS +# The amd64 runtime also contains Inferno-derived assembly. Retain its complete +# copyright/permission header, not just Go's top-level BSD license. +sed -n '1,24s@^// *@@p' "$goroot/src/runtime/memmove_amd64.s" > "$work/runtime-notice" +grep -Fq 'Lucent Technologies' "$work/runtime-notice" || fail 'Review the runtime assembly notice' +grep -Fq 'THE SOFTWARE.' "$work/runtime-notice" || fail 'Runtime assembly notice is incomplete' +append "Go $compiler" "$work/runtime-notice" src/runtime/memmove_amd64.s +for component in "${components[@]}"; do + IFS='|' read -r module version files <<< "$component" + go list -m -json "$module" > "$work/module" + jq -e --arg m "$module" --arg v "$version" \ + '.Path == $m and .Version == $v and .Replace == null' "$work/module" > /dev/null \ + || fail "Resolved module differs: $module@$version" + dir=$(jq -er .Dir "$work/module") + for file in $files; do + append "$module@$version" "$dir/$file" "$file" + done +done +if "$write"; then + # Validate everything before replacing the distributed file. + install -m 644 "$work/notices" THIRD_PARTY_NOTICES.txt +else + cmp -s THIRD_PARTY_NOTICES.txt "$work/notices" \ + || fail 'THIRD_PARTY_NOTICES.txt missing/stale; review, then run check-licenses.sh --write' +fi +echo "Bundled license/notice check passed ($compiler, ${#components[@]} modules)" diff --git a/backend/test-licenses.sh b/backend/test-licenses.sh new file mode 100644 index 0000000..230ab2b --- /dev/null +++ b/backend/test-licenses.sh @@ -0,0 +1,73 @@ +#!/usr/bin/env bash +# Isolated negative cases; never modify the checkout's binary or notices. +set -euo pipefail +cd "$(dirname "$0")" +work=$(mktemp -d) +trap 'rm -rf "$work"' EXIT +mkdir -p "$work/backend" "$work/tools" "$work/grpc" +cp check-licenses.sh THIRD_PARTY_NOTICES.txt go.mod go.sum "$work/backend/" +go version -m bin/starlinkd > "$work/original-metadata" +export REAL_GO +REAL_GO=$(command -v go) +export LICENSE_TEST_WORK="$work" +cat > "$work/tools/go" <<'EOF' +#!/usr/bin/env bash +set -euo pipefail +if [ "$*" = 'version -m bin/starlinkd' ]; then + cat "$LICENSE_TEST_WORK/metadata" +elif [ "$*" = 'list -m -json google.golang.org/grpc' ] && [ -f "$LICENSE_TEST_WORK/missing-upstream" ]; then + "$REAL_GO" "$@" | jq --arg d "$LICENSE_TEST_WORK/grpc" '.Dir = $d' +else + exec "$REAL_GO" "$@" +fi +EOF +chmod +x "$work/tools/go" +export PATH="$work/tools:$PATH" +reset_fixture() { + cp "$work/original-metadata" "$work/metadata" + cp THIRD_PARTY_NOTICES.txt "$work/backend/" + rm -f "$work/missing-upstream" +} +reject() { + if (cd "$work/backend"; bash check-licenses.sh) > "$work/rejected.log" 2>&1; then + echo "License check accepted: $1" >&2; exit 1 + fi + grep -Fq "$2" "$work/rejected.log" + echo "Rejected: $1" +} +reset_fixture +(cd "$work/backend"; bash check-licenses.sh) +rm "$work/backend/THIRD_PARTY_NOTICES.txt" +reject 'missing distributed notices' 'THIRD_PARTY_NOTICES.txt missing/stale' +reset_fixture +sed -i '/Copyright 2014 gRPC authors./d' "$work/backend/THIRD_PARTY_NOTICES.txt" +reject 'removed grpc attribution' 'THIRD_PARTY_NOTICES.txt missing/stale' +reset_fixture +sed -i '/dep.*google.golang.org\/grpc/d' "$work/metadata" +reject 'missing linked component' 'Linked module inventory changed' +reset_fixture +printf '\tdep\texample.com/new\tv1.0.0\th1:test\n' >> "$work/metadata" +reject 'unreviewed dependency' 'Linked module inventory changed' +reset_fixture +sed -i 's/v1.84.0/v1.84.1/g' "$work/metadata" +reject 'unreviewed dependency version' 'Linked module inventory changed' +reset_fixture +printf '\t=>\texample.com/replacement\tv1.0.0\th1:test\n' >> "$work/metadata" +reject 'module replacement' 'Module replacements require notice review' +reset_fixture +sed -i '1s/go1.27.3/go1.27.2/' "$work/metadata" +reject 'different bundled compiler' 'Binary compiler differs' +reset_fixture +dir=$("$REAL_GO" list -m -f '{{.Dir}}' google.golang.org/grpc) +cp "$dir/LICENSE" "$work/grpc/" +touch "$work/missing-upstream" +reject 'missing required upstream NOTICE' 'Missing upstream text: google.golang.org/grpc@v1.84.0/NOTICE.txt' +before=$(sha256sum "$work/backend/THIRD_PARTY_NOTICES.txt") +if (cd "$work/backend"; bash check-licenses.sh --write) > "$work/write.log" 2>&1; then + echo 'Generator accepted missing upstream NOTICE' >&2; exit 1 +fi +test "$before" = "$(sha256sum "$work/backend/THIRD_PARTY_NOTICES.txt")" +reset_fixture +(cd "$work/backend"; bash check-licenses.sh --write; bash check-licenses.sh) +cmp THIRD_PARTY_NOTICES.txt "$work/backend/THIRD_PARTY_NOTICES.txt" +echo 'License inventory, notice integrity, and generation tests passed' diff --git a/backend/verify-release.sh b/backend/verify-release.sh index 5c8c4a3..3ce1d56 100644 --- a/backend/verify-release.sh +++ b/backend/verify-release.sh @@ -11,6 +11,8 @@ work=$(mktemp -d) trap 'rm -rf "$work"' EXIT go mod verify +bash ./check-licenses.sh +bash ./test-licenses.sh # Fresh code generation + rebuild, without replacing the committed artifact. OUTPUT="$work/starlinkd" VERSION="$version" bash ./build.sh cmp bin/starlinkd "$work/starlinkd" || { echo "Bundled binary does not match source/toolchain/manifest; rebuild it." >&2; exit 1; }