Record vendored licenses and split future syncs in two - #424
Merged
Conversation
An audit of a vendored tree needs to answer two questions the table could not: what license the code arrived under, and when it was taken. The license each package declares and the date the copy landed are now columns beside the upstream commit that supplies the other half of the provenance. The sync procedure now lands the pristine upstream copy and the re-applied patches as separate commits, so the unmodified upstream state is something an auditor can check out rather than reconstruct by subtracting a ledger from a merged tree.
It landed as two commits split by package, not one. The point stands either way — neither isolates an unmodified upstream tree — but a checkable claim that is wrong costs the reader's trust in the rest of the table.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The vendoring table recorded the upstream commit but not what license the code arrived under or when it was taken — both of which an audit needs, and neither of which is derivable from the hash alone. Adds them as columns, and notes that each vendored tree carries its own LICENSE untouched.
Also changes the re-sync procedure to land the pristine upstream copy and the re-applied patches as two commits rather than one. The unmodified upstream state then becomes a checkout instead of a reconstruction. The most recent sync landed as a single commit and does not have this property, which is what makes its patch ledger load-bearing rather than descriptive — the doc now says so.