fix(supply-chain): separate MIT and bundled-font licenses - #270
Draft
seonghobae wants to merge 4 commits into
Draft
fix(supply-chain): separate MIT and bundled-font licenses#270seonghobae wants to merge 4 commits into
seonghobae wants to merge 4 commits into
Conversation
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
Author
|
Exact-current-head read-only review request for Direct exact-head gates are complete: CI @coderabbitai review Review only. Do not mutate the branch, dispatch repair writers, reuse predecessor/stale/synthetic evidence, or synthesize author approval. Bind findings and verdicts to this exact unchanged head. |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head='b2c6b6eb7b9638051688939b722a1094c97da013'
base='a430b1c153702de3b6439def801732d7453b4940'
echo '== Revision identities =='
git rev-parse HEAD
git cat-file -t "$head"
git cat-file -t "$base"
git merge-base --is-ancestor "$base" "$head" && echo 'base-is-ancestor=yes' || echo 'base-is-ancestor=no'
echo '== Changed paths and diff summary =='
git diff --name-status "$base" "$head"
git diff --stat "$base" "$head"
git diff --check "$base" "$head"
git diff -- "$base" "$head" -- LICENSE package.json src/fonts/NOTICE src/fonts/OFL.txt 2>/dev/null || true
echo '== Root LICENSE canonical MIT comparison =='
expected="$(mktemp)"
cat > "$expected" <<'EOF'
MIT License
Copyright (c) 2026 Inkspan Contributors
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
EOF
if diff -u "$expected" LICENSE; then
echo 'root-license-canonical-mit=yes'
else
echo 'root-license-canonical-mit=no'
fi
rm -f "$expected"
echo '== Font-license evidence =='
printf 'NOTICE Noto occurrences: '
rg -n -i 'Noto(\s+Sans)?' src/fonts/NOTICE || true
printf 'OFL reserved-font-name occurrences: '
rg -n 'Reserved Font Name|Noto Sans' src/fonts/OFL.txt || true
printf 'OFL version markers: '
rg -n 'SIL OPEN FONT LICENSE|Version 1\.1|PREAMBLE|TERMS AND CONDITIONS' src/fonts/OFL.txt || true
wc -l src/fonts/NOTICE src/fonts/OFL.txt
echo '== npm manifest evidence =='
jq '{license, files, version, dependencies, devDependencies, exports, main, module, types}' package.json
echo '== Package-related changed manifest fields =='
git diff -U0 "$base" "$head" -- package.json
echo '== Non-scope changes excluding license evidence =='
git diff --name-only "$base" "$head" -- . ':!LICENSE' ':!package.json' ':!src/fonts/NOTICE' ':!src/fonts/OFL.txt'Length of output: 8196 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='b2c6b6eb7b9638051688939b722a1094c97da013'
base='a430b1c153702de3b6439def801732d7453b4940'
echo '== Test structure =='
ast-grep outline src/licenseBoundary.test.ts --items all
echo '== Added test content =='
cat -n src/licenseBoundary.test.ts
echo '== License content at base and head =='
echo '-- base LICENSE --'
git show "${base}:LICENSE" | cat -n
echo '-- head LICENSE --'
git show "${head}:LICENSE" | cat -n
echo '== Corrected canonical MIT comparison =='
expected="$(mktemp)"
cat > "$expected" <<'EOF'
MIT License
Copyright (c) 2026 ContextualWisdomLab
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
EOF
diff -u "$expected" LICENSE && echo 'root-license-canonical-mit=yes'
rm -f "$expected"
echo '== Exact package contract comparison =='
for key in version license dependencies devDependencies peerDependencies optionalDependencies exports main module types files; do
before="$(git show "${base}:package.json" | jq -c --arg key "$key" '.[$key]')"
after="$(git show "${head}:package.json" | jq -c --arg key "$key" '.[$key]')"
if [ "$before" = "$after" ]; then
printf '%s=unchanged\n' "$key"
else
printf '%s=CHANGED\n' "$key"
fi
done
echo '== Test references to requested evidence =='
rg -n -C 2 'LICENSE|MIT|NOTICE|OFL|Noto|package\.json|license|files|src/fonts' src/licenseBoundary.test.tsLength of output: 10800 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/inkspan'
head='b2c6b6eb7b9638051688939b722a1094c97da013'
echo '== Exact-head GitHub Actions runs =='
for run_id in 31590591645 31590591555 31590591516; do
gh api "repos/${repo}/actions/runs/${run_id}" \
--jq '[.id, .name, .head_sha, .status, .conclusion] | `@tsv`'
done
echo '== Retained OFL text has no changes from the protected base =='
git diff --quiet a430b1c153702de3b6439def801732d7453b4940 "$head" -- src/fonts/OFL.txt \
&& echo 'ofl-unchanged-from-base=yes' \
|| echo 'ofl-unchanged-from-base=no'Length of output: 1082 🤖 web_search executed:
Length of output: 10588 🏁 Script executed: #!/bin/bash
