mengw15 opened a new issue, #8985:
URL: https://github.com/apache/texera/issues/8985
### Task Summary
Part of #8800. Two gaps let these files in unnoticed:
- The license header check (`check-header.yml`) skips binary files, so an
image or video can be added without anyone recording where it came from.
- Nothing checks that files `.licenserc.yaml` excludes with the comment "see
LICENSE file for attribution" are actually listed in `LICENSE`. That is how
`jupyter-logo.svg` slipped through on `release/v1.3`.
Proposed fix:
1. Add a provenance manifest at the repository root, with one entry per
image or media file: its path, its origin (`project-made`, `third-party` or
`unknown`), and for third-party files the source and licence. The manifest
ships in the source release, so release voters can check it.
2. Add a step to `check-header.yml` that fails when:
- an image or media file in the repository has no manifest entry;
- a `third-party` entry is missing from `LICENSE`, or from
`frontend/LICENSE-binary` for files under `frontend/`;
- a path that `.licenserc.yaml` excludes as "see LICENSE file for
attribution" is missing from `LICENSE`.
3. Add a `test_*.sh` for the check under `.github/scripts/`, so the existing
infra job runs it.
This does not have to wait for the audit in #8984. Files whose source is not
known yet are entered as `unknown`. New files are covered right away, the
`unknown` entries become the audit's to-do list, and a `DISCLAIMER-WIP`, if one
is needed, can point to them.
### Task Type
- [ ] Refactor / Cleanup
- [x] DevOps / Deployment / CI
- [ ] Testing / QA
- [x] Documentation
- [ ] Performance
- [ ] Other
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
