| // Copyright 2021 Google LLC |
| // |
| // Licensed under the Apache License, Version 2.0 (the "License"); |
| // you may not use this file except in compliance with the License. |
| // You may obtain a copy of the License at |
| // |
| // http://www.apache.org/licenses/LICENSE-2.0 |
| // |
| // Unless required by applicable law or agreed to in writing, software |
| // distributed under the License is distributed on an "AS IS" BASIS, |
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| // See the License for the specific language governing permissions and |
| // limitations under the License. |
| /* |
| |
| Package compliance provides an approved means for reading, consuming, and |
| analyzing license metadata graphs. |
| |
| Assuming the license metadata and dependencies are fully and accurately |
| recorded in the build system, any discrepancy between the official policy for |
| open source license compliance and this code is a bug in this code. |
| |
| A few principal types to understand are LicenseGraph, LicenseCondition, and |
| ResolutionSet. |
| |
| LicenseGraph |
| ------------ |
| |
| A LicenseGraph is an immutable graph of the targets and dependencies reachable |
| from a specific set of root targets. In general, the root targets will be the |
| artifacts in a release or distribution. While conceptually immutable, parts of |
| the graph may be loaded or evaluated lazily. |
| |
| LicenseCondition |
| ---------------- |
| |
| A LicenseCondition is an immutable tuple pairing a condition name with an |
| originating target. e.g. Per current policy, a static library licensed under an |
| MIT license would pair a "notice" condition with the static library target, and |
| a dynamic license licensed under GPL would pair a "restricted" condition with |
| the dynamic library target. |
| |
| ResolutionSet |
| ------------- |
| |
| A ResolutionSet is an immutable set of `AttachesTo`, `ActsOn`, `Resolves` |
| tuples describing how license conditions apply to targets. |
| |
| `AttachesTo` is the trigger for acting. Distribution of the target invokes |
| the policy. |
| |
| `ActsOn` is the target to share, give notice for, hide etc. |
| |
| `Resolves` is the license condition that the action resolves. |
| |
| Remember: Each license condition pairs a condition name with an originating |
| target so each resolution in a ResolutionSet has two targets it applies to and |
| one target from which it originates, all of which may be the same target. |
| |
| For most condition types, `ActsOn` and `Resolves.Origin` will be the same |
| target. For example, a notice condition policy means attribution or notice must |
| be given for the target where the condition originates. Likewise, a proprietary |
| condition policy means the privacy of the target where the condition originates |
| must be respected. i.e. The thing acted on is the origin. |
| |
| Restricted conditions are different. The infectious nature of restricted often |
| means sharing code that is not the target where the restricted condition |
| originates. Linking an MIT library to a GPL library implies a policy to share |
| the MIT library despite the MIT license having no source sharing requirement. |
| |
| In this case, one or more resolution tuples will have the MIT license module in |
| `ActsOn` and the restricted condition originating at the GPL library module in |
| `Resolves`. These tuples will `AttachTo` every target that depends on the GPL |
| library because shipping any of those targets trigger the policy to share the |
| code. |
| */ |
| package compliance |