set -euo pipefail
reference="$(mktemp)"
repository_terms="$(mktemp)"
reference_terms="$(mktemp)"
trap 'rm -f "$reference" "$repository_terms" "$reference_terms"' EXIT
curl --fail --silent --show-error --location \
'https://openfontlicense.org/open-font-license-official-text/OFL.txt' \
-o "$reference"
echo '== Official reference identity =='
sed -n '1,20p' "$reference"
echo '== Compare standard OFL-1.1 terms =='
sed -n '/^SIL OPEN FONT LICENSE Version 1\.1 - 26 February 2007$/,$p' \
src/fonts/OFL.txt > "$repository_terms"
sed -n '/^SIL OPEN FONT LICENSE Version 1\.1 - 26 February 2007$/,$p' \
"$reference" > "$reference_terms"
if diff -u "$reference_terms" "$repository_terms"; then
echo 'ofl-standard-terms-exact=yes'
else
echo 'ofl-standard-terms-exact=no'
fiLength of output: 1154 🏁 Script executed: #!/bin/bash
set -euo pipefail
page="$(mktemp)"
trap 'rm -f "$page"' EXIT
curl --fail --silent --show-error --location \
--user-agent 'Mozilla/5.0 (compatible; CodeRabbit review)' \
'https://openfontlicense.org/open-font-license-official-text/' \
-o "$page"
echo '== Official OFL page title and text-download candidates =='
rg -n -i -C 1 '<title>|OFL\.txt|plaintext|plain text|download' "$page" | head -n 120Length of output: 6977 🏁 Script executed: #!/bin/bash
set -euo pipefail
reference="$(mktemp)"
repository_terms="$(mktemp)"
reference_terms="$(mktemp)"
trap 'rm -f "$reference" "$repository_terms" "$reference_terms"' EXIT
curl --fail --silent --show-error --location \
--user-agent 'Mozilla/5.0 (compatible; CodeRabbit review)' \
'https://openfontlicense.org/documents/OFL.txt' \
-o "$reference"
sed -n '/^SIL OPEN FONT LICENSE Version 1\.1 - 26 February 2007$/,$p' \
src/fonts/OFL.txt > "$repository_terms"
sed -n '/^SIL OPEN FONT LICENSE Version 1\.1 - 26 February 2007$/,$p' \
"$reference" > "$reference_terms"
echo '== Official reference header =='
sed -n '1,16p' "$reference"
echo '== Exact standard-terms comparison =='
if diff -u "$reference_terms" "$repository_terms"; then
echo 'ofl-standard-terms-exact=yes'
else
echo 'ofl-standard-terms-exact=no'
fiLength of output: 2344 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== Trailing whitespace in bundled OFL text =='
rg -n '[ \t]+$' src/fonts/OFL.txt || trueLength of output: 379
I reviewed
I kept this review distinct from protected-main verification and approval authority, as required by the repository guidance. 🧠 Learnings used
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #269.
Product boundary
This Draft separates the root software license from bundled-font license evidence without changing either license.
LICENSEis exact canonical MIT text for the Inkspan software. Noto Sans attribution and complete OFL-1.1 terms remain insrc/fonts/NOTICEandsrc/fonts/OFL.txt. The npm manifest remainslicense: MITand continues to package both rootLICENSEandsrc/fonts.Test-first lineage
Protected base is the unchanged release candidate
main@a430b1c153702de3b6439def801732d7453b4940.961597fe6431452a8ba89d513b6ae236abcc2e9frequired exact canonical root MIT text while separately requiring Noto/OFL evidence.31589849372failed at the intended root-license assertion: the protected root file contained canonical MIT text plus an appended bundled-font section. The font attribution and OFL assertions passed.c3ce70a527e19c06e41b7d82d369ee8fd5fa402dremoved only the appended bundled-font section from rootLICENSE.license: MITplusLICENSEandsrc/fontsin the npmfilescontract.Exact current-head evidence
b2c6b6eb7b9638051688939b722a1094c97da013;31590591645: success on this exact head, including the canonical license, separate font terms, package-manifest evidence and existing repository acceptance suite;31590591555: queued at the latest inspection and not counted as passing;31590591516: queued at the latest inspection and not counted as passing;Invariants preserved
This is machine-readable supply-chain evidence and license-file separation, not a license change or legal advice.
Integration boundary
Keep Draft and unmerged while #118 owns the unchanged protected 0.6.0 candidate. After later protected integration, operational acceptance must verify GitHub identifies the repository software license as MIT and that the published npm artifact still contains both MIT and OFL evidence. Exact-head Security/Semgrep, current review, zero valid unresolved findings, independent approval and all repository gates remain required before any eventual merge decision.