2020-12-10 18:45:56 +03:00
|
|
|
# Open Source Software Compliance
|
2020-12-07 22:59:39 +03:00
|
|
|
|
2020-12-10 18:45:56 +03:00
|
|
|
## Overview
|
2020-12-07 22:59:39 +03:00
|
|
|
|
2020-12-10 18:45:56 +03:00
|
|
|
We currently use an asynchronous, daily cron job to check the compliance of our
|
|
|
|
|
libraries (and check for vulnerabilities at the same time). If the NOTICES file
|
|
|
|
|
needs changing, the cron job will generate a PR to update it.
|
2020-12-07 22:59:39 +03:00
|
|
|
|
2020-12-10 18:45:56 +03:00
|
|
|
The cron job leverages Bazel to generate the list of dependencies, and relies
|
|
|
|
|
on BlackDuck to flag license violations and security advisories.
|
2020-12-07 22:59:39 +03:00
|
|
|
|
2020-12-10 18:45:56 +03:00
|
|
|
## Licenses
|
2020-12-07 22:59:39 +03:00
|
|
|
|
2020-12-10 18:45:56 +03:00
|
|
|
Which licenses are or are not acceptable is maanged at the Blackduck level.
|
2020-12-07 22:59:39 +03:00
|
|
|
|
2020-12-10 18:45:56 +03:00
|
|
|
## What if the check fails?
|
2020-12-07 22:59:39 +03:00
|
|
|
|
2020-12-10 18:45:56 +03:00
|
|
|
Checks can fail for a number of reasons. Here are the common ones:
|
2020-12-07 22:59:39 +03:00
|
|
|
|
2020-12-10 18:45:56 +03:00
|
|
|
- A library is using a license we don't allow. Check with security & legal to
|
|
|
|
|
see if the license can be added; if not, remove the dependency.
|
|
|
|
|
- A library is incorrectly classified on BlackDuck: it should have an allowed
|
|
|
|
|
license, but somehow the information on BlackDuck disagrees with that.
|
|
|
|
|
Contact Security to sort it out.
|
|
|
|
|
- A library triggers a security notice. That will depend on the specific issue;
|
|
|
|
|
in general, upgrading the library may help.
|